great-tk: WISPr

2015年4月19日日曜日

IAP/AOS:WISPR RADIUS Authentication&Accounting

Aruba-AP-Group is
Aruba-Location-ID is IAP's MAC address

IAP's WISPr RADIUS Authentication & Accounting thru ClearPass

Username:

user1

End-Host Identifier:

0811968a546c

Access Device IP/Port:

10.215.1.39:0

RADIUS Request

Radius:Aruba:Aruba-AP-Group	instant-C5:86:02
Radius:Aruba:Aruba-Essid-Name	Yokohama-Wi-Fi
Radius:Aruba:Aruba-Location-Id	6c:f3:7f:c5:35:68
Radius:IETF:Called-Station-Id	6cf37fc53568
Radius:IETF:Calling-Station-Id	0811968a546c
Radius:IETF:NAS-IP-Address	10.215.1.39
Radius:IETF:NAS-Port	0
Radius:IETF:NAS-Port-Type	19
Radius:IETF:Service-Type	1
Radius:IETF:User-Name	user1
Radius:WISPr:WISPr-Location-ID	isocc=JP,cc=81,ac=0,network=Yokohama-Wi-Fi
Radius:WISPr:WISPr-Location-Name	Wi2Connect,Yokohama-Wi-Fi
Radius:WISPr:WISPr-Logoff-URL	https://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout

Computed Attributes

Authentication:ErrorCode	0
Authentication:Full-Username	user1
Authentication:Full-Username-Normalized	user1
Authentication:MacAuth	NotApplicable
Authentication:OuterMethod	PAP
Authentication:Posture	Unknown
Authentication:Source	[Local User Repository]
Authentication:Status	User
Authentication:Username	user1
Authorization:Sources	[Local User Repository]
Connection:AP-Mac	6cf37fc53568
Connection:Client-Mac-Address	0811968a546c
Connection:Client-Mac-Address-Colon	08:11:96:8a:54:6c
Connection:Client-Mac-Address-Dot	0811.968a.546c
Connection:Client-Mac-Address-Hyphen	08-11-96-8a-54-6c
Connection:Client-Mac-Address-NoDelim	0811968a546c
Connection:Client-Mac-Vendor	Intel Corporate
Connection:Dest-IP-Address	10.215.107.105
Connection:Dest-Port	1812
Connection:NAD-IP-Address	10.215.1.39
Connection:Protocol	RADIUS
Connection:Src-IP-Address	10.215.1.39
Connection:Src-Port	49160
Connection:SSID	Yokohama-Wi-Fi

Account Session ID:

6CF37FD35694-0811968A546C-552CA6C5

Start Timestamp:

Apr 14, 2015 14:33:57 JST

End Timestamp:

Apr 14, 2015 14:35:22 JST

Status:

Inactive

Termination Cause:

Admin-Reset

Service Type:

Number of Authentication Sessions:

Network Details

NAS IP Address:	10.215.1.39:0
NAS Port Type:	Wireless-802.11
Calling Station ID:	0811968a546c
Called Station ID:	6cf37fc53568
Framed IP Address:	10.215.1.95
Account Auth:	-

Utilization

Active Time:	85 Sec
Account Delay Time:	-
Account Input Octets :	566288
Account Output Octets :	768014
Account Input Packets :	1601
Account Output Packets :	1065

Authentication Sessions Details

SessionId	Type	Time Stamp
R00000052-01-552ca6c5	initial	Apr 14, 2015 14:33:57 JST

6c:f3:7f:c5:35:68# show ap bss-table

Aruba AP BSS Table

------------------

bss ess port ip phy type ch/EIRP/max-EIRP cur-cl ap name in-t(s) tot-t

--- --- ---- -- --- ---- ---------------- ------ ------- ------- -----

6c:f3:7f:d3:56:90 IAP-guest ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:51s

6c:f3:7f:d3:56:92 TK-IAP-205-1 ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:43s

6c:f3:7f:d3:56:93 TK-IAP-205-EAP ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:94 Yokohama-Wi-Fi ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:95 wayport ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

6c:f3:7f:d3:56:96 Wayport_Access ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

6c:f3:7f:d3:56:80 IAP-guest ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:47s

6c:f3:7f:d3:56:82 TK-IAP-205-1 ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:83 TK-IAP-205-EAP ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:84 Yokohama-Wi-Fi ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:85 wayport ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

6c:f3:7f:d3:56:86 Wayport_Access ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

Channel followed by "*" indicates channel selected due to unsupported configured channel.

"Spectrum" followed by "^" indicates Local Spectrum Override in effect.

Num APs:12

Num Associations:0

6c:f3:7f:c5:35:68# show summary

Name :instant-C5:86:02
System Location :
Domain :JP3
VC IP Address :10.215.1.206
VC VLAN :0
VC Mask :0.0.0.0
VC Gateway :0.0.0.0
Content Filtering :disable
Terminal Access :enable
Telnet Server :enable
Organization :Shimbashi
Airwave Server :10.215.1.103
Airwave Backup Server:
Airwave Prov Backup :
Number of VC transition :0
Airwave Shared Key :f9011638d60b55ebf3c9bf0ca7fd20c48c529a62a9a29f2b
Airwave Config Via :UI
Airwave :Connected
Airwave Mode :Monitor
Aruba Central Server :
Aruba Central :Not Set Up
Managed Via :Airwave
Syslog Server :10.215.200.97
Syslog Level :debug
Band :all
Master IP Address *:10.215.1.39
IP Address :10.215.1.39
Netmask :255.255.255.0
Gateway :10.215.1.254
NameServer :10.44.10.10
NameServer :10.44.11.10

DNSDomain :arubanetworks.com

IAP's Condiguration:

wlan ssid-profile Yokohama-Wi-Fi
enable
index 4
type guest
essid Yokohama-Wi-Fi
opmode opensystem
max-authentication-failures 0
auth-server External-RADIUS
rf-band all
captive-portal external profile ClearPass
wispr
dtim-period 1
inactivity-timeout 1000
broadcast-filter arp
radius-accounting
dmo-channel-utilization-threshold 90
local-probe-req-thresh 0
max-clients-threshold 64
wmm-video-share 50
wmm-voice-share 50
!
wlan wispr-profile
wispr-location-name-operator-name Wi2Connect
wispr-location-name-location Yokohama-Wi-Fi
wispr-location-id-network Yokohama-Wi-Fi
wispr-location-id-cc 81
wispr-location-id-ac 0

wispr-location-id-isocc JP

2015年4月14日火曜日

IAP: IAP WISPr

WISPrの良さはクライアントSWを入れているため、無線LANのMACアドレスが確実に取れる。センター設備でCaptive-portalは通常L2接続をクライアントまであれば、MACアドレス情報がとれるが、L3の場合はとれない。WISPrであれば、L3になってもクライアントのMACアドレス情報が取得可能。

The generic guide specifies WISPr 1.0 specification.

http://www.ipass.com/wp-content/uploads/2011/10/Generic_Interface_Specification.pdf

Login Method:

curl -A Wi2Connect -v "https://securelogin.arubanetworks.com/cgi-bin/login?cmd=login&mac=8c:29:37:ee:28:9c&ip=10.215.1.95&opcode=wispr&if;" -d "UserName=user1" -d "Password=aruba123" -d "button=Login" -d "OriginatingServer=/test/login/redirect" -k

curl -A iPassConnect -v "https://securelogin.arubanetworks.com/cgi-bin/login?cmd=login&mac=8c:29:37:ee:28:9c&ip=10.215.1.95&opcode=wispr&if;" -d "UserName=user1" -d "Password=aruba123" -d "button=Login" -d "OriginatingServer=/test/login/redirect" -k

Logoff Method:

curl -A Wi2Connect -v "http://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.95&opcode=wispr" -k

curl -A Wi2Connect -v "https://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.95&opcode=wispr" -k

curl -A iPassConnect -v "http://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.95&opcode=wispr" -k

curl -A iPassConnect -v "https://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.95&opcode=wispr" -k

以下のLogoffメソッドは失敗する！

curl -A Wi2Connect -v "http://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.90&opcode=wispr" -k

curl -A Wi2Connect -v "https://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.90&opcode=wispr" -k

Testing:

Curl windows版

http://curl.haxx.se/gknw.net/7.40.0/dist-w32/curl-7.40.0-rtmp-ssh2-ssl-sspi-zlib-idn-static-bin-w32.zip

C:\curl>curl -A Wi2Connect -v "https://securelogin.arubanetworks.com/cgi-bin/log

in?cmd=login&mac=8c:29:37:ee:28:9c&ip=10.215.1.95&opcode=wispr&if;"

-d "UserName=user1" -d "Password=aruba123" -d "button=Login" -d "OriginatingServ

er=/wi2free/login/redirect" -k

* Trying 172.31.98.1...

* Connected to securelogin.arubanetworks.com (172.31.98.1) port 443 (#0)

* TLSv1.0, TLS handshake, Client hello (1):

* TLSv1.0, TLS handshake, Server hello (2):

* TLSv1.0, TLS handshake, CERT (11):

* TLSv1.0, TLS handshake, Server finished (14):

* TLSv1.0, TLS handshake, Client key exchange (16):

* TLSv1.0, TLS change cipher, Client hello (1):

* TLSv1.0, TLS handshake, Finished (20):

* TLSv1.0, TLS change cipher, Client hello (1):

* TLSv1.0, TLS handshake, Finished (20):

* SSL connection using TLSv1.0 / AES128-SHA

* Server certificate:

* subject: serialNumber=lLUge2fRPkWcJe7boLSVdsKOFK8wv3MF; C=US; O=securel

ogin.arubanetworks.com; OU=GT28470348; OU=See www.geotrust.com/resources/cps (c)

11; OU=Domain Control Validated - QuickSSL(R) Premium; CN=securelogin.arubanetwo

rks.com

* start date: 2011-05-11 01:22:10 GMT

* expire date: 2017-08-11 04:40:59 GMT

* issuer: C=US; O=GeoTrust Inc.; OU=Domain Validated SSL; CN=GeoTrust DV

SSL CA

* SSL certificate verify result: self signed certificate in certificate c

hain (19), continuing anyway.

> POST /cgi-bin/login?cmd=login&mac=8c:29:37:ee:28:9c&ip=10.215.1.95&amp

;opcode=wispr&if; HTTP/1.1

> User-Agent: Wi2Connect

> Host: securelogin.arubanetworks.com

> Accept: */*

> Content-Length: 87

> Content-Type: application/x-www-form-urlencoded

* upload completely sent off: 87 out of 87 bytes

* HTTP 1.0, assume close after body

< HTTP/1.0 200 OK

< Transfer-Encoding: chunked

< Content-Type:text/html;

<html> <!--<?xml version="1.0" encoding="UTF-8"?><WISPAccessGatewayParam xmlns:x

si="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="ht

tp://us-rws-gw.ipass.com/pages/WISPAccessGatewayParam.xsd"><AuthenticationReply>

<MessageType>120</MessageType><ResponseCode>50</ResponseCode><LogoffURL>http://s

ecurelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.95&opc

ode=wispr</LogoffURL></AuthenticationReply></WISPAccessGatewayParam>--> </html>*

Closing connection 0

* TLSv1.0, TLS alert, Client hello (1):

C:\curl>curl -A Wi2Connect -v "http://securelogin.arubanetworks.com/cgi-bin/logi

n?cmd=logout&ip=10.215.1.95&opcode=wispr" -k

* Trying 172.31.98.1...

* Connected to securelogin.arubanetworks.com (172.31.98.1) port 80 (#0)

> GET /cgi-bin/login?cmd=logout&ip=10.215.1.95&opcode=wispr HTTP/1.1

> User-Agent: Wi2Connect

> Host: securelogin.arubanetworks.com

> Accept: */*

* Recv failure: Connection was reset

* Closing connection 0

curl: (56) Recv failure: Connection was reset

Summary:

------------------------------------------------

In RADIUS attribute, IAP shows the logoff-URL below:

WISPr-Logoff-URL = https://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout

In the WISPr exchange, the logoffURL is displayed below:

<LogoffURL>http://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout&ip=10.215.1.90&op

ode=wispr</LogoffURL>

------------------------------------------------

IAP's configuration:

wlan ssid-profile wayport

enable

index 5

type guest

essid wayport

opmode opensystem

max-authentication-failures 0

vlan guest

auth-server External-RADIUS

rf-band all

captive-portal external profile ClearPass

wispr

dtim-period 1

inactivity-timeout 1000

broadcast-filter arp

radius-accounting

dmo-channel-utilization-threshold 90

local-probe-req-thresh 0

max-clients-threshold 64

wlan auth-server External-RADIUS

ip 10.215.107.105

port 1812

acctport 1813

key 0259b9c674ce44ab90a5c58c83891d477920233c77236862

rfc3576

cppm-rfc3576-port 5999

wlan wispr-profile

wispr-location-name-operator-name Wi2Connect

wispr-location-name-location Yokohama-Wi-Fi

wispr-location-id-network Yokohama-Wi-Fi

wispr-location-id-cc 81

wispr-location-id-ac 0

wispr-location-id-isocc JP

RADIUS Accounting:

WISPr Client example(iPassConnect)