{"id":16162935,"url":"https://github.com/eiddor/cisco-sda-freeradius","last_synced_at":"2025-10-24T03:09:16.835Z","repository":{"id":225888337,"uuid":"356988228","full_name":"eiddor/cisco-sda-freeradius","owner":"eiddor","description":"Sample FreeRADIUS configuration for use with Cisco Software-Defined Access","archived":false,"fork":false,"pushed_at":"2021-04-14T19:08:44.000Z","size":24,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-07T04:25:00.552Z","etag":null,"topics":["cisco","cisco-sd-access","freeradius"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eiddor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-04-11T21:56:52.000Z","updated_at":"2025-01-20T09:59:20.000Z","dependencies_parsed_at":"2024-03-04T20:44:38.343Z","dependency_job_id":"0f76ec64-c53c-4371-92ec-8753ddaf9012","html_url":"https://github.com/eiddor/cisco-sda-freeradius","commit_stats":null,"previous_names":["eiddor/cisco-sda-freeradius"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/eiddor/cisco-sda-freeradius","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eiddor%2Fcisco-sda-freeradius","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eiddor%2Fcisco-sda-freeradius/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eiddor%2Fcisco-sda-freeradius/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eiddor%2Fcisco-sda-freeradius/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eiddor","download_url":"https://codeload.github.com/eiddor/cisco-sda-freeradius/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eiddor%2Fcisco-sda-freeradius/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269990246,"owners_count":24508822,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-12T02:00:09.011Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cisco","cisco-sd-access","freeradius"],"created_at":"2024-10-10T02:33:56.365Z","updated_at":"2025-10-24T03:09:11.768Z","avatar_url":"https://github.com/eiddor.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Using FreeRADIUS with Cisco Software-Defined Access\n\n# Introduction\nThis repo contains most of what you will need in order to configure [FreeRADIUS](https://freeradius.org/) for authentication and authorization with a [Cisco Software-Defined Access](https://www.cisco.com/c/en/us/solutions/enterprise-networks/software-defined-access/index.html) network.\n\n**Note:** _[Cisco Identity Services Engine](https://www.cisco.com/c/en/us/products/security/identity-services-engine/index.html) (ISE) is still required for policy in Cisco SD-Access._\n\nInspired from this [post](https://community.cisco.com/t5/networking-documents/how-to-use-group-based-policies-with-3rd-party-radius-using/ta-p/3930041) and this [video](https://www.youtube.com/watch?v=ZoNKa9X1Xjk\u0026list=UUHDBMhhEDalzaiFGXOhHJDg\u0026index=1). \n\n\nAlthough this example is for FreeRADIUS, you can extend this same functionality to other RADIUS servers such as [ForeScout](https://www.forescout.com/) or [ClearPass](https://www.arubanetworks.com/products/security/network-access-control/). \n\n**Note:** _These are sample files and are only appropriate for a lab environment.  **They are by no means secure** and your production implementation will look much different._\n\n# Getting Started\n\nThe important FreeRADIUS files in this repository are:\n\n#### `freeradius/clients.conf`\n\nThe FreeRADIUS `clients.conf` file specifies the  parameters for the _RADIUS clients_, typically  network switches.  In Cisco ISE these are known as network access devices (NADs.)  This is not the same as the user devices that will actually be logging into the network.\n\n```sh\nclient switches {\n  ipaddr = 0.0.0.0/0\n  proto = *\n  secret = radiussecret\n  nas_type = cisco\n}\n```\n\nThe two key settings that you should change to match your environment are:\n\n`ipaddr` - IP address of the client device(s) that will be querying RADIUS.  In our example we're allowing any device.\n\n`secret` - The RADIUS secret that the client device will use to authenticate.\n\nThe official documentation for this file can be found [here](https://freeradius.org/radiusd/man/clients.html) \n\nSee [here](https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/clients.conf) for a well-documented example.\n\n#### `freeradius/users`\n\nThe FreeRADIUS `users` file contains both the authentication credentials and authorization result information about users logging into the network.  In a production environment your RADIUS server would usually point to a database, LDAP, or AD server for the authentication credentials.\n\n```sh\nuser Cleartext-Password := \"password\"\n\tService-Type = Framed,\n\tTunnel-Private-Group-ID = \"1021\",\n\tTunnel-Type = 13,\n\tTunnel-Medium-Type = 6,\n\tCisco-AVPair = \"cts:vn=Campus\",\n\tCisco-AVPair += \"cts:security-group-tag=0016-00\"\n```\n\nIn the example above `user` is the username and `password` is the user's password. \n\nOnce the user is authenticated to the network, the rest of the settings are results that are pushed to the client device for authorization.\n\n`Tunnel-Private-Group-ID` - The VLAN ID or VLAN name that the authenticated user should be placed in.\n\n`Cisco-AVPair += \"cts:security-group-tag=0016-00\"` - The Scalable (or Security) Group Tag (SGT) that will be assigned to the user's traffic.  In this example, we are using `0016`.  The SGT must be in HEX format and you can view the value in Cisco DNA Center or in Cisco ISE.  The `-00` is also mandatory and is the SGT \"Generation\" which can be viewed in Cisco ISE.\n\n`Cisco-AVPair = \"cts:vn=Campus\"` - (optional) The Cisco SD-Access Virtual Network that the user will be placed in.  This setting is currently optional as the VLAN will usually dictate which VN the user is in.\n\nThe official documentation for this file can be found [here](https://freeradius.org/radiusd/man/users.html).\n\nSee [here](https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-config/files/authorize) for a well-documented example.\n\n### Running in Docker\n\nI've included a `docker-compose.yml` file that should allow you to easily run FreeRADIUS in a Docker container along with these files. \n\n```yaml\nversion: '3'\n\nservices:\n     freeradius:\n         image: roddie/cisco-sda-freeradius:latest\n         container_name: freeradius\n         ports:\n             - \"1812-1813:1812-1813/udp\"\n         volumes:\n             - \"./freeradius/clients.conf:/etc/raddb/clients.conf\"\n             - \"./freeradius/users:/etc/raddb/mods-config/files/authorize\"\n         restart: unless-stopped\n```\n\nThis file expects our custom files to exist in `./freeradius` on the host.  Feel free to modify the `volume:` section to match your environment.\n\nYou can start the container running in the background with: `docker-compose up -d freeradius`\n\nYou can also run it directly with:\n\n```\ndocker run --name freeradius -p 1812-1813:1812-1813/udp -v \"/$(pwd)/freeradius/clients.conf:/etc/raddb/clients.conf\" -v \"/$(pwd)/freeradius/users:/etc/raddb/mods-config/files/authorize\" roddie/cisco-sda-freeradius:latest\n```\n\nThe image referenced in `docker-compose.yml` is a [custom Docker image](https://hub.docker.com/r/roddie/cisco-sda-freeradius) for use with this project which includes a fix to push the RADIUS attributes to the switch inside of the tunneled Access-Accept message (see note in non-Docker section below). \n\nI have also included the `Dockerfile` and accompanying files in the `docker/` directory in case you want to build your own image.\n### Running outside of Docker\n\nIf you have an existing FreeRADIUS implementation to use or would like to run FreeRADIUS natively on your server, you should be able to incorporate the information from the examples in this repository easily.\n\n---\n**Note:** If you are using a tunneled authentication method such as EAP, you will need to tell FreeRADIUS to include the RADIUS attributes with the Access-Accept message inside of the tunnel. \n\nIn the version used in this repository, that setting is `use_tunneled_reply = yes`, however it may vary depending on your version of FreeRADIUS and how you have it setup.  This is already enabled in the Docker image discussed above.\n\nSee [this post](https://community.cisco.com/t5/switching/catalyst-2960-ignores-radius-attributes-to-set-vlan/m-p/1792633/highlight/true#M192521) for a better explanation.\n\n---\n# Testing\n\nBefore deploying the Cisco IOS-XE templates and testing with fabric users, you should probably run a local test using the `radtest` command (available in the container or in the `freeradius-utils` package).  This will test your RADIUS configuration and allow you to see the authorization results that RADIUS will return to your switches.\n\n```console\nroddie@testubuntu ~% radtest user1 password 127.0.0.1 10 radiussecret\nSent Access-Request Id 184 from 0.0.0.0:57731 to 127.0.0.1:1812 length 75\n        User-Name = \"user1\"\n        User-Password = \"password\"\n        NAS-IP-Address = 127.0.1.1\n        NAS-Port = 10\n        Message-Authenticator = 0x00\n        Cleartext-Password = \"password\"\nReceived Access-Accept Id 184 from 127.0.0.1:1812 to 127.0.0.1:57731 length 103\n        Service-Type = Framed-User\n        Tunnel-Private-Group-Id:0 = \"1021\"\n        Tunnel-Type:0 = VLAN\n        Tunnel-Medium-Type:0 = IEEE-802\n        Cisco-AVPair = \"cts:vn=Campus\"\n        Cisco-AVPair = \"cts:security-group-tag=0016-00\"\n```\n\nWe can see above that we authenticate successfully with our credentials as our RADIUS server is sending back an **Access-Accept**.  Inside of the Access-Accept message, the RADIUS server is also sending our configured attributes back to tell the switch which VLAN (1021) we should be placed on along with our SGT and optional VN.\n\n\n# Usage\n\nThe file `cisco/cat9k-template.txt` is a sample of what should be pushed to a Cisco Catalyst 9000 switch in order to redirect the authentication and authorization function to your FreeRADIUS server.  This template should be pushed using [Cisco DNA Center](https://www.cisco.com/c/en/us/products/cloud-systems-management/dna-center/index.html) and it will not remove the existing configuration that is pointing to ISE for policy.\n\nThe file is mostly documented, but I will add more information here, too.\n# TODO\n\n* Modify `docker-compose.yml` to provide logging from the container.\n \n* Better documentation overall.\n\nIf you have any questions about these files or the purpose of them, please open an [issue](https://github.com/eiddor/cisco-sda-freeradius/issues).","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feiddor%2Fcisco-sda-freeradius","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feiddor%2Fcisco-sda-freeradius","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feiddor%2Fcisco-sda-freeradius/lists"}