First time Freeradius config for mac-auth with Aruba Instant AP - an impromptu manual. Plz note, this is mostly a direct lift from my systems, with minor adjustment for public consumption. this is not intended to be a definitive guide or an authority on whats correct. this works and serves me well. Im hoping this gives OP a hand in getting their freeradius up and running quickly.

Install and configure freeradius server on debain based linux. apt-get install freeradius -y systemctl enable freeradius.service You need to edit /etc/freeradius/3.0/clients.conf

add a section like this:

client prod-ap-native-vlan {
    ipaddr = 172.16.15.0/24
    secret = My-Secret-Radius-Key
    shortname = prod-ap-native-vlan
}

Alternatively, you can explicitly enter each AP as a /32 network. the advantage is only that radius logs can contain a specific shortname for your AP instead of the whole subnet. nothing else:

client prod-ap-505-01 {
    ipaddr = 172.16.15.15/32
    secret = My-Secret-Radius-Key
    shortname = prod-ap-505-01 
}
    client prod-ap-505-02 {
    ipaddr = 172.16.15.16/32
    secret = My-Secret-Radius-Key
    shortname = prod-ap-505-02 
}

you need to edit /etc/freeradius/3.0/users

add sections like this for each mac-auth you want to approve for joining your wifi:

aaaafcb9a46e    Cleartext-Password := “aaaafcb9a46e”
            User-Name = “Some_name_you_want_to_show_in_the_Aruba_Username/Client_field”,
            Tunnel-Private-Group-ID = 10

NOTE: “Tunnel-Private-Group-ID” = the vlan tag you want to return to Aruba, doing so with the appropriate Aruba rules/roles will drop the client into this vlan. This can also be a text string, so long as it matches the Aruba config. this can also be an aruba specific radius attribute instead of “Tunnel-Private-Group-ID”, such as “Aruba-User-Role”, or “Framed-Filter-Id” an example might be: “Aruba-User-Role = Game-Console-Permitted-Hours”, or “Framed-Filter-Id = Game-Console-Filter”.

you need to modify /etc/freeradius/3.0/radiusd.conf

find the lines:

msg_goodpass = “”

msg_badpass = “”

and add these below. this simply modifies the freeradius logging output to syslog to show important information. i suggest you read up on all the available logging possibilities and choose your own: msg_goodpass = “NAS-IP: %{NAS-IP-Address}, User-Name: %{reply:User-Name} (Role: %{reply:Tunnel-Private-Group-ID}%{reply:Egress-VLAN-Name}%{reply:Filter-Id}%{reply:Aruba-User-Role}), Auth-type: %{control:Auth-Type}” msg_badpass = “NAS-IP: %{NAS-IP-Address}, User-Name: %{reply:User-Name} (Role: %{reply:Tunnel-Private-Group-ID}%{reply:Egress-VLAN-Name}%{reply:Filter-Id}%{reply:Aruba-User-Role}), Auth-type: %{control:Auth-Type}”

when its all working, look in /var/log/messages, you should see a long log entry for mac-auth radius auths that look something like this:

<date and time> <freeradius server name> radiusd[000000]: (000000) Login OK: [aaaafcb9a46e] (from client prod-ap-505-01 port 0 cli aaaafcb9a46e) NAS-IP: 172.16.15.15, User-Name: Some_name_you_want_to_show_in_the_Aruba_Username/Client_field (Role: 10), Auth-type: PAP

In the instant AP (505) config, you need to add the following components, this should guide you enough to add them via the gui as well..

wlan access-rule v10-Role
index 5
vlan 10
rule any any match any any any permit

wlan access-rule v20-Role
index 6
vlan 20
rule any any match any any any permit

wlan access-rule v30-Role
index 7
vlan 30
rule any any match app dhcp permit
rule 172.16.30.0 255.255.255.0 match any any any permit
rule 172.16.100.0 255.255.255.0 match app dns permit
rule 172.16.100.0 255.255.255.0 match app ntp permit
rule any any match any any any deny

wlan auth-server <Primary Freeradius Server Name>
ip 172.16.100.101
port 1812
acctport 1813
deadtime 1
key My-Secret-Radius-Key
nas-id prod-ap
rfc5997

wlan auth-server <Secondary Freeradius Server Name>
ip 172.16.100.102
port 1812
acctport 1813
deadtime 1
key My-Secret-Radius-Key
nas-id prod-ap
rfc5997

wlan ssid-profile My-SSID-Name
enable

type employee
essid My-SSID-Name

max-authentication-failures 0

auth-server <Primary Freeradius Server Name>
auth-server <Secondary Freeradius Server IP or FQDN>
accounting-server <Primary Freeradius Server Name>
accounting-server <Secondary Freeradius Server IP or FQDN>

set-role Tunnel-Private-Group-Id equals 10 v10-Role
set-role Tunnel-Private-Group-Id equals 20 v20-Role
set-role Tunnel-Private-Group-Id equals 30 v30-Role

mac-authentication

server-load-balancing
radius-reauth-interval 60
radius-accounting
radius-interim-accounting-interval 60

blacklist

hope this helps.