Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
technical:ppsk-radius [2024/04/23 10:10] – system | technical:ppsk-radius [2024/04/29 09:03] (current) – [Advanced Private PSK Flow] system | ||
---|---|---|---|
Line 5: | Line 5: | ||
----- | ----- | ||
- | ====== PPSK support in RADIUSdesk | + | ====== PPSK support in FreeRADIUS |
===== Introduction ===== | ===== Introduction ===== | ||
- | * RADIUSdesk | + | |
- | * This in combination with MESHdesk and APdesk | + | |
+ | * The RADIUS protocol in its most traditional implementation does not allow communication back to the RADIUS client, e.g. to terminate a user's session with a NAS. | ||
+ | * As new enhancements were added to the RADIUS protocol, a mechanism was added to reach the client via Change Of Authority (COA) and Packet Of Disconnect (POD) requests from the RADIUS server to the RADIUS client. | ||
+ | * We can say that the RADIUS client took on features of the RADIUS server. | ||
+ | * This mechanism works well in an environment where the RADIUS server can reach the RADIUS client directly at IP level (no NAT firewalls in between) | ||
+ | * Unfortunately, | ||
+ | * In RADIUSdesk we use the API that is part of RouterOS to reach Mikrotik RADIUS Clients. | ||
+ | * In MESHdesk and APdesk | ||
+ | * With this in mind, let us look at the flow of a simple Private PSK implementation | ||
------ | ------ | ||
+ | |||
+ | ===== Simple Private PSK Flow ===== | ||
+ | |||
+ | <panel type=" | ||
+ | {{ : | ||
+ | </ | ||
+ | |||
+ | ---- | ||
+ | |||
+ | ===== Advanced Private PSK Flow ===== | ||
+ | <panel type=" | ||
+ | {{ : | ||
+ | </ | ||
+ | * The **Intelligent VLAN Engine** runs on the RADIUSdesk server and is crucial if you want to implement Private PSK with data restrictions. | ||
+ | * It constantly monitors a user's usage and if it detects that a certain limit has been reached, it will act accordingly. | ||
+ | * This usually starts by sending a disconnect instruction to the AP or mesh node the user is currently connected to. | ||
+ | * The user's device will attempt to reconnect to the same SSID after it has been disconnected. | ||
+ | * The **Intelligent VLAN Engine** will now apply the new restrictions to the newly established connection, if there are any. | ||
+ | * The **Intelligent VLAN Engine** also removes restrictions by disconnecting and reconnecting a user when it detects that a restriction needs to be lifted, e.g. when a daily, weekly or monthly limit no longer applies | ||
+ | |||
+ | ---- | ||
+ |