<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV>Hello,</DIV>
<DIV>I use freeradius 2.1.1-7 and a CISCO router (IOS 12.4(6)T9) to provide VPN connections.</DIV>
<DIV>I would like my CISCO router to assign static IP address to remote VPN users thanks to the Freeradius server.</DIV>
<DIV>My freeradius server is configured to give static ip address to users. I can check it with radtest :</DIV>
<DIV>[root@host ~]# radtest <A href="mailto:toto@domain.com">toto@domain.com</A> mypassword 127.0.0.1 0 testing123<BR>Sending Access-Request of id 152 to 127.0.0.1 port 1812<BR> User-Name = "<A href="mailto:toto@domain.com">toto@domain.com</A>"<BR> User-Password = "mypassword"<BR> NAS-IP-Address = 127.0.0.1<BR> NAS-Port = 0<BR>rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=152, length=69<BR> Service-Type = Framed-User<BR> Framed-Protocol = PPP<BR> Framed-IP-Address = 15.1.1.99<BR> Framed-IP-Netmask = 255.255.255.0<BR></DIV>
<DIV>and the CISCO router gets it ...</DIV>
<DIV> </DIV>
<DIV>Log Buffer (32768 bytes):</DIV>
<DIV>Jul 3 17:50:35.368: RADIUS/ENCODE(00000058):Orig. component type = VPN_IPSEC<BR>Jul 3 17:50:35.368: RADIUS: AAA Unsupported Attr: interface [158] 13<BR>Jul 3 17:50:35.368: RADIUS: 32 31 33 2E 34 31 2E 31 33 33 2E<BR>Jul 3 17:50:35.368: RADIUS/ENCODE(00000058): dropping service type, "radius-ser<BR>ver attribute 6 on-for-login-auth" is off<BR>Jul 3 17:50:35.368: RADIUS(00000058): Config NAS IP: 0.0.0.0<BR>Jul 3 17:50:35.368: RADIUS/ENCODE(00000058): acct_session_id: 72<BR>Jul 3 17:50:35.368: RADIUS(00000058): sending<BR>Jul 3 17:50:35.368: RADIUS/ENCODE: Best Local IP-Address X.X.X.X for Radius<BR>-Server Y.Y.Y.Y<BR>Jul 3 17:50:35.368: RADIUS(00000058): Send Access-Request to Y.Y.Y.Y:1812 i<BR>d 1645/50, len 112<BR>Jul 3 17:50:35.368: RADIUS: authenticator 73 C3 A8 1F E5 ED BA C6 - B0 39 12 7<BR>4 33 3C 80
A7<BR>Jul 3 17:50:35.372: RADIUS: User-Name [1] 25 "<A href="mailto:toto@domain.com">toto@domain.com</A>"<BR>Jul 3 17:50:35.372: RADIUS: User-Password [2] 18 *<BR>Jul 3 17:50:35.372: RADIUS: Calling-Station-Id [31] 16 "A.B.C.D"<BR>Jul 3 17:50:35.372: RADIUS: NAS-Port-Type [61] 6 Virtual<BR> [5]<BR>Jul 3 17:50:35.372: RADIUS: NAS-Port [5] 6 3</DIV>
<DIV>Jul 3 17:50:35.372: RADIUS: NAS-Port-Id [87] 15 "E.F.G.H"<BR>Jul 3 17:50:35.372: RADIUS: NAS-IP-Address [4] 6 X.X.X.X</DIV>
<DIV>Jul 3 17:50:35.440: RADIUS: Received from id 1645/50 Y.Y.Y.Y:1812, Access-A<BR>ccept, len 44<BR>Jul 3 17:50:35.444: RADIUS: authenticator 86 A5 0A EA BE DF 30 E0 - 11 E3 24 5<BR>4 9B 2C C6 77<BR>Jul 3 17:50:35.444: RADIUS: Service-Type [6] 6 Framed<BR> [2]<BR>Jul 3 17:50:35.444: RADIUS: Framed-Protocol [7] 6 PPP<BR> [1]<BR>Jul 3 17:50:35.444: RADIUS: Framed-IP-Address [8] 6 15.1.1.99</DIV>
<DIV>Jul 3 17:50:35.444: RADIUS: Framed-IP-Netmask [9] 6 255.255.255.0</DIV>
<DIV>Jul 3 17:50:35.444: RADIUS(00000058): Received from id 1645/50<BR>Jul 3 17:50:35.444: RADIUS: Constructed " ppp negotiate"<BR>Jul 3 17:50:37.852: RADIUS/ENCODE(00000058):Orig. component type = VPN_IPSEC<BR>Jul 3 17:50:37.852: RADIUS(00000058): Config NAS IP: 0.0.0.0<BR>Jul 3 17:50:37.852: RADIUS(00000058): sending<BR>Jul 3 17:50:37..852: RADIUS/ENCODE: Best Local IP-Address X.X.X.X for Radius<BR>-Server Y.Y.Y.Y<BR>Jul 3 17:50:37.852: RADIUS(00000058): Send Accounting-Request to Y.Y.Y.Y:18<BR>13 id 1646/33, len 112<BR>Jul 3 17:50:37.852: RADIUS: authenticator AE 34 03 31 02 D0 C3 19 - 16 B0 6F D<BR>D 1E 26 FE 66<BR>Jul 3 17:50:37.852: RADIUS: Acct-Session-Id [44] 10 "00000048"<BR>Jul 3 17:50:37.852: RADIUS: Framed-IP-Address [8] 6 15.1.1.18</DIV>
<DIV>Jul 3 17:50:37.852: RADIUS: User-Name [1] 25 "<A href="mailto:toto@domain.com">toto@domain.com</A>"<BR>Jul 3 17:50:37.852: RADIUS: Acct-Authentic [45] 6 RADIUS<BR> [1]<BR>Jul 3 17:50:37.852: RADIUS: Acct-Status-Type [40] 6 Start<BR> [1]<BR>Jul 3 17:50:37.852: RADIUS: NAS-Port-Type [61] 6 Virtual<BR> [5]<BR>Jul 3 17:50:37.852: RADIUS: NAS-Port [5] 6 3</DIV>
<DIV>Jul 3 17:50:37.852: RADIUS: NAS-Port-Id [87] 15 "E.F.G.H"<BR>Jul 3 17:50:37.852: RADIUS: NAS-IP-Address [4] 6 X.X.X.X</DIV>
<DIV>Jul 3 17:50:37.852: RADIUS: Acct-Delay-Time [41] 6 0</DIV>
<DIV>Jul 3 17:50:37.856: RADIUS: Received from id 1646/33 Y.Y.Y.Y:1813, Accounti<BR>ng-response, len 20<BR>Jul 3 17:50:37.856: RADIUS: authenticator B8 26 8E 14 AE AB AF AA - 67 C3 3C 1<BR>F 62 4D 70 5B</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>... but never assign it to remote users, the cisco router assigns an IP address from its local pool.</DIV>
<DIV> </DIV>
<DIV>The interesting lines of my cisco configuration are :</DIV>
<DIV> </DIV>
<DIV>aaa new-model<BR>!<BR>!<BR>aaa authentication login ClientAuth group radius<BR>aaa authorization network ClienAuth group radius local<BR>aaa accounting delay-start<BR>aaa accounting network ClientAuth start-stop group radius</DIV>
<DIV>crypto isakmp client configuration address-pool local vpnpool</DIV>
<DIV>crypto map rasvpn client authentication list ClientAuth<BR>crypto map rasvpn client accounting list ClientAuth<BR>crypto map rasvpn isakmp authorization list ClientAuth<BR>crypto map rasvpn client configuration address respond<BR>crypto map rasvpn 10 ipsec-isakmp dynamic dynmap</DIV>
<DIV> </DIV>
<DIV>I also tried with the cisco av-pair attribute with no luck ...</DIV>
<DIV> </DIV>
<DIV>Does anybody know what the problem could be ?</DIV>
<DIV> </DIV>
<DIV>Thanks!</DIV>
<DIV> </DIV>
<DIV>Fred</DIV></div><br>
</body></html>