<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Thanks for the response Alan.<div><br></div><div>I am using DHCP and RADIUS. I was initially using FreeRADIUS for captive portal user authentication and accounting for a pfsense router (using the DHCP server built into the pfsense box). The DHCP server on pfsense limits us to only serving IPs on a singe subnet. </div><div>We are now trying to use FreeRADIUS as a DHCP server as well by associating user accounts with ippools through Pool-Name. <br><div><div><br></div><div>When I run the server in debug mode the Acct-Unique-Session-ID remains the same across the interim accounting updates. However, re-authentications don't seem to have a unique key associated with them. </div><div>Each time the user is reauthenticated, dhcp_sqlippool.post-auth is triggered and the script I added is executed. I plan to create a table radippoolinfo that will store ip pool specific info such as router address, net mask, dns servers, etc…</div><div><br></div><div>In my post-auth policy, I am updating control with the proper pool-name (with an unlang), changing some other reply attributes, then calling dhcp_sqlippool. What I am doing doesn't <i>feel</i> right. I am very new to this, does this sound like the proper way of handling the serving of ip's on multiple subnets. DHCP-Domain-Name-Server and DHCP-Router-Address will change between pools. </div><div><br></div><div>I guess I'm asking if I am approaching this correctly: Using unlang in policy.conf to handle these rules. </div><div><br></div><div><br></div><div>Sorry to put such a long debug message in here. I pulled out one authorization request, but they all look the same. It looks like </div><div><br></div><div>This is what my authorization looks like:</div><div><br></div><div>The request comes in with a framed ip of 192.168.0.43, but it tries to serve it 192.168.0.50. It reallocates a new IP for each auth every minute.</div><div>--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------</div><div><div>rad_recv: Access-Request packet from host 192.168.1.1 port 7053, id=32, length=142</div><div> NAS-IP-Address = [redacted]</div><div> NAS-Identifier = "pfsense.localdomain"</div><div> User-Name = "b8:8d:12:10:8d:f6"</div><div> User-Password = "[redacted]"</div><div> Service-Type = Login-User</div><div> NAS-Port-Type = Ethernet</div><div> NAS-Port = 30</div><div> Framed-IP-Address = 192.168.0.43</div><div> Called-Station-Id = "[redacted]"</div><div> Calling-Station-Id = "b8:8d:12:10:8d:f6"</div><div>Thu Jan 10 23:53:34 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default</div><div>Thu Jan 10 23:53:34 2013 : Info: +- entering group authorize {...}</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[preprocess] returns ok</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[chap] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[mschap] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[digest] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: [suffix] No '@' in User-Name = "b8:8d:12:10:8d:f6", looking up realm NULL</div><div>Thu Jan 10 23:53:34 2013 : Info: [suffix] No such realm "NULL"</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[suffix] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: [eap] No EAP-Message, not doing EAP</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[eap] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: [files] users: Matched entry DEFAULT at line 93</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[files] returns ok</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: %{User-Name} -> b8:8d:12:10:8d:f6</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] sql_set_user escaped user --> 'b8:8d:12:10:8d:f6'</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 0</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'b8:8d:12:10:8d:f6' ORDER BY id</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] User found in radcheck table</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'b8:8d:12:10:8d:f6' ORDER BY id</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'b8:8d:12:10:8d:f6' ORDER BY priority</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Released sql socket id: 0</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[sql] returns ok</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[expiration] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[logintime] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[pap] returns noop</div><div>Thu Jan 10 23:53:34 2013 : Info: Found Auth-Type = Accept</div><div>Thu Jan 10 23:53:34 2013 : Info: Auth-Type = Accept, accepting the user</div><div>Thu Jan 10 23:53:34 2013 : Info: # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default</div><div>Thu Jan 10 23:53:34 2013 : Info: +- entering group post-auth {...}</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: %{User-Name} -> b8:8d:12:10:8d:f6</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] sql_set_user escaped user --> 'b8:8d:12:10:8d:f6'</div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: %{User-Password} -> [redacted]</div></div><div><div>Thu Jan 10 23:53:34 2013 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'b8:8d:12:10:8d:f6', '[redacted]', 'Access-Accept', '2013-01-10 23:53:34')</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'b8:8d:12:10:8d:f6', '[redacted]', 'Access-Accept', '2013-01-10 23:53:34')</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 4</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Released sql socket id: 4</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[sql] returns ok</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 3</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: %{User-Name} -> b8:8d:12:10:8d:f6</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] sql_set_user escaped user --> 'b8:8d:12:10:8d:f6'</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: START TRANSACTION -> START TRANSACTION</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '[redacted]'</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'pfpriv' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'b8:8d:12:10:8d:f6'), (callingstationid <> 'b8:8d:12:10:8d:f6'), expiry_time LIMIT 1 FOR UPDATE</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '192.168.0.50' AND expiry_time IS NULL -> UPDATE radippool SET nasipaddress = '[redacted]', pool_key = 'b8:8d:12:10:8d:f6', callingstationid = 'b8:8d:12:10:8d:f6', username = 'b8:8d:12:10:8d:f6', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '192.168.0.50' AND expiry_time IS NULL</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] Allocated IP 192.168.0.50 [3200a8c0]</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: COMMIT -> COMMIT</div><div>Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Released sql socket id: 3</div><div>Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 192.168.0.50 from pfpriv (did [redacted] cli b8:8d:12:10:8d:f6 port 30 user b8:8d:12:10:8d:f6)</div><div>Thu Jan 10 23:53:34 2013 : Info: Allocated IP: 192.168.0.50 from pfpriv (did [redacted] cli b8:8d:12:10:8d:f6 port 30 user b8:8d:12:10:8d:f6)</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[sqlippool] returns ok</div><div>Thu Jan 10 23:53:34 2013 : Info: ++[exec] returns noop</div><div>Sending Access-Accept of id 32 to 192.168.1.1 port 7053</div><div> WISPr-Bandwidth-Max-Up := 5000000</div><div> WISPr-Bandwidth-Max-Down := 12000000</div><div> Framed-IP-Address = 192.168.0.50</div><div>Thu Jan 10 23:53:34 2013 : Info: Finished request 10.</div><div>Thu Jan 10 23:53:34 2013 : Debug: Going to the next request</div><div>Thu Jan 10 23:53:34 2013 : Debug: Waking up in 4.9 seconds.</div><div>Thu Jan 10 23:53:39 2013 : Info: Cleaning up request 10 ID 32 with timestamp +268</div><div>Thu Jan 10 23:53:39 2013 : Info: Ready to process requests.</div></div></div></div><div><div>On Jan 11, 2013, at 4:34 PM, Alan DeKok <<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Ethan Hayon wrote:<br><blockquote type="cite">Hi, I'm trying to set up FreeRADIUS 2.2 to act as an authentication and accounting system as well as a DHCP server. (I'm relaying DHCP requests from a pfSense box).<br></blockquote><br> Are you doing DHCP *and* RADIUS?<br><br><blockquote type="cite">I am trying to use sqlippools on FreeRADIUS, but I have noticed that my ippools are filling up quickly (I am only testing with two devices). I have pfSense configured to reauthenticate user every minute, so I believe that FreeRADIUS is running post-auth dhcp leasing each time the user is reauthenticated. FreeRADIUS is serving the same client a new IP address each minute. <br></blockquote><br> There's no need to "believe" anything. Run the server in debugging<br>mode to see exactly what it's doing.<br><br> Any IP allocation MUST be done on a key which is unique to each<br>device. That key should remain the same across multiple re-authentications.<br><br> So... is it? Please check.<br><br><blockquote type="cite">I want to have multiple pools on different subnets. When a new client connects to the network (they don't yet have a radius account) they are sent to a default (pending) pool. This may be on the 192.168.1/24 subnet. After they have set up their account and have been added to the RADIUS database, they will be given a pool-name, maybe `pool2`. `pool2` will be on a different subnet, for example, 192168.2/24. The pfsense box knows how to route these subnets, so that is not a problem. I only want clients to receive a different IP address if their pool-name changes for whatever reason, if there are no changes to their account, they shouldn't be leased a new IP every time they reauthenticate (every minute).<br></blockquote><br> This is what databases are for. If you want to map each client to a<br>pool, you'll need a table with a "client identifier" column, and a<br>"pool-name" column. Then, assign IPs based on the pool name, as looked<br>up in the table.<br><br><blockquote type="cite">Am I approaching this problem correctly? I have written some un-lang in the policy.conf file for handling some of this. I am getting hung up on this problem. The pool is getting exhausted in minutes since each client is leased a new ip every minute.<br></blockquote><br> Solve that problem first. Run the server in debugging mode to see<br>*why* it's assigning a new IP.<br><br> Alan DeKok.<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></body></html>