<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0);">Hi All,</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">I have a NAS that sends two types of Access-Requests. They are VPN login (AnyConnect or IPSec), and CLI access for the NAS. I’m trying to direct the VPN requests into the virtual server “vpn”. I would like CLI requests to be
handled by realm DEFAULT, so I’m trying to catch everything that doesn’t fit that category and direct it elsewhere. </div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Here is an example of a request:</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">
<div>---------------------------------</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Received Access-Request packet from host <redacted> port 1025, id=24, length=185</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>User-Name = ""</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>User-Password = </div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>NAS-Port = 229748736</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>Called-Station-Id = “<redacted>"</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>Calling-Station-Id = "<redacted>"</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>NAS-Port-Type = Virtual</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>Tunnel-Client-Endpoint:0 = "<redacted>"</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>NAS-IP-Address = <redacted></div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>Cisco-AVPair = "ip:source-ip=<redacted>"</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>Vendor-3076-Attr-146 = 0xxxxx</div>
<div>Tue Oct 22 07:50:46 2013 : Debug: [<thread>] <span class="Apple-tab-span" style="white-space:pre">
</span>Vendor-3076-Attr-150 = 0xxxxx</div>
<div>----------------------------------</div>
<div><br>
</div>
<div>What I am interested to know is if my way of accomplishing this task is efficient, or if there is a better way. I’m working on porting my configs to 3.0 and am striving for efficiency and simplicity.</div>
<div><br>
</div>
</div>
<div>
<pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><pre style="color: rgb(0, 0, 0); line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(255, 255, 255); word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas">I’ve added the two nameless attributes to /etc/raddb/dictionary</font></pre><pre style="color: rgb(0, 0, 0); line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(255, 255, 255); word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><br></font></pre><pre style="color: rgb(0, 0, 0); line-height: 19.600000381469727px; white-space: pre-wrap; word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><span style="background-color: rgb(255, 254, 254);"><font face="Consolas">ATTRIBUTE<span class="Apple-tab-span" style="white-space:pre"> </span>CPVN3000-Tunnel-Group-Name<span class="Apple-tab-span" style="white-space:pre"> </span>146<span class="Apple-tab-span" style="white-space:pre"> </span>string</font></span></pre><pre style="color: rgb(0, 0, 0); line-height: 19.600000381469727px; white-space: pre-wrap; word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><pre style="line-height: 19.600000381469727px; white-space: pre-wrap; word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><span style="background-color: rgb(255, 254, 254);"><font face="Consolas">ATTRIBUTE<span class="Apple-tab-span" style="white-space: pre;"> </span>CPVN3000-Client-Type<span class="Apple-tab-span" style="white-space: pre;"> </span>150<span class="Apple-tab-span" style="white-space: pre;"> </span>string</font></span></pre></pre><pre style="color: rgb(0, 0, 0); line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(255, 255, 255); word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><br></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;">I</span><span style="color: rgb(0, 0, 0); line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(255, 254, 254);"> created hints for each possible value of "</span><span style="background-color: rgb(255, 254, 254); line-height: 19.600000381469727px; white-space: pre-wrap;">CPVN3000-Tunnel-Group-Name</span><span style="line-height: 19px; white-space: pre-wrap;">”</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><span style="background-color: rgb(255, 254, 254); line-height: 19.600000381469727px; white-space: pre-wrap;"><font face="Consolas"><br></font></span></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><span style="line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(254, 253, 253);"><font face="Consolas">/etc/raddb/hints</font></span></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><span style="line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(254, 253, 253);"><font face="Consolas"><br></font></span></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(253, 252, 252);">DEFAULT <span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="background-color: rgb(255, 254, 254);"><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">CPVN3000-Tunnel-Group-Name == </span><span style="line-height: 19px; white-space: pre-wrap;">“</span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">staff</span><span style="line-height: 19px; white-space: pre-wrap;">”</span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">, Strip-User-Name = Yes</span></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span class="Apple-tab-span" style="line-height: 19.600000381469727px; white-space: pre;"> </span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">Hint = </span><span style="line-height: 19px; white-space: pre-wrap;">“</span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">VPN</span><span style="line-height: 19px; white-space: pre-wrap;">”</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19.600000381469727px; white-space: pre-wrap; background-color: rgb(253, 252, 252);">DEFAULT <span class="Apple-tab-span" style="white-space: pre;"> </span></span><span style="background-color: rgb(255, 254, 254);"><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">CPVN3000-Tunnel-Group-Name == </span><span style="line-height: 19px; white-space: pre-wrap;">“guest</span><span style="line-height: 19px; white-space: pre-wrap;">”</span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">, Strip-User-Name = Yes</span></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span class="Apple-tab-span" style="line-height: 19.600000381469727px;"> </span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">Hint = </span><span style="line-height: 19px; white-space: pre-wrap;">“</span><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">VPN</span><span style="line-height: 19px; white-space: pre-wrap;">”</span></font></pre></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19.600000381469727px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19.600000381469727px; white-space: pre-wrap;">In /etc/raddb/users</span><span style="line-height: 19px; white-space: pre-wrap;">…</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;">DEFAULT</span><span class="Apple-tab-span" style="line-height: 19px; white-space: pre;"> </span><span style="line-height: 19px; white-space: pre-wrap;">Hint == “VPN”, Proxy-To-Realm := “VPN_REALM</span><span style="line-height: 19px; white-space: pre-wrap;">”</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;">A</span><span style="line-height: 19px; white-space: pre-wrap;">nd finally, in /etc/raddb/proxy.conf</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;">R</span><span style="line-height: 19px; white-space: pre-wrap;">ealm VPN_REALM {</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span class="Apple-tab-span" style="line-height: 19px; white-space: pre;"> </span><span style="line-height: 19px; white-space: pre-wrap;">virtual_server = “vpn</span><span style="line-height: 19px; white-space: pre-wrap;">”</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;">}</span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><span style="line-height: 19px; white-space: pre-wrap;"><br></span></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas">How does that look?</font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas"><br></font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas">Regards,</font></pre><pre style="word-wrap: break-word; margin-top: 0px; margin-bottom: 0px;"><font face="Consolas">Dave</font></pre></pre>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">
<div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
</div>
</body>
</html>