<div dir="ltr"><div>Hi</div><div><br></div><div><div>Setup:</div><div>Cisco ASA (NAS) -> FRAD -> MS-NPS -> Active Directory</div></div><div><br></div><div>I having some issues with one aspect of this setup. I am trying to make the Framed-IP-Address received back from the NPS be forwarded back to the ASA in the same Access-Accept packet as the Class value (Group Policy name) is being sent. Based on the debug below, we see that the static IP defined in a users object is returned to FR, but it is not being taken into account and added to the next part. </div>
<div><br></div><div>If I remove the static IP from the Active Directory user object, the Framed-IP-Address is not returned to the FR by the NPS as expected.</div><div><br></div><div>If i define in sites-enabled/default update reply { Framed-IP-Address = "10.42.7.150" } the Access-Accept packet is updated and the ASA hands out the IP to the VPN client.</div>
<div><br></div><div>I also tried to define a update reply like this without success: update reply { Framed-IP-Address = "%{ Framed-IP-Address }" }</div><div>No matter in what section I placed this in the sites-enabled/default file, it had a null value and returned the error: <span style="white-space:pre-wrap;color:rgb(0,0,0)">"ERROR: Failed parsing value "" for attribute Framed-IP-Address: Failed to find IP address for". I know too little about running querys / variables like this, so I'm clueless.</span></div>
<div><br></div><div>The the other aspect, the dynamic ip pool which is setup on the ASA, works as a fallback when the Framed-IP-Address is not sent in the Access-Accept packet. In other words, this works as expected and is OK.</div>
<div><br></div><div>I've spent good few days (read weeks) trying to find the solution myself, with several clean setups, but I simply can't get it to work. I hope some of you have done this and know what my issue might be with my configuration. I've touched very little of the default config, apart from adding the config below. There has been no change to any dictionary files either.</div>
<div><br></div><div><br></div><div><br></div><div>Thank you very much in advance</div><div><br></div><div>Regards</div><div>Aleksander</div><div><br></div><div><br></div><div><br></div><div><br></div><div>===============<br>
</div><div><br></div><div><div>freeradius -v</div><div>freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Dec 16 2012 at 13:28:43</div></div><div><br></div><div>===============<br></div><div>freeradius/proxy.conf</div>
<div>===============<br></div><div><div>home_server domain.dco1 {</div><div> type = auth</div><div> ipaddr = 192.168.1.10 </div><div> port = 1812</div><div> secret = pass</div><div> require_message_authenticator = no </div>
<div> response_window = 20</div><div> zombie_period = 40</div><div> revive_interval = 120</div><div> status_check = none</div><div> check_interval = 30</div><div> num_answers_to_alive = 3 </div>
<div>} </div><div>home_server_pool domain_pool {<br></div><div> type = fail-over </div><div> home_server = domain.dco1</div><div>}</div></div><div><div><br></div><div>realm "<a href="http://domain.com">domain.com</a>" {</div>
<div> strip</div><div> auth_pool = domain_pool</div><div># acct_pool = LOCAL</div><div>}</div></div><div><br></div><div>===============</div><div>freeradius/users: default config</div><div>
===============<br></div><div><br></div><div>freeradius/sites-enabled/default: Uncommented attr_filter.post-proxy in the post-proxy section to get freeradius/attrs to work.</div><div><br></div><div>===============</div><div>
freeradius/attrs:</div><div>===============</div><div><a href="http://domain.com">domain.com</a><br></div><div><div> Class := "ou=domain.com-GP"</div></div><div><br></div><div><div>DEFAULT</div><div> Service-Type == Framed-User,</div>
<div> Service-Type == Login-User,</div><div> Login-Service == Telnet,</div><div> Login-Service == Rlogin,</div><div> Login-Service == TCP-Clear,</div><div> Login-TCP-Port <= 65536,</div>
<div> Framed-IP-Address == 255.255.255.254,</div><div> Framed-IP-Netmask == 255.255.255.255,</div><div> Framed-Protocol == PPP, </div><div> Framed-Protocol == SLIP,</div><div> Framed-Compression == Van-Jacobson-TCP-IP, </div>
<div> Framed-MTU >= 576,</div><div> Framed-Filter-ID =* ANY,</div><div> Reply-Message =* ANY,</div><div> Proxy-State =* ANY, </div><div> EAP-Message =* ANY, </div><div> Message-Authenticator =* ANY, </div>
<div> MS-MPPE-Recv-Key =* ANY,</div><div> MS-MPPE-Send-Key =* ANY,</div><div> MS-CHAP-MPPE-Keys =* ANY,</div><div> State =* ANY,</div><div> Session-Timeout <= 28800,</div><div> Idle-Timeout <= 600,</div>
<div> Port-Limit <= 2</div></div><div><br></div><div><br></div><div>===============</div><div>DEBUG ON CONN (let me know if this output doesn't cover the needed insight)</div><div>===============</div><div><br>
</div><div>3.3.3.3 = ASA<br></div><div>192.168.1.10 = NPS<br></div><div><br></div><div>[.....]</div><div> WARNING: Empty pre-proxy section. Using default return values.</div><div>Sending Access-Request of id 74 to 192.168.1.10 port 1812</div>
<div> User-Name = "test"</div><div> User-Password = "test"</div><div> NAS-Port = 200704</div><div> Called-Station-Id = "1.1.1.1"</div><div> Calling-Station-Id = "2.2.2.2"</div>
<div> NAS-Port-Type = Virtual</div><div> Tunnel-Client-Endpoint:0 = "2.2.2.2"</div><div> NAS-IP-Address = 3.3.3.3</div><div> Cisco-AVPair = "ip:source-ip=2.2.2.2"</div><div>
Vendor-3076-Attr-146 = 0x44656661756c7457454256504e47726f7570</div><div> Vendor-3076-Attr-150 = 0x00000002</div><div> Proxy-State = 0x3534</div><div>Proxying request 0 to home server 192.168.1.10 port 1812</div>
<div>Sending Access-Request of id 74 to 192.168.1.10 port 1812</div><div> User-Name = "test"</div><div> User-Password = "test"</div><div> NAS-Port = 200704</div><div> Called-Station-Id = "1.1.1.1"</div>
<div> Calling-Station-Id = "2.2.2.2"</div><div> NAS-Port-Type = Virtual</div><div> Tunnel-Client-Endpoint:0 = "2.2.2.2"</div><div> NAS-IP-Address = 3.3.3.3</div><div> Cisco-AVPair = "ip:source-ip=2.2.2.2"</div>
<div> Vendor-3076-Attr-146 = 0x44656661756c7457454256504e47726f7570</div><div> Vendor-3076-Attr-150 = 0x00000002</div><div> Proxy-State = 0x3534</div><div>Going to the next request</div><div>Waking up in 0.9 seconds.</div>
<div>rad_recv: Access-Accept packet from host 192.168.1.10 port 1812, id=74, length=88</div><div> Proxy-State = 0x3534</div><div> Framed-Protocol = PPP</div><div> Service-Type = Framed-User</div><div>
Framed-IP-Address = 10.42.7.150</div><div> Class = 0xacf7099d0000013700010200ac12e01a0000000058e653601a8d0a8101cf70306d8babb900000000000000bc</div><div># Executing section post-proxy from file /etc/freeradius/sites-enabled/default</div>
<div>+- entering group post-proxy {...}</div><div>[attr_filter.post-proxy] expand: %{Realm} -> <a href="http://domain.com">domain.com</a></div><div>attr_filter: Matched entry <a href="http://domain.com">domain.com</a> at line 103</div>
<div>++[attr_filter.post-proxy] returns updated</div><div>[eap] No pre-existing handler found</div><div>++[eap] returns noop</div><div>Found Auth-Type = Accept</div><div>Auth-Type = Accept, accepting the user</div><div># Executing section post-auth from file /etc/freeradius/sites-enabled/default</div>
<div>+- entering group post-auth {...}</div><div>++[exec] returns noop</div><div>Sending Access-Accept of id 54 to 3.3.3.3 port 48206</div><div> Class := 0x6f753d566f6963652e6e6f2d4755</div><div>Finished request 0.</div>
<div>Going to the next request</div><div>Waking up in 4.9 seconds.</div><div>Cleaning up request 0 ID 54 with timestamp +18</div><div>Ready to process requests.</div><div><br></div></div>