Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks, Alex
Hello Alex, I have just gone through this exact scenario and University of Notre Dame, if you want to give me a call I can talk in detail what the solution was here at ND and it may be of help Email me directly at mmay3@nd.edu and we can go over the solution in which I deployed. Mike _____ From: freeradius-devel-bounces+mmay3=nd.edu@lists.freeradius.org [mailto:freeradius-devel-bounces+mmay3=nd.edu@lists.freeradius.org] On Behalf Of Alexandru Dincov Sent: Monday, November 20, 2006 11:36 AM To: freeradius-devel@lists.freeradius.org Subject: huntgroups question Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks, Alex
You can use the users file with: DEFAULT NAS-IP-Address =~ "^123.123", ... or DEFAULT NAS-IP-Address !~ "^123.123", Auth-Type := Reject Alexandru Dincov wrote:
Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks,
Alex
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Alexandru Dincov wrote:
knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges?
Hi Alex, You can do regular expression matches in the huntgroups file. For example: dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..* Maybe that can get you close to what you want? Oh and by the way, these types of questions should be asked on the FreeRADIUS Users list. cheers, Mike
On November 21, 2006 8:48:30 AM +1100 Michael Mitchell <mitchell.michael@bigpond.com> wrote:
Alexandru Dincov wrote:
knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges?
Hi Alex,
You can do regular expression matches in the huntgroups file. For example:
dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..*
warning, the first of those captures 100 /24's, the second 56 /24's. -frank
Frank Cusack wrote: ...
dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..*
warning, the first of those captures 100 /24's, the second 56 /24's.
dial Client-IP-Address =~ '192\.168\.1\..*' The backslashes can make a big difference. And note the single quotes, too. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Frank Cusack wrote:
On November 21, 2006 8:48:30 AM +1100 Michael Mitchell wrote:
dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..*
warning, the first of those captures 100 /24's, the second 56 /24's.
Ahh yes, so it does. Thanks for pointing that out Frank! But the example still stands, you can do regular expressions in the huntgroups file - just be careful with your regular expressions. :) cheers, Mike
participants (6)
-
Alan DeKok -
Alexandru Dincov -
Frank Cusack -
Kenneth Grady -
Michael Mitchell -
Mike May