July 2016 - Freeradius-Users - lists.freeradius.org

vlan assigment on called-station-id
by Zenon Matuszyk 14 Jul '16

14 Jul '16

Hello, I have a problem with assigment vlan, i have two locations with 6 AP each, and two groups workers and guest (one serwer radius). If user is in group workers in site1 shoud be assigned to VLAN 200 or in group guest, than shoud be assigned to VLAN 300. On site2 workers vlan 400, guest 600.I want it to be checked using the mac address the APs. I try use user file, but not working. If i try plugin to wifi on site1 its ok but in site2 radius trying to get me assigned to vlan 200 not 400. How can I assign VLAN depending on location AP?? Maybe someone tried to do like that site1 DEFAULT LDAP-Group == workers Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 200 DEFAULT LDAP-Group == guest Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 300 site2 DEFAULT LDAP-Group == workers Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 400 DEFAULT LDAP-Group == guest Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 600 -- Z poważaniem / Yours sincerely Zenon Matuszyk mobile: 00 48 797 004 938 e-mail: zenon.matuszyk(a)networkers.pl www: http://www.networkers.pl

2 3

Any example for rlm_redis_ippool?
by Yanrui Hu 14 Jul '16

14 Jul '16

Guys. Currently we are using rlm_sqlippool to allocate IP addresses for strongswan, the CPU of the DB server is rather high. Somebody said that rlm_redis_ippool could mitigate the problem, we want have a try. Can you send us an example -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

2 1

i cant change rate limit in mikrotik by coa
by تعلم البرمجة 14 Jul '16

14 Jul '16

hello ! i have dynamic ip and i want update user when online Update control { .... Mikrotik-Rate-Limit = "256k/1024k" } home_server example_coa { .... ipaddr = X.X.X.X # ?????????? } Unkown destination ip any idea ? sorry for language english

3 2

Freeradius with Cisco VSA tutorial?
by Ted Hyde 13 Jul '16

13 Jul '16

Greets, I'm migrating a cisco router from local auth to radius (already did wifi eap-tls on the ap's, that was the easy part), now looking to do the ssl vpn auth as well. There is mention of using both inline attributes and dictionary attributes (such as "webvpn:........" key pairs), however I haven't found any direct examples of such. Has anyone tried this before with freeradius and can share examples? Thanks, Ted. ⁣

2 1

Add APs based on MAC address instead of IP
by Raj Meka 13 Jul '16

13 Jul '16

Friends, I have installed freeradius recently on cloud. If I configure the IP in clients.conf file it is working fine. But I want add MAC address instead of IP, So I don't need to worry about the IP address of AP. Any suggestions, or anyone configured this way ? Raj

2 2

String expansion of attributes value from database
by Krzysztof Grobelak 13 Jul '16

13 Jul '16

Hello All, Is it possible to have similar functionality in a database stored reply item as with users file? in users file: user1 Cleartext-Password := “super_secret" Alc-Subsc-ID-Str := "%{Alc-Client-Hardware-Addr}", Alc-Subsc-Prof-Str := "sub_profile_1", Alc-SLA-Prof-Str := “sla_profile_1" The above works and the %{Alc-Client-Hardware-Addr} gets expanded to a correct mac address. However when the following is used in database: +----+----------------+--------------------+----+-------------------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+-------------------------------+ | 1 | profile_1 | Alc-Subsc-ID-Str | := | "%{Alc-Client-Hardware-Addr}" | | 2 | profile_1 | Alc-Subsc-Prof-Str | := | sub_profile_1 | | 3 | profile_1 | Alc-SLA-Prof-Str | := | sla_profile_1 | +----+----------------+--------------------+----+-------------------------------+ The value of Alc-Subsc-ID-Str attribute is returned as is, without expansion. The comments in the sql module say that the sql should mirror the users file in functionality so i’m assuming i’m missing something ;) Can you advice please? Regards, Kris

3 6

dhcp after wpa_supplicant auth on Unbuntu 16.04
by Alex Sharaz 13 Jul '16

13 Jul '16

Hi, Performing eap-tls on wired interface of an Ubuntu VM. Everything works o.k. and I'm in a vlan supporting IPv4 pooled addressing and SLACC IPv6. But interface IPv4 address is from before wpa_supplicant auth. Any easy way to delay dhpc request until after the wpa_auth operation? Rgds Alex

2 1

Swapping input and output octets
by Anuruddha Premalal 13 Jul '16

13 Jul '16

Hi All, One of the NAS in our network is reporting the accounting the wrong way (input and output octets are swapped). I'm trying to fix it by adding a logic similar to below at the start of the accounting section if( request:NAS-IP-Address == "192.168.1.7" && Acct-Status-Type != "Start"){ Temp-Attribute = &Acct-Input-Octets update request { Acct-Input-Octets := &Temp-Attribute Acct-Output-Octets := &Acct-Input-Octets } } I need to use a temporary variable to perform the data swapping. However I couldn't find a documentation of use of temporary variables or any such. Is there a better way to achieve this. How can a variable be used to store a value for a temporary reason without adding it to the request body. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 2

Fwd: i can`t allow all ipv4 home_server
by تعلم البرمجة 13 Jul '16

13 Jul '16

hello i want allow all ipv4 home server to control coa client 0.0.0.0/0 { secret=123123 coa_server= example_coa #working fine } home_server example_coa { type=coa ipaddr= * #allow all ip Not working secret=123123 ..... } sorry for my language english

2 1

i can`t allow all ipv4 home_server
by تعلم البرمجة 13 Jul '16

13 Jul '16

hello i want allow all ipv4 home server to control coa client 0.0.0.0/0 { secret=123123 coa_server= example_coa #working fine } home_server example_coa { type=coa ipaddr= * #allow all ip Not working secret=123123 ..... } sorry for my language english

2 1