- Freeradius-Users - lists.freeradius.org

Re: 802.1x & kerberos
by Reynolds, Walter 11 Oct '07

11 Oct '07

We also have this working with the below settings. However in running ver 1.1.6 (maybe others) we have found that there is some sort of problem that will cause the Freeradius server to crash. This seems to be tied to request with incorrect passwords as notated by the following in the log: Thu Oct 11 10:01:03 2007 : Auth: rlm_krb5: [UserName] krb5_g_i_t_w_p failed: Decrypt integrity check failed Has anyone else seen this or have suggestions for me on this. > Date: Thu, 11 Oct 2007 15:00:39 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: 802.1x & kerberos > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20071011140039.GA23584(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > It works w/o EAP. I can do a radtest with a valid userid and > password > > on the kerberos server and get authorized (and not get authorized > with > > bad information). > > right > > > I can get EAP-TTLS to work if I put a user and a password in the > radius > > users file but that's not what we want. We need the kerberos piece > to > > work. I'd be happy to send some config files along if that would > help. > > I feel like I'm missing something small that's so obvious no one has > > thought to document it. > > no. you dont need to use the users file for the userid/password. > you simply need to ensure that the krb5 module is in the Authorize > section and that you have PAP enabled...and that you are using EAP-TTLS > with PAP inner method. > > so....your FR config needs at least the following configs... > > radiusd.conf > > in the authorize section > > krb5 { > > } > > in the authenticate section (radiusd.conf for 1.1.x, sites- > enabled/default for 2.x) > > Auth-Type krb5 { > krb5 > } > > you MAY configure krb5 in radiusd.... we havent found this actually > necessary(!) > > # krb5 { > # keytab = /path/to/keytab > # service_principal = name_of_principle > # } > > > > finally. if you are facing issues and you dont help with supplying > a log file then please ensure that your RADIUS request isnt being > b0rked > by something in the users file eg > > DEFAULT Auth-Type = System > > you can at least change this to.... > > DEFAULT Auth-Type = krb5 > > just for checking(!!) > > alan > >

2 1

eDirectory Authentication
by Brad Lachel 11 Oct '07

11 Oct '07

We are currently using our RADIUS server to do one thing. It is authenticating wireless users via Mac address through access points. Very clean, very simple. We would like to increase the security a bit by having the users authenticate against eDirectory as well. If a user tries to get on the network, his MAC is passed to the RADIUS server. If the MAC is validated, the request is passed to the Novell Server, the user is asked to enter his password, and then he is allowed in. I have setup my config files according to several eDirectory/FreeRADIUS FAQ articles that I have found, but I am still having a few issues. 1: I am never asked for a password 2: rlm_ldap: When I attempt to get access, I get an error message "could not start TLS operations error" Below are some clips from my configurations as well as the access messages as I receive: ACCESS ATTEMPT: rad_recv: Access-Request packet from host 172.16.14.23:1812, id=1, length=73 User-Password = "xxxxxx" User-Name = "0016cb-b64f93" NAS-Identifier = "172.16.14.23" NAS-IP-Address = 172.16.14.23 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/172.16.14.23/auth- detail-20071011' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/ auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/ 172.16.14.23/auth-detail-20071011 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "0016cb-b64f93", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry 0016cb-b64f93 at line 222 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for 0016cb-b64f93 radius_xlat: '(uid=0016cb-b64f93)' radius_xlat: 'o=dist-155' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.16.13.10:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/ cacert.pem rlm_ldap: setting TLS CACert Directory to /usr/local/etc/raddb/certs/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Operations error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request RADIUSD.CONF # MODULE CONFIGURATION # modules { # pap { encryption_scheme = crypt auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 # passwd = /etc/passwd # shadow = /etc/shadow # group = /etc/group radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=% {Stripped-User-Name:-%{User-Name:-None}} --challenge=% {mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = 172.16.13.10 identity = "cn=ProxyUser,ou=District,o=dist-155" password = "xxxxxx" basedn = "o=dist-155" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = yes tls_mode = yes port = 636 tls_cacertfile = /usr/local/etc/raddb/certs/cacert.pem tls_cacertdir = /usr/local/etc/raddb/certs/ # tls_certfile = /usr/local/etc/raddb/certs/radius.crt # tls_keyfile = /usr/local/etc/raddb/certs/radius.key # tls_randfile = /path/to/rnd tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 Set: password_attribute = nspmPassword # password_attribute = userPassword edir_account_policy_check=yes # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=% {Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap- UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # set_auth_type = yes } EAP.CONF eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types md5 { } leap { } gtc { auth_type = PAP } ## EAP-TLS tls { private_key_password = ch$d!s$ private_key_file = ${raddbdir}/certs/cert-key.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes # check_crl = yes # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } mschapv2 { } } USERS #Dist - Lachel "0016cb-b64f93" Auth-Type := Local, User-Password == "xxxxxx" I am using freeRADIUS 1.1.7 on an OS X 10.4.10 Server machine. My Access Points are currently Apple Airports, but we will be replacing those with Cisco 1131s. Any help at getting this going would be greatly appreciated. Thanks Brad Lachel Community High School District #155 stuff(a)d155.org ----------------------------- All e-mail to and from this address is subject to the Acceptable Use Policies of Community High School District #155. All e-mail may be monitored and/or disclosed to third parties. Any views or opinions presented in an e-mail are solely those of the author and may not represent those of Community High School District #155. Community High School District #155 http://www.d155.org

4 4

weird problem
by Kris 11 Oct '07

11 Oct '07

i`m using Mikrotik (Hotspot) + Freeradius + Mysql + perl postscript to check auth , on perl script i do check quota based on radacct table. if quota more than xxx Gb then you cant login. the problem are like this what the result of accounting different with value that send to NAS. like this modcall: leaving group session (returns ok) for request 1 radius_xlat: '/usr/local/bin/rmauth.pl ADMIN 00:16:17:52:8F:94 172.1.1.248' Exec-Program: /usr/local/bin/rmauth.pl ADMIN 00:16:17:52:8F:94 172.1.1.248 Exec-Program output: Mikrotik-Xmit-Limit = _*762**2654321*_, Mikrotik-Recv-Limit = _*50000000000*_, Ascend-Data-Rate=_*98304*_, Ascend-Xmit-Rate=_*262144*_, Exec-Program-Wait: value-pairs: Mikrotik-Xmit-Limit = _*762**2654321*_, Mikrotik-Recv-Limit = _*50000000000*_, Ascend-Data-Rate=_*98304*_,, Ascend-Xmit-Rate=_*262144*_, Exec-Program: returned: 0 Sending Access-Accept of id 1 to 10.128.3.3 port 1024 Mikrotik-Xmit-Limit = _*3502655261*_ <= Above value is 7622654321 but it send 3502655261 Mikrotik-Recv-Limit = _*2755359744*_ <= Above value is 5000000000 but it send 2755359744 Ascend-Data-Rate = 98304 Ascend-Xmit-Rate = 262144 Finished request 1 any clue bout this problem ?

4 11

Re: configure MSCHAPV2 authentication protocol
by tnt＠kalik.co.yu 11 Oct '07

11 Oct '07

You can start by deleting that. It's totally wrong. That's not a CHAP-Password (it' not encrypted at all) and you can't use that attribute with MS-CHAPv2 anyway. Than read available information: http://wiki.freeradius.org/SQL_HOWTO Start by populating radcheck table, test it, and (when it works) then populate the rest. Ivan Kalik Kalik Informatika ISP Dana 11/10/2007, "yangcuilin" <yangcuilin(a)use.com.cn> piše: >Hi, brother >Yes, I using the Mysql, the data in mysql is attached file (sql.bmp). >What I should do? >

1 0

configure MSCHAPV2 authentication protocol
by yangcuilin 11 Oct '07

11 Oct '07

Hi, Attached is my configuration file. I want to use MSCHAPv2 authentication protocol in my FreeRADIUS. This is my first time to configuration about MSCHAPV2. May be something wrong with the file. Does it need configuration at other file? Please give me some advice. Thank you very much! Appreciated in advance. Rock

5 4

Problem with LDAP and Groups
by Bryan Evege 11 Oct '07

11 Oct '07

Hello all. First off here's what I want to accomplish in the end. Use LDAP as the backend to store all user information including radius attributes, shell info and access to specific devices in specific locations. For example, Johnny needs access to all linux boxes in Atlanta and priv-level 15 on cisco routers in Denver. Fred needs read/write access to all packet shappers in Denver and read only to all cisco devices in Atlanta and Denver. You get the picture. I've setup a test server following the document in /opt/freeradius/share/doc/freeradius/ldap_howto.txt without much difficulty. This method does a good job of allowing only certain groups to access certain devices without messing with the huntgroups. Here's the problem. When a user logs in and is a member of more than one group radius only uses the first one to match. I've included the users file below. For example, if the user is a member of the cisco group and the packeteer group only the packeteer group information gets passed back because it is found before the cisco group. Is there a way to say that the request is from a Cisco box so only look for the user in the cisco group? If the user is then found in that group then pass back the correct attributes from their profile. I know I would have to define what a "cisco box" is, probably by IP. Please let me know if this is even possible and if so provide an example. If it is not possible please provide some direction on how to go about doing this. Freeradius 1.1.7 *_Users file_* DEFAULT Ldap-Group == acct_disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." DEFAULT Ldap-Group == packeteer_read_only,User-Profile := "uid=packeteer_read_only,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == Packeteer,User-Profile := "uid=Packeteer,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == netscreen,User-Profile := "uid=netscreen,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == cisco_priv_15,User-Profile := "uid=cisco_priv_15,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == cisco_priv_1,User-Profile := "uid=cisco_priv_1,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == netscreen,User-Profile := "uid=netscreen,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." DEFAULT Auth-Type = System fall-Through = 1 Radiusd.conf ldap section ldap { server = "localhost" identity = "cn=Manager,dc=csctus,dc=net" password = xxxxxxx basedn = "ou=users,ou=radius,dc=csctus,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections #start_tls = yes # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #default_profile = "uid=Packeteer,ou=profiles,ou=radius,dc=csctus,dc=net" #profile_attribute = "radiusProfileDn" #access_attr = "DialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=no # groupname_attribute = radiusGroupName #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_filter = (&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)) groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes } dn: dc=csctus,dc=net objectClass: dcObject objectClass: organizationUnit ou: csctus.net Radius dc: csctus dn: ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: radius dn: ou=profiles,ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: profiles dn: ou=users,ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: users dn: ou=admins,ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: admins dn: uid=dial,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: dial radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=cisco,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: cisco radiusReplyItem: Cisco-AVPair ="priv-lvl=15" dn: uid=packeteer,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: packeteer radiusReplyItem: Packeteer-AVPair = "access=touch" dn: uid=isdn,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: isdn radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=example,ou=users,ou=radius,dc=csctus,dc=net objectclass: radiusProfile uid: example userPassword: test radiusGroupName: dial radiusGroupName: isdn dn: uid=bevege,ou=users,ou=radius,dc=csctus,dc=net radiusGroupName: cisco_priv_15 radiusGroupName: Packeteer objectClass: radiusprofile uid: bevege userPassword: {MD5}xxxxxxxxx dn: cn=freeradius,ou=admins,ou=radius,dc=csctus,dc=net objectclass: person sn: freeradius cn: freeradius userPassword: freeradius dn: cn=billing,ou=admins,ou=radius,dc=csctus,dc=net objectclass: person sn: billing cn: billing userPassword: billing dn: cn=replica,ou=admins,ou=radius,dc=csctus,dc=net objectclass: person sn: replica cn: replica userPassword: replica Thanks, BE

3 2

Post-Proxy attr_filter on Access-Accept Packets only
by Mike O'Connor 10 Oct '07

10 Oct '07

Hi Guys How do I only add a radius attribute via attr_filter on Accept-Accept Packets ? My current config is adding the attribute on accounting reply packets also. Thanks Mike

2 4

Question regarding the Expiration attribute
by Terry Pelley 10 Oct '07

10 Oct '07

FreeRADIUS Version 1.1.7 on Novell SLES10 The question is simple but I can't seem to find the answer to it so I will apologize in advance. Can some one tell me the format for entering the date in the Expiration attribute? I'm using the users file to authenticate users on a small wireless network. ie. testuser User-Password == "testpass" Expiration = ??? (lets use today 10 October 2007 as an example) thanks in advance.

2 1

Accounting with Oracle and stored procedures
by Tore Anderson 10 Oct '07

10 Oct '07

Hi. I'm having problems integrating FreeRADIUS with Oracle (Instantclient 10.2.0.3 library). My client makes two stored procedures available to me: FUNCTION session_start(id_in IN VARCHAR2, terminal_address_in IN VARCHAR2, nas_address_in IN VARCHAR2, msisdn_in IN VARCHAR2, apn_in IN VARCHAR2, rat_in NUMBER, start_date_in IN DATE) RETURN INTEGER; and FUNCTION session_stop(id_in IN VARCHAR2, bytes_transmitted_in IN NUMBER, bytes_received_in IN NUMBER, stop_date_in IN DATE) RETURN INTEGER; The juicy bits from my sql{} statement: driver = "rlm_sql_oracle" server = "foobar" login = "foobar" password = "foobar" radius_db = "(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=foobar)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=foobar)))" accounting_start_query = "SELECT session_start('%{Acct-Session-Id}', '%{Framed-IP-Address}', '%{NAS-IP-Address}', '%{Calling-Station-Id}', '%{Called-Station-Id}', '0', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')) FROM dual" accounting_stop_query = "SELECT session_stop('%{Acct-Session-Id}', '0', '0', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')) FROM dual" This is parsed correctly and FreeRADIUS (v1.1.0) starts up nicely enough. But when an accounting query comes in, I get the following error: rlm_sql (sql): Reserving sql socket id: 4 SELECT session_start('c16dd2c12dc4536a', '10.16.12.253', '10.0.0.1', '12341324', 'foobar', '0', TO_DATE('2007-10-10 16:16:19','yyyy-mm-dd hh24:mi:ss')) FROM dual rlm_sql_oracle: execute query failed in sql_query: ORA-24374: define not done before fetch or execute and fetch rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 SELECT session_start('c16dd2c12dc4536a', '10.16.12.253', '10.0.0.1', '12341324', 'foobar', '0', TO_DATE('2007-10-10 16:16:19','yyyy-mm-dd hh24:mi:ss')) FROM dual rlm_sql_oracle: execute query failed in sql_query: ORA-24374: define not done before fetch or execute and fetch rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-24374: define not done before fetch or execute and fetch We've also tried changing from FUNCTION to PROCEDURE, but no change in behaviour. Anyone here had similar problems? I'm thankful for any suggestions! Regards -- Tore Anderson

1 0

Re: IPv6 deployment "howto"
by Matthias Cramer 10 Oct '07

10 Oct '07

Hi Mark Mark J Elkins wrote: > Matthias Cramer wrote: >>>> What magic lines would I need to add to my Cisco and what magic to add >>>> to FreeRadius? >>>> Anyone have Dialup clients being issued IPv6 addresses yet? >>>> >>>> 1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static >>>> IPv6 address or to signify the NAS to use a Dynamic address) >>>> 2 - I expect the "authorize_check_query" and other SQL queries to change >>>> a bit... ie return IPv6 data - without breaking IPv4 only NAS's >>>> 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco. >>>> >>> There's Framed-IPv6-prefix, where you can assign Ip's to a client. >>> >> I do it with: >> >> cisco-avpair = "ipv6:route#1=2001:dead:beef::/64" >>srclient/faces/jsp/trademark/sr300.jsp?language=de&section=tm&id=510320 >> I do not use dynamic allocation. >> >> Cheers >> >> Matthias >> > Can I ask why? (why no dynamic). I don't even know if there is a way to > do this.... Because all the people i serve IPv6 this way are ADSL Customers, who are allways online anyway, and like to be able to run a webserver or such. > Why a /64 - and not /60 or /56 ?? (not even sure if thats possible) I do /64 and /48, but any sensible subnet is possible in my oppinion. > Sorry about the questions - but very few people seem to be providing any > sort of IPv6 access to dialup clients.... > > Some more.. > Do you use FreeRadius 2.0 or something older. No, i unse 1.1.3 because this is the last version which seams not to have the sighup bug. > In order to support IPv6 - what new fields did you add to your backend > (database). I use a traditional "users" file .... > Did you add any new "cisco-avpair" parts apart from an IPv6 Route ... No > which kind of seems strange to me - should you not have added a Prefix > (ipv6:prefix#1) instead ? .. which adds an entry to the RIB table anyway? > What did you have to add to the Cisco for user access? interface Virtual-Template1 mtu 1492 ip unnumbered Loopback0 no ip redirects no ip proxy-arp ip tcp adjust-mss 1452 ipv6 enable qos pre-classify peer default ip address pool ADSLPool1 ppp mtu adaptive ppp authentication chap pap callin ADSL ppp authorization ADSL > Are many (any?) people using IPv6? Not that many .. we have abut 5-10 Customers using IPv6 > What did they have to do on their end to get an address? Have a IPv6 Capable router... Which is a Cisco, Linux, *BSD Router. Probably it will also work with MacOSX or Vista doing PPP or PPPoE depending on what service you provice. > I promise that I'll one day update the wiki with this sort of info.. That sounds nice. Best regards and greetings to South Africa Matthias -- Matthias Cramer System & Network Manager Interway Communication GmbH Phone +41 43 500 1111 Josefstrasse 225 Fax +41 44 271 3535 CH-8005 Zuerich http://www.interway.ch/

2 1