- Freeradius-Users - lists.freeradius.org

Strange CHAP/PAP issue (Version 1.1.6)[sic!]
by Wojciech Ziniewicz 26 Sep '07

26 Sep '07

Hello all, I have a small (about 400 users) network based on pppoe with freeradius authentication. For the last few days I am trying to switch to CHAP authentication. I've made proper changes to radiusd.conf and pppoe-server to demand CHAP auth from users and here's what I get. Here's what we've got in the database : RADCHECK : TEST Cleartext-password := TEST987 TEST Auth-Type := CHAP TEST Password == TEST987 READREPLY: TEST Service-Type = Framed TEST Framed-Compression = Van-Jacobson-TCP-IP TEST Framed-MTU = 1492 TEST Framed-IP-Netmask = 255.255.255.0 TEST Framed-IP-Address = 10.100.2.156 TEST Framed-Protocol = ppp TEST Auth-Type := CHAP TEST Password == TEST987 And the error is : a) here's the fragment from the syslog : Sep 26 01:34:37 beta pppd[5311]: Connect: ppp44 <--> eth2 Sep 26 01:34:37 beta pppd[5311]: rc_avpair_new: unknown attribute 60 Sep 26 01:34:47 beta pppd[5311]: Peer TEST failed CHAP authentication b) And fragment from the radius debug mode : rad_recv: Access-Request packet from host 127.0.0.1:3458, id=144, length=88 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "TEST" CHAP-Password = 0xdf6fe5d7a573bff814452731ef01f044df Calling-Station-Id = "00:E0:91:14:52:C3" NAS-IP-Address = 127.0.0.1 NAS-Port = 8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "attr_filter" returns noop for request 3 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 3 radius_xlat: 'TEST' rlm_sql (sql): sql_set_user escaped user --> 'TEST' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TEST' and access=1 ? ORDER BY id ' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: '' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'TEST' ORDER BY id ' radius_xlat: '' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 3 rlm_chap: login attempt by "TEST" with CHAP password rlm_chap: Using clear text password "TEST987" for user TEST authentication. rlm_chap: Password check failed modcall[authenticate]: module "chap" returns reject for request 3 modcall: leaving group CHAP (returns reject) for request 3 auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [TEST/<CHAP-Password>] (from client localhost port 8 cli 00:E0:91:14:52:C3) Delaying request 3 for 1 seconds Finished request 3 Going to the next request -------------- Any ideas ? Thanks a lot for your time and HELP! regards WZ -- Pozdrawiam, Wojciech Ziniewicz Administrator Cebit

3 8

simultaneous use --solved-- :-)
by Michael Ziemann 26 Sep '07

26 Sep '07

Hi all! I solved my simultaneous-use problems with AcctStopTime 0000-00-00 00:00:00 ... The reason was a wrong MySQL-Code in the sql.conf file: accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct- Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" I changed it to: # |-----> # | edited by Martin Kirchner & Michael Ziemann | Sep. 2007 # |-----> accounting_stop_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}', \ AcctOutputOctets = '%{Acct-Output-Octets}', \ AcctStopTime = FROM_UNIXTIME(UNIX_TIMESTAMP(`AcctStartTime`) + `AcctSessionTime` ) \ WHERE UserName = '%{SQL-User-Name}' \ AND AcctStopTime= '0000-00-00 00:00:00'" Now it works very well... The users can login, but they can't login twice at the same time... The accounting works perfect, too... Thanks for the good support and friendly responses. My project is finished now... Thanks for your patience! Michael Ziemann

2 1

Problem upgrading Windows version to Ver.1.1.7
by Terry Pelley 26 Sep '07

26 Sep '07

I'm Currently running FreeRADIUS Version 1.1.3-r0.1.2 (Windows version) Knowing that I am long overdue for an upgrade, I backed up all of my configs and ran the 1.1.7 installer. everything seems to go just fine and the service is up and running when the update process completes. However, when I try and run in Debug mode, I get the following error. Starting - reading configuration files ... reread_config: reading radiusd.conf Configuration directory ../etc/raddb is globally writable. Refusing to start due to insecure configuration. Errors reading radiusd.conf This happens with the "Out of the Box" configuration. I have not yet replaced the default configs with my own. The install was done using all of the defaults as well, I changed nothing. Any Windows/FreeRADIUS.net experts out there? Thanks.

2 1

Acct-Input-Gigawords in Exec-Program env
by Rob Hartzenberg 26 Sep '07

26 Sep '07

Hi list, I'm having trouble identifying the Acct-Input-Gigawords field in the shell environment of Exec-Program. Does anyone know how to ensure that it is being exported? I have a shell script (test-exec.sh) which according to examples in docs goes like so: #!/bin/sh /usr/bin/printenv > /tmp/env.txt Then in my acct_users, again by example: DEFAULT Acct-Status-Type == Stop Exec-Program = "/opt/bin/test-exec.sh" This correctly prints out all the env variables to the file as expected. The problem is however that with ADSL traffic regularly exceeding the Gigawords boundaries of Acct-Input-Octets, we rely on the Acct-Input-Gigawords for the overflow. This is unfortunately not showing up in the list of env variables. Anyway to resolve this? Thanks -Rob

2 1

Re: How to send different attributes a miscellaneous nas
by Medvedev Maxim 26 Sep '07

26 Sep '07

In FreeRadius 1.1.7+LDAP group handling work ? > 1. You need to enter priority for the groups in usergroup table. > 2. SQL group handling doesn't really work in 1.1.x versions. Upgrade to > 2.0. > > Ivan Kalik > Kalik Informatika ISP > > Dana 25/9/2007, "Elaalala Erence" <sp_root at mail.ru> pise: > >>Hi, >> >>freeradius 1.1.7 + postgres 8.1.9 >> >>radgroupcheck not work (( >> >>http://wiki.freeradius.org/Rlm_sql >>point 5 not work (( >> >>Why attributes are summarised ? >> >>Help me! -- Best regards, Medvedev Maxim mailto:sp_root@mail.ru

2 1

about the FreeRadius user manage tool
by yangcuilin 26 Sep '07

26 Sep '07

Hi, Do you know some FreeRadius user manager tools? If you know, please give me the name and web address (Or some advice)? I just want to add/delete/update the user convenient. Thank you very much. Rock

2 1

Special Character Password Authentication
by Aren Chua 26 Sep '07

26 Sep '07

Greeting to All, I have some problem on special character when authenticating on radius. my special character here means 'space' character. The sinario is like this: When I type in this username and password for authentication User-Name: abc123 User-Password: Aa;:/? ',<.>" (note the blank space after the "?") my radius server received the username and password as this: User-Name: abc123User-Password: Aa;:/?_',<.>" the 'space' character become this '_' character Any idea about this issue? Regards, Aren Chua _________________________________________________________________ Gear up for Halo® 3 with free downloads and an exclusive offer. It’s our way of saying thanks for using Windows Live™. http://gethalo3gear.com?ocid=SeptemberWLHalo3_WLHMTxt_2

2 1

Openser+Asterisk+Freeradius
by Live Great 26 Sep '07

26 Sep '07

Hi, Is this the solution to provide an accurate billing/accounting function? What is the goal for integrating this 3 software? I've been searched google for a while, but couldn't find a clear answer. Your comment is much appreciated. Thanks SW

2 1

generate_state() in rlm_eap module generates duplicate state ?
by Vinay Wagh 25 Sep '07

25 Sep '07

Hi, I am using version freeradius ver 1.1.6 and I am observing a problem for which I could not find an existing bug report. Here is the description Problem description I am testing a gateway appliance for large number of subscribers. I am sending around 100 EAP-authentication requests (EAP-MD5) per second (or more) to the freeradius server. Before starting my request I changed the max_requests configuration from 1024 to 8192. What I observed was that every so often I would get an Access-Reject for a request which should have succeeded and does succeed on subsequent attempts. I added debugs in the free radius server and found out that in eap_authenticate the handler for this request never gets inserted in the session tree. So the radius server sends the Access-Challenge but when the gateway replies to the Access-Challenge the radius server cannot find the EAP request handler in the session tree and so the authentication fails. On looking deeper in to the problem I saw that the reason the rbtree_insert in eaplist_add() fails is because there is already a node in the tree with the same state (PW_STATE), this node is for a different request altogether and so the insert in to the tree fails. Since I send multiple requests from the same gateway and the radius client on the gateway opens up 4 source ports to the radius server we have can send 4 requests in the same second that have the same ID and source IP address. The eap_handler_cmp() function uses the STATE to distinguish requests if the id and source IP address are the same, but in my case the state is also the same. Here is the relevant debug log for it Wed Sep 19 22:36:37 2007 : Info: STATE: Added state 82 f1 8b 49 6f bf b9 a4 ee 2a d3 d5 ef f8 ec 3b for {am= 1}201myid(a)mynet.net <1%7D201myid(a)mynet.net> Sending Access-Challenge to {am= 1}201myid(a)mynet.net <1%7D201myid(a)mynet.net> ... ... rad_recv: Access-Request packet from host 1.1.1.1:57979, id=8, length=160 User-Name = "{am= 1}245myid(a)mynet.net <1%7D245myid(a)mynet.net>" ... Wed Sep 19 22:36:37 2007 : Info: STATE: Added state 82 f1 8b 49 6f bf b9 a4 ee 2a d3 d5 ef f8 ec 3b for {am= 1}245myid(a)mynet.net<1%7D245myid(a)mynet.net> Wed Sep 19 22:36:37 2007 : Error: Found duplicate data, Id = {am= 1}201myid(a)mynet.net <1%7D201myid(a)mynet.net>, State = 82 f1 8b 49 6f bf b9 a4 ee 2a d3 d5 ef f8 ec 3b Wed Sep 19 22:36:37 2007 : Error: rlm_eap: Failed to remember handler! I am guessing this can cause other problems, not sure if this can result in sending Access-Accept to users who should not be authenticated but it definitely rejects users who should be authenticated. Another problem I see which seems related to this is that I receive Access-Accept on the gateway for a valid user but the reply has an invalid message authenticator. I think this is probably because it finds a different handler instead, but not sure about that. Is this a known bug ? If yes, is it fixed and in what release ? For now, I am changing the eap_handler_cmp() function to compare the identity if the state is the same, since in our lab setup we also have a unique identity for each user, do you see a problem with doing this. Thanks, Vinay

4 5

How to send different attributes a miscellaneous nas
by Медведев Максим 25 Sep '07

25 Sep '07

Hi, freeradius 1.1.7 + postgres 8.1.9 radgroupcheck not work (( http://wiki.freeradius.org/Rlm_sql point 5 not work (( Why attributes are summarised ? Help me! Full info: INSERT INTO radcheck (id, username, attribute, op, value) VALUES (1, 'sproot', 'User-Password', '==', '123'); INSERT INTO radgroupcheck (id, groupname, attribute, op, value) VALUES (2, 'juniper_pppoe_64k', 'Huntgroup-Name', '==', 'juniper'); INSERT INTO radgroupcheck (id, groupname, attribute, op, value) VALUES (1, 'cisco_pppoe_64k', 'Client-IP-Address', '==', '172.25.0.1'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (1, 'cisco_pppoe_64k', 'Cisco-AVPair', '=', 'lcp:interface-config#1=rate-limit input 64000 8000 8000 conform-action transmit exceed-action drop'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (2, 'cisco_pppoe_64k', 'Cisco-AVPair', '+=', 'lcp:interface-config#1=rate-limit output 64000 8000 8000 conform-action transmit exceed-action drop'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (3, 'juniper_pppoe_64k', 'ERX-Egress-Policy-Name', '=', 'pppoe-64kbps-policy'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (4, 'juniper_pppoe_64k', 'ERX-Egress-Statistics', '=', '1'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (5, 'juniper_pppoe_64k', 'ERX-Ingress-Policy-Name', '=', 'pppoe-64kbps-policy'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (6, 'juniper_pppoe_64k', 'ERX-Ingress-Statistics', '=', '1'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (7, 'juniper_pppoe_64k', 'ERX-Primary-Dns', '=', '1.1.1.1'); INSERT INTO radgroupreply (id, groupname, attribute, op, value) VALUES (8, 'juniper_pppoe_64k', 'ERX-Secondary-Dns', '=', '2.2.2.2'); INSERT INTO radreply (id, username, attribute, op, value) VALUES (1, 'sproot', 'Framed-IP-Address', '=', '192.168.1.2'); INSERT INTO radreply (id, username, attribute, op, value) VALUES (2, 'sproot', 'Framed-IP-Netmask', '=', '255.255.255.255'); INSERT INTO usergroup (username, groupname, priority) VALUES ('sproot', 'cisco_pppoe_64k', 0); INSERT INTO usergroup (username, groupname, priority) VALUES ('sproot', 'juniper_pppoe_64k', 0); ################################ "huntgroups" file: juniper NAS-IP-Address == 172.25.0.10 cisco NAS-IP-Address == 172.25.0.1 ################################ "users" file: DEFAULT Simultaneous-Use := 1 Fall-Through = 1 ################################ "clients.conf" file: client 127.0.0.1 { secret = testing123 shortname = localhost nastype = other } client 10.0.1.2 { secret = testing123 shortname = localhost nastype = other } client 172.25.0.1 { secret = test shortname = nas.lan nastype = cisco } ################################ "postgresql.conf" file: sql { driver = "rlm_sql_postgresql" server = "localhost" login = "radius" password = "diametr" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" read_groups = yes postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "usergroup" deletestalesessions = no sqltrace = yes sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 sql_user_name = "%{User-Name}" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" authorize_group_check_query = "SELECT ${groupcheck_table}.id, ${groupcheck_table}.GroupName, \ ${groupcheck_table}.Attribute, ${groupcheck_table}.Value,${groupcheck_table}.Op \ FROM ${groupcheck_table}, ${usergroup_table} \ WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName \ ORDER BY ${groupcheck_table}.id" authorize_group_reply_query = "SELECT ${groupreply_table}.id, ${groupreply_table}.GroupName, ${groupreply_table}.Attribute, \ ${groupreply_table}.Value, ${groupreply_table}.Op \ FROM ${groupreply_table},${usergroup_table} \ WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName \ ORDER BY ${groupreply_table}.id" authenticate_query = "SELECT Value,Attribute FROM ${authcheck_table} \ WHERE UserName = '%{User-Name}' AND ( Attribute = 'User-Password' OR Attribute = 'Crypt-Password' ) \ ORDER BY Attribute DESC" group_membership_query = "SELECT GroupName FROM ${usergroup_table} WHERE UserName='%{SQL-User-Name}'" simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL" accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, \ ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey, \ ERXIngressPolicyName, ERXEgressPolicyName, ERXPppoeDescription, CiscoAVPair) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', \ NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}', '%{ERX-Ingress-Policy-Name}', '%{ERX-Egress-Policy-Name}', '%{ERX-Pppoe-Description}', '%{Cisco-AVPair}')" accounting_stop_query = "UPDATE ${acct_table2} \ SET AcctStopTime = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), \ AcctSessionTime = NULLIF('%{Acct-Session-Time}', '')::bigint, \ AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), \ AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), \ AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, \ FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" } ################################ "radius.conf" file: prefix = /opt/freeradius exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radius group = radius max_request_time = 20 delete_blocked_requests = no cleanup_delay = 5 max_requests = 5120000 bind_address = "10.0.1.2" port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 50 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 32 max_servers = 64 min_spare_servers = 8 max_spare_servers = 32 max_requests_per_server = 500 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0640 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/postgresql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess auth_log chap mschap files sql pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } preacct { preprocess acct_unique files } accounting { detail sql } session { sql } post-auth { reply_log } pre-proxy { } post-proxy { } ################################ Packet-Type = Access-Request Sun Sep 23 02:40:21 2007 Cisco-AVPair = "client-mac-address=000c.293b.eba6" Framed-Protocol = PPP User-Name = "sproot" CHAP-Password = 0x017c2048ee32d9a2fbe809c193930c17b3 NAS-Port-Type = Virtual NAS-Port = 268435472 NAS-Port-Id = "1/0/0/0" Service-Type = Framed-User NAS-IP-Address = 172.25.0.1 Acct-Session-Id = "00000010" Client-IP-Address = 172.25.0.1 CHAP-Challenge = 0xd59ee4fe7f305d7d9aace2827f6d2b72 Huntgroup-Name = "cisco" Packet-Type = Access-Accept Sun Sep 23 02:40:21 2007 Framed-IP-Address = 192.168.1.2 Framed-IP-Netmask = 255.255.255.255 Cisco-AVPair = "lcp:interface-config#1=rate-limit input 64000 8000 8000 conform-action transmit exceed-action drop" Cisco-AVPair += "lcp:interface-config#1=rate-limit output 64000 8000 8000 conform-action transmit exceed-action drop" ERX-Egress-Policy-Name = "pppoe-64kbps-policy" ERX-Egress-Statistics = enable ERX-Ingress-Policy-Name = "pppoe-64kbps-policy" ERX-Ingress-Statistics = enable ERX-Primary-Dns = 1.1.1.1 ERX-Secondary-Dns = 2.2.2.2 P.S. sorry for my bad english...

2 1