- Freeradius-Users - lists.freeradius.org

Strongswan integration, Access-Request contains no credentials?
by Phil Frost 16 Mar '18

16 Mar '18

I'm attempting to configure an IKEv2 VPN which uses strongswan's eap-radius plugin to delegate authentication to freeradius. I've configured freeradius to authenticate against Active Directory by executing ntlm_auth, and I'm hoping to use mschapv2 authentication. I'm able to successfully authenticate with radtest: radtest -x -t mschap phil.frost redacted 127.0.0.1 0 redacted Sending Access-Request of id 193 to 127.0.0.1 port 1812 User-Name = "phil.frost" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = redacted MS-CHAP-Response = redacted rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=193, length=84 MS-CHAP-MPPE-Keys = redacted MS-MPPE-Encryption-Policy = redacted MS-MPPE-Encryption-Types = redacted I'm also able to connect to the VPN if I use the eap-mschapv2 strongswan plugin in lieu of eap-radius and configure a plaintext password in strongswan's user database. So it would appear the issue is the integration between the two. Should strongswan be including the credentials? Or should freeradius be doing something to indicate the VPN client should present them? I've learned many ways things could work, but a hint at how they *should* work in this case would very much help me narrow what's otherwise been a fruitless search through a combinatorial explosion of RFCs and protocol options. This seems to be the most salient part of the freeradius output. The unabbridged debug output is attached. rad_recv: Access-Request packet from host 127.0.0.1 port 60479, id=236, length=137 User-Name = "phil.frost" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 5 NAS-Port-Id = "ikev2-vpn" NAS-IP-Address = 10.6.0.81 Called-Station-Id = "10.6.0.81[4500]" Calling-Station-Id = "73.161.191.57[4500]" NAS-Identifier = "strongSwan" Message-Authenticator = redacted # Executing section authorize from file /etc/freeradius/sites-enabled/postmates +group authorize { ++[preprocess] = ok ++[mschap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user.

2 1

Statistics about sql connections
by Andrea Gabellini 14 Mar '18

14 Mar '18

Hello, is it possible to get statistics about configured sql connections? At least how many threads are used? Thanks, Andrea -- ---------------------------------------------------------------- Missing your cat? Try looking under my tires. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

3 3

Stripped-User-Domain case insensitive
by wouldsmina 13 Mar '18

13 Mar '18

Hi, I'am testing Freeradius with this guide <https://wiki.freeradius.org/guide/eduroam>, but when I put a capital letter in my domain name (example: anonymous(a)mydomain.COm) the requests are proxied. I think I need to add something here (into site-enabled/default) : ... if (Stripped-User-Domain != "${operator_name}") { ... I tested : ... if ("%{tolower:Stripped-User-Domain}" != "${operator_name}") { ... but it doesn't work (all requests are proxied). what wrong? thanks.

2 2

off topic - eapol_test alternative
by Matt Zagrabelny 12 Mar '18

12 Mar '18

Greetings FR-users, We don't have access to the shared secrets of a RADIUS server performing EAP, but we'd like to download the RADIUS server SSL certs. Is anyone aware of a GNU/Linux utility similar to eapol_test to do this? I'm not sure if NetworkManager can do it - I've searched the internet a bit. Is there a proprietary solution that anyone is aware of? Thanks for any pointers! -m

4 10

How to configure freeradius server to authenticate VSA attribute
by Jibin Han 12 Mar '18

12 Mar '18

Hi, I am using freeradius v2.1.12 on Ubuntu 16.04, I need to configure it so that it will authenticate the incoming RADIUS messages based on their Vendor Specific Attributes. I looked over freeradius.org, it is not clear how to do that, hence ask people in this group. Here are the details - 1. We have an in-house developed RADIUS client software which creates a RADIUS access request message and sends to freeradius server. 2. The configuration of freeradius server is ready: when the client message has the right user/password, we can receive accept message; otherwise reject message. The authentication is PAP. 3. Now we insert VSA attribute: the code is 26, the vendor id is our vendor's ID and the custom name and value. 4. Our goal is, make freeradius server authenticate not only user/password, but also this VSA - when an invalid name/value are put into VSA, freeradius sends reject message. I check out dictionary, but that seems just some name mapping, I do not think it authenticate attributes. Could you point me the direction how this could be done and preferably with some examples? I can upgrade to freeradius v3 if it is required. Thanks a lot!

4 6

Freeradius - radacct session issue
by Pierre Delamotte 12 Mar '18

12 Mar '18

Hi Issue: I am picking a lot of entries in radacct that seem to have been updated days after session has been closed (recording of the timestamp of an accounting stop reception). Such an entry is looking like: select * from radacct where radacctid = 7299616\G *************************** 1. row *************************** radacctid: 7299616 acctsessionid: f0766fb97a76.0400.dhcp acctuniqueid: 9c83f2fc9f88007e5ebaf552233b6817 username: xxxxxx groupname: realm: xxxxxxxx nasipaddress: 10.100.2.10 nasidentifier: bgate1030 nasportid: slot=3D3D0=3D3B nasporttype: Wireless-802.11 acctstarttime: 2018-02-22 16:50:02 acctupdatetime: 2018-03-06 01:30:51 acctstoptime: 2018-02-25 18:55:30 acctinterval: 900 acctsessiontime: 6301 acctauthentic: connectinfo_start: connectinfo_stop: acctinputoctets: 359928391 acctoutputoctets: 6626058 calledstationid: A6-74-2A-B0-D2-4C:xxxxxxxx callingstationid: F0-76-6F-B9-7A-76 acctterminatecause: NAS-Reboot servicetype: framedprotocol: framedipaddress: 10.16.59.137 acctstartdelay: NULL acctstopdelay: NULL xascendsessionsvrkey: NULL 1 row in set (0.01 sec) select * from radacct where radacctid = 4605678\G *************************** 1. row *************************** radacctid: 4605678 acctsessionid: 2400ba1bcd17.0400.dhcp acctuniqueid: 3590303eebf7e0a3dbdca9116f37a6a2 username: xxxxxx groupname: realm: xxxxxxxxxxxx nasipaddress: 10.100.2.10 nasidentifier: bgate1030 nasportid: slot=3D3D0=3D3B nasporttype: Wireless-802.11 acctstarttime: 2018-01-18 09:11:03 acctupdatetime: 2018-03-09 16:10:37 acctstoptime: 2018-01-18 06:17:36 acctinterval: 10681 acctsessiontime: 942 acctauthentic: connectinfo_start: connectinfo_stop: acctinputoctets: 1716210 acctoutputoctets: 601621 calledstationid: A6-74-2A-AD-F0-F3:xxxxxxx callingstationid: 24-00-BA-1B-CD-17 acctterminatecause: NAS-Request servicetype: framedprotocol: framedipaddress: 10.16.22.228 acctstartdelay: NULL acctstopdelay: NULL xascendsessionsvrkey: NULL 1 row in set (0.00 sec) select * from radacct where radacctid = 5016371\G *************************** 1. row *************************** radacctid: 5016371 acctsessionid: a04c5b6485b1.0400.dhcp acctuniqueid: f28f3633c6d406e3d68d9bf75f1f3d71 username: xxxxxxxxxx groupname: realm: xxxxxxxxx nasipaddress: 10.100.2.10 nasidentifier: bgate1030 nasportid: slot=3D3D0=3D3B nasporttype: Wireless-802.11 acctstarttime: 2018-01-15 10:44:44 acctupdatetime: 2018-03-01 12:02:54 acctstoptime: 2018-01-15 12:06:12 acctinterval: 900 acctsessiontime: 1826 acctauthentic: connectinfo_start: connectinfo_stop: acctinputoctets: 120903 acctoutputoctets: 63363 calledstationid: B6-74-2A-AD-EF-A5:xxxxxxxxxx callingstationid: A0-4C-5B-64-85-B1 acctterminatecause: NAS-Request servicetype: framedprotocol: framedipaddress: 10.16.21.160 acctstartdelay: NULL acctstopdelay: NULL xascendsessionsvrkey: NULL 1 row in set (0.01 sec) Context: Freeradius (Version 3.0.13 see below) is deployed with a front-end called Radiusdesk. Service is provided thru WiFi APs centrally managed (Capwap) by and Access Controller (AC) acting as Freeradius client. This AC is regularly performing unattended reboots, hence most likely the replication of Accounting Session Id. The Accounting SQL management is performed via the standard Freeradius sql module. We picked up the issue when we identified some discrepancies in collecting user usage stats. Any idea why Freeradius would overwrite an entry that has been "closed"? and how we could work around that (beside ditching the AC or systematically moving the "closed" entries to another table upon reception of Acct_Stop)? radiusd: FreeRADIUS Version 3.0.13 (git #d5a382e), for host x86_64-pc-linux-gnu, built on Mar 24 2017 at 19:26:35 FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT PLM -- Disclaimer and Confidentiality Warning - This message is intended for the addressee only. If you are not the intended recipient of this message, you are notified that any distribution, use of or copying of this communication is strictly prohibited. If you have received the communication in error, please notify the sender immediately. The views and opinions expressed in this message are those of the individual sender of this message and do not necessarily represent the views and opinions of Brightwave Technologies Consequently, Brightwave Technologies does not accept responsibility for such views and opinions and this message should not be read as representing the views and opinions of Brightwave Technologies without subsequent written confirmation. Each page attached hereto must also be read in conjunction with this disclaimer.

2 3

FreeRADIUS packages by NetworkRADIUS
by Stefan Paetow 12 Mar '18

12 Mar '18

Hi guys, Just as a by the way, the LDAP module for FreeRADIUS as packaged by NR sarl has a dependency for openldap-ltb. This is not available in the CentOS or RedHat repos. You may want to document that (and where to find it). :-) Stefan Paetow Consultant, Trust and Identity t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

1 0

Accounting-Response taking too long
by mustafa mujahid 08 Mar '18

08 Mar '18

Hi all, Radius version : 2.2 (old, but reliable) Ive recently ran into a problem with our accounting Radius server which have seen smooth sailing for a long time. Basically every night at 8pm a stop request is generated for all users and then consequently a start to change the package assigned to the customer. Currently our Radius is serving 19000 customers. The problem we are facing is that the NAS which is basically a session and resource controller sends the accounting-requests but the accounting-responses are taking from around 7 to 10 seconds from the time the Acct-requests come in to be dispatched to the NAS as observed from wire shark, please see attachment. The same is reflected in the radius accounting logs. The problem that occurs due to this is that the NAS when it doesn't receive the response in the given time keeps retrying, sending accounting-requests again and again and eventually errors with retries expired and fails. Should I increase the ''max_requests'' in radiusd.conf, currently it set to 2048. The comments say it should be 256 multiplied by the number clients. Now by clients does it mean the actual number of customers in my case or the number of NASs that connect to the Radius server. (Apologies for the lack of understanding) Accounting responses usually take milliseconds but I don't know why it's taking so long in this case. If I could be guided in how to troubleshoot this or any assistance in this regard would be greatly appreciated. BR/Mustafa

4 5

Simultaneous-Use Attribute not working
by Muhammed Buvaydani 08 Mar '18

08 Mar '18

Hello every body I made all important configuration to allow Simultaneous-Use attribute working without result . Modify the /etc/freeradius/sql/mysql/dialup.conf file and unncomment : simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" This is the result when I run freeradius in debug mode , there are no any check for simultaneous-use attribute rad_recv: Accounting-Request packet from host 10.10.0.130 port 1049, id=231, length=104 Acct-Status-Type = Start Acct-Session-Id = "3a457fb2" User-Name = "99625743140" NAS-Identifier = "ftg" Framed-IP-Address = 192.168.33.5 Fortinet-Client-IP-Address = 192.168.33.5 Fortinet-Vdom-Name = "root" Calling-Station-Id = "192.168.33.5" Event-Timestamp = "Mar 8 2018 12:32:49 +03" # Executing section preacct from file /etc/freeradius/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',NAS-Identifier = "ftg",NAS-IP-Address = 10.10.0.130,Acct-Session-Id = "3a457fb2",User-Name = "99625743140"' [acct_unique] Acct-Unique-Session-ID = "cd2730cfc5c2adb4". ++[acct_unique] = ok [suffix] No '@' in User-Name = "99625743140", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 10.10.0.130 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.10.0.130/detail-20180308 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.10.0.130/detail-20180308 [detail] expand: %t -> Thu Mar 8 12:32:49 2018 ++[detail] = ok [sradutmp] expand: /var/log/freeradius/sradutmp -> /var/log/freeradius/sradutmp [sradutmp] expand: %{User-Name} -> 99625743140 rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[sradutmp] = noop [sql] expand: %{User-Name} -> 99625743140 [sql] sql_set_user escaped user --> '99625743140' [sql] expand: %{Acct-Delay-Time} -> [sql] ... expanding second conditional [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 10 rlm_sql (sql): Released sql socket id: 10 ++[sql] = ok ++update control { sql_xlat expand: %{User-Name} -> 99625743140 sql_set_user escaped user --> '99625743140' expand: SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where acctstarttime >= CURDATE() AND radacct.username='%{User-Name}' -> SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where acctstarttime >= CURDATE() AND radacct.username='99625743140' rlm_sql (sql): Reserving sql socket id: 9 sql_xlat finished rlm_sql (sql): Released sql socket id: 9 expand: %{sql:SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where acctstarttime >= CURDATE() AND radacct.username='%{User-Name}'} -> 115456 sql_xlat expand: %{User-Name} -> 99625743140 sql_set_user escaped user --> '99625743140' expand: SELECT value FROM radcheck WHERE attribute='Ftg-Total-Limit' AND username='%{User-Name}' -> SELECT value FROM radcheck WHERE attribute='Ftg-Total-Limit' AND username='99625743140' rlm_sql (sql): Reserving sql socket id: 8 SQL query did not return any results rlm_sql (sql): Released sql socket id: 8 expand: %{sql: SELECT value FROM radcheck WHERE attribute='Ftg-Total-Limit' AND username='%{User-Name}'} -> sql_xlat expand: %{User-Name} -> 99625743140 sql_set_user escaped user --> '99625743140' expand: SELECT value FROM radcheck WHERE attribute='Ftg-Total-Limit' AND username='%{User-Name}' -> SELECT value FROM radcheck WHERE attribute='Ftg-Total-Limit' AND username='99625743140' rlm_sql (sql): Reserving sql socket id: 7 SQL query did not return any results rlm_sql (sql): Released sql socket id: 7 expand: %{sql: SELECT value FROM radcheck WHERE attribute='Ftg-Total-Limit' AND username='%{User-Name}'} -> sql_xlat expand: %{User-Name} -> 99625743140 sql_set_user escaped user --> '99625743140' expand: select calledstationid from radacct where acctsessionid='%{Acct-Session-Id}' -> select calledstationid from radacct where acctsessionid='3a457fb2' rlm_sql (sql): Reserving sql socket id: 6 sql_xlat finished rlm_sql (sql): Released sql socket id: 6 expand: %{sql:select calledstationid from radacct where acctsessionid='%{Acct-Session-Id}'} -> ++} # update control = noop ++? if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-String-1}") expand: %{control:Tmp-Integer-0} -> 115456 expand: %{control:Tmp-String-1} -> ? Evaluating ("%{control:Tmp-Integer-0}" > "%{control:Tmp-String-1}") -> TRUE ++? if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-String-1}") -> TRUE ++if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-String-1}") { +++update coa { expand: %{User-Name} -> 99625743140 expand: %{Framed-IP-Address} -> 192.168.33.5 +++} # update coa = noop ++} # if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-String-1}") = noop [attr_filter.accounting_response] expand: %{User-Name} -> 99625743140 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 231 to 10.10.0.130 port 1049 WARNING: Empty pre-proxy section. Using default return values. Sending CoA-Request of id 235 to 10.10.0.130 port 3799 User-Name = "99625743140" Framed-IP-Address = 192.168.33.5 Finished request 2. Cleaning up request 2 ID 231 with timestamp +244 Going to the next request Waking up in 2.4 seconds. rad_recv: CoA-NAK packet from host 10.10.0.130 port 3799, id=235, length=50 Error-Cause = Session-Context-Not-Found Event-Timestamp = "Mar 8 2018 12:32:49 +03" Message-Authenticator = 0xdecd7dd3d4d82835f93f87c35704f1b9 # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +group post-proxy { [eap] No pre-existing handler found ++[eap] = noop +} # group post-proxy = noop Finished request 2. Going to the next request Waking up in 2.9 seconds.

1 0

dhcp xlat for encoding DHCP options in RADIUS attributes
by Nathan Ward 07 Mar '18

07 Mar '18

Hi, I did a bit of digging around in the archives, I’m trying to do effectively what Peter was doing in this thread: http://lists.freeradius.org/pipermail/freeradius-devel/2013-April/007974.ht… Actually not effectively, quite literally, for literally the same service offered by the same provider in the same market :) I am aware of dhcp_options xlat for *decoding* DHCP options. I am looking to encode DHCP options for transmitting to the NAS. I note that Arran has implemented an xlat called ‘dhcp’ since then, looks like it’s based on discussions from that thread, but I’m not sure how it should be used. I’ve defined some attributes similar to the thread above, but with the ‘dot notation’ format rather than the ‘BEGIN TLV’ type format. Additionally, I changed the type of ‘DHCP-Vendor’ to ‘tlv’. It was set to “octets # tlv”.. which I’m not sure how to interpret, but FreeRADIUS refused to start when it was set to that as the sub options expect it to be a TLV, which seems reasonable. This is in my dictionary.dhcp, in amongst everything else - the first lines is modified as I describe above, the others are new. ATTRIBUTE DHCP-Vendor 43 tlv ATTRIBUTE DHCP-Vendor-URL 43.1 string ATTRIBUTE DHCP-Vendor-Pass 43.2 string ATTRIBUTE DHCP-Vendor-CPEID 43.253 string If I do ‘ERX-Dhcp-Options = “0x%{dhcp:DHCP-Vendor-URL}”’ after setting DHCP-Vendor-URL, it tells me that it’s not a DHCP option, and I get an empty option. If I try set it to “0x%{dhcp:DHCP-Vendor}”, it gets set to empty, and it doesn’t get transmitted in the RADIUS packet. I have also tried things like %{dhcp:&DHCP-Vendor} and so on, but same result. The DHCP-Vendor-URL is transmitted in the RADIUS reply as a standard RADIUS VSA which isn’t useful unfortunately, and the NAS gets a bit confused. To get around that, I’m setting those attributes in control - could strip them out later, but, this seemed less cumbersome. I’ve tried leaving them in the reply, but ERX-Dhcp-Options is still not filled and is of course not transmitted. I can encode this all manually, and doing it by hand once off I do get the effect I’m after, but it’s a bit of a chore as the strings are variable length and of course content, and constructing a TLV structure with xlat by hand seems very fragile, so would rather do this with the purpose built xlat if I can. I have had a bit of a poke around in the code, but VSAs and particularly TLVs are a bit foreign to me. Any guidance about how to use this? Happy to write up some docs for the xlat pages or something once I’ve got a handle on how to use it. Looks like the same xlat is in v4 (at the moment) so would be useful for there too I presume. The documentation (http://networkradius.com/doc/3.0.10/raddb/mods-available/dhcp.html) suggesting it was used with ALu boxes and Juniper, but I wasn’t able to find any examples or discussion other than Peter’s above - and I believe it is slightly outdated now that the dhcp xlat has been implemented along side dhcp_options? Passing DHCP-Vendor-URL, I get an error as mentioned: (6) update control { (6) DHCP-Vendor-URL = "http://blah/" (6) DHCP-Vendor-Pass = "" (6) EXPAND %{string:request:ADSL-Agent-Remote-Id} (6) --> CHORUS1636495896B01 (6) DHCP-Vendor-CPEID = CHORUS1636495896B01 (6) } # update control = noop (6) update reply { (6) ERROR: DHCP option encoding failed: Attribute "DHCP-Vendor-URL" is not a DHCP option (6) EXPAND 0x%{dhcp:control:DHCP-Vendor-URL} (6) --> 0x (6) ERX-DHCP-Options = 0x (6) } # update reply = noop Predictably, this becomes: (6) Sent Access-Accept Id 75 from 10.55.86.243:1812 to 103.241.56.191:55932 length 0 (6) Framed-IP-Address = 100.74.0.69 (6) Reply-Message := "User authenticated - " (6) ERX-Virtual-Router-Name = "default:CustomersNat" (6) Class = 0x61693a3339373463396339613133383737326133313363303335653439383237643432 (6) ERX-Dhcp-Options = 0x And passing 'DHCP-Vendor’: (9) update control { (9) DHCP-Vendor-URL = "http://blah/" (9) DHCP-Vendor-Pass = "" (9) EXPAND %{string:request:ADSL-Agent-Remote-Id} (9) --> CHORUS1636495896B01 (9) DHCP-Vendor-CPEID = CHORUS1636495896B01 (9) } # update control = noop (9) update reply { (9) EXPAND 0x%{dhcp:control:DHCP-Vendor} (9) --> 0x (9) ERX-DHCP-Options = 0x (9) } # update reply = noop Predictably, this becomes: (9) Sent Access-Accept Id 84 from 10.55.86.243:1812 to 103.241.56.191:55932 length 0 (9) Framed-IP-Address = 100.74.0.69 (9) Reply-Message := "User authenticated - " (9) ERX-Virtual-Router-Name = "default:CustomersNat" (9) Class = 0x61693a6261656232323837616639393065366636666239316333623761643536366661 (9) ERX-Dhcp-Options = 0x (9) Finished request -- Nathan Ward

3 4