Ondrej Famera wrote:
- yes, I restart RADIUS after adding/removing record from DB, but result is that only one address is resolved per hostname (so dualstack hostname get resolved only to single IPv6 address - in context of RADIUS server, regular DNS query returns both IPv4 and IPv6 address)
RADIUS uses the source IP address to look up the shared secret. There is no "multiple IPs map to one secret" functionality. I'd be opposed to adding that, as it doesn't follow traditional RADIUS practice. i.e. The other RADIUS clients/servers on the network don't behave this way, either. On top of that, it gets into issues of responsibility. The DNS system may not be managed by the RADIUS department. And you don't want the DNS people to take down your RADIUS server by breaking DNS. So it's safer to use IP addresses.
- i haven't tried this yet, but it looks like i still need to resolve hostnames to addresses somewhere while my goal was to avoid this and let the RADIUS to do this stuff
RADIUS depends on addresses, not host names. Using host names is wrong.
- furthermore i have a different secret for every hostname on the same network (like 10.0.0.0/24) and according to documentation (raddb/sites-available/dynamic_clients) i need to assign secrets to addresses not hostnames, so it looks again as no-go solution for me
You can just use addresses. But maybe you mean you have two hostnames, both mapping to one address, but with different secrets. No, that's not going to work. It's impossible. RADIUS doesn't work that way. Alan DeKok.