Thank you for your answer Alan...And to take time to teach me the right way to get some help. I sincerely appreciate it. I will try to rephrase my question according to your advices. To authenticate host in a network i'm using a Proxy Radius chain. The first element of this chain is named a Node and has a node identifier. Host are connecting to the network via NAS and the Radius Server configured in the NAS is the node radius. The host and the NAS don't know about the node identifier. The radius server knows about node identifier. I have add a node file under /etc/raddb/policy.d/ and invoked it in /etc/raddb/sites-available/default node.pre-proxy { if ("%{request:Packet-Type}" == 'Access-Request') { update proxy-request { &NET-NodeID == "ndid-00000001" } } } but when using PEAP-MSCHAPv2 authentication model the NET-NodeID item doesn't appear in the Access-Request sent to the inner-tunnel. Fri Aug 26 16:16:40 2016 : Debug: (2079) Virtual server inner-tunnel received request Fri Aug 26 16:16:40 2016 : Debug: (2079) EAP-Message = 0x0242001a01746573744062796f2d6e6574776f726b732e636f6d Fri Aug 26 16:16:40 2016 : Debug: (2079) FreeRADIUS-Proxied-To = 127.0.0.1 Fri Aug 26 16:16:40 2016 : Debug: (2079) User-Name = "test@networks.com" Fri Aug 26 16:16:40 2016 : Debug: (2079) NAS-IP-Address = 127.0.0.1 Fri Aug 26 16:16:40 2016 : Debug: (2079) NAS-Identifier = "ap.example.com" Fri Aug 26 16:16:40 2016 : Debug: (2079) Called-Station-Id = "4E-A1-C9-31-3D-06:" Fri Aug 26 16:16:40 2016 : Debug: (2079) NAS-Port-Type = Wireless-802.11 Fri Aug 26 16:16:40 2016 : Debug: (2079) NAS-Port = 0 Fri Aug 26 16:16:40 2016 : Debug: (2079) Calling-Station-Id = "2A-72-E8-47-76-FE" Fri Aug 26 16:16:40 2016 : Debug: (2079) Connect-Info = "CONNECT 0Mbps 802.11b" Fri Aug 26 16:16:40 2016 : Debug: (2079) Acct-Session-Id = "57B6BC2F-0000000C" Fri Aug 26 16:16:40 2016 : Debug: (2079) Framed-MTU = 1400 Fri Aug 26 16:16:40 2016 : Debug: (2079) Event-Timestamp = "Aug 26 2016 16:16:40 CEST" I join the file containing the full authentication log for a request coming from node with identifier ndid-00000001 in NET-NodeID Once again thank you for your support. I did my best to answer your request and give you a better view. Let me know if it is not enough. Tim Le 28/08/2016 à 22:59, Alan DeKok a écrit :
On Aug 28, 2016, at 11:37 AM, Tim Baledorion <timbaledorion@hotmail.com> wrote:
Here is my design. I would suggest using standard RADIUS vocabulary. And being clear in your descriptions.
I have a node implementing a Radius Proxy. What's a "node"?
This node is including its identifier in all Radius-Request. What is that "identifier?" Is it a RADIUS attribute?
What's a "RADIUS-Request" ?
Its identifier is returned by the radius proxy chain (that has 3 levels til the end radius server) OK...
A NAS is connected to this node and linked to the radius proxy. How is the NAS "linked" to the RADIUS proxy?
The host are connecting to the NAS using PEAP/MSCHAPv2. OK...
I want the Node Identifier to be a part of the check items for the authentication process but i don't know how to do it. Read the debug output as suggested in the FAQ, "man" pages, web pages, and daily on this list.
See what attributes are in the Access-Request. Then... write policies to look for those attributes.
There is tons of documentation, and hundreds of examples of policies that come with the server.
I don't know if it has to be configured at the client, NAS or RADIUS side. RADIUS server policies are configured on the RADIUS server.
As of today everything works as described above but i haven't find anyway to get the Node Identifier Item in the authentication request. Read the debug output as suggested in the FAQ, "man" pages, web pages, and daily on this list.
You will see what is in the packet.
Don't hesitate to ask for further informations. Please ask *good* questions. Right now, it's very hard to know what you want to do, because you've given very unusual explanations for everything.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html