Hi Nasser It would have been helpful if you mentioned what NAS you are using. Regards Vijay A. On Tuesday, November 17, 2015, Nasser Heidari <nasser@rasana.net> wrote:
Hi,
In my current environment I'm using Radius Proxy. As a new requirement I want to allow all users whom rejected by Proxy to connect to Network, but put them in walled garden and let them to access only specified resources. Also when they get connected I should store their IP, Mac, NAS information which exist in accounting packet.
I want to create virtual server on radius proxy and handle all REJECTED users with this. Problem is, there isn't any relation between authentication and accounting packets so I don't know which accounting packets are related to REJECTED users to forward them to virtual server.
I have two Ideas which may help me to solve this issue: 1- Store POSTAUTH message in DB and then when I receive accounting packets, in preacct stage lookup user's info using (mac+nas+nas-port) in POSTAUTH DB and then decide to forward packet to PROXY or Virtual server. 2- When I'm sending access-accept, send another attribute to NAS (which is Cisco), and NAS should include this special attribute in all accounting packets of REJECTED users so using this I can seprate users and send correct accounting info to PROXY or virtual server. (Trying to use a kind of marking method, which I'm not sure it's possible).
I would be thankful if you kindly share your Ideas about this problem and other possible methods to solve it.
Kind Regards, Nasser
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html