-- Nathan Ward
On 5/06/2016, at 21:23, Rene Stoutjesdijk <r.stoutjesdijk@gmail.com> wrote:
Hello, i do have a question (my first on this list) or described situation below is possible, and if yes can somebody provide me tips how to do the freeradius part.
I do have a freeradius daemon up and running with only authentication and accounting. I would like to change the setup that also ip address are provided (via the AVP Framed-IP-Address) towards the client. This seems to be possible, but i would like to get the ip address from an external DHCP server. So basically what i would like to achieve is: if authentication request comes in: - let the radius daemon do a request for an ip address from an external dhcp server with the following characteristics - the client mac address should contain the IMSI/MSISDN from the subscriber (request is coming from a GGSN (mobile network)) so doesn't contain a valid client mac address - the username AVP should be used as (i think option 61) within DHCP so it can also be used with the DHCP/DNS integration for name resolving (DDNS) - if the ip address is provided towards the free radius daemon, take this ip address and provide it back within the framed-ip-addres AVP towards the radius client (GGSN)
I do have maybe an alternative and that's provide the ip address from the free radius daemon and execute a nsupdate update script to update the DNS, but i think the above described situation is better.
Hi, To my knowledge, FreeRADIUS doesn’t implement a DHCP client, the closest it gets is a relay. It sounds like your solution has quite a few moving parts, and I can see a couple of places where it might go wonky. If I were you I would simplify this to assign addresses out of FreeRADIUS, or even from a pool on the GGSN and look to accounting packets for IP address information, then sync your online user information with your DNS if that is a requirement. You touched on nsupdate which is a way to achieve this as users come online, but you should look at a way to sync periodically also - how you achieve that really depends on your DNS server. If you are really determined to do it with DHCP, perhaps the FreeRADIUS “dhcpclient” binary would help you in building a fake client. Remember you will need to maintain leases and so on so might want to do this on accounting or something. It’s all very fiddly, and will surely break! I haven’t ever done this, so YMWV. -- Nathan Ward