X-Account-Key: account2
X-Mozilla-Keys: 
Received: from [127.0.0.1] ([172.17.101.70]) by correoex2.sti.uchile.cl with
	Microsoft SMTPSVC(6.0.3790.3959); Wed, 10 Sep 2008 17:01:48 -0400
Message-ID: <48C83494.9060206@sti.uchile.cl>
Date: Wed, 10 Sep 2008 16:56:52 -0400
From: "Osvaldo Campos M. - Administrador Red STI" <ocampos@sti.uchile.cl>
Reply-To: ocampos@sti.uchile.cl
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: ocampos@sti.uchile.cl
CC: "Osvaldo H. Campos Molina" <ocampos@uchile.cl>
Subject: Re: Cisco VPN Server 3000 + Radius + LDAP = heeelp!!
References: <Ztkt0OIN.1220995367.2139960.tnt@kalik.net>
	<48C8312B.3050600@sti.uchile.cl>
In-Reply-To: <48C8312B.3050600@sti.uchile.cl>
Content-Type: text/plain; charset="iso-8859-2"; format="flowed"
Content-Transfer-Encoding: quoted-printable
Return-Path: ocampos@sti.uchile.cl
X-OriginalArrivalTime: 10 Sep 2008 21:01:48.0087 (UTC)
	FILETIME=[7082CC70:01C91388]

Sorry, but I don't understand very well.

For that you understand our "scenario", we have an LDAP server with=20
users that are all in oneself branch. All these users have the attribute=20
"PostOfficeBox". We will use this attribute as the group attribute(i.e.,=20
to makes the difference between user's types). For example, if=20
PostOfficeBox=3D00000001 then the user belongs to Sales, if=20
PostOfficeBox=3D00000002 then the user belongs to Marketing.

So, what we need is assign addresses to vpn users according to=20
PostOfficeBox value.


My config in the ldap.attrmap is something like that... (This is what=20
you said??? Is correct???)
    checkItem    $GENERIC$   radiusCheckItem
    replyItem      $GENERIC$   radiusReplyItem
    checkItem    vpnusers1       PostOfficeBox    #vpnusers1 and=20
vpnusers2 are the ippool
    checkItem    vpnusers2       PostOfficeBox    #PostOfficeBox is the=20
LDAP attribute

In the user file...
    DEFAULT NAS-IP-Address =3D "y.y.y.y", Auth-Type :=3DLDAPVPN1, AUTZ-Type=
=20
:=3DLDAPVPN1, Pool- Name :=3Dvpnusers1
    DEFAULT NAS-IP-Address =3D "y.y.y.y", Auth-Type :=3DLDAPVPN2, AUTZ-Type=
=20
:=3DLDAPVPN2, Pool-Name :=3Dvpnusers2
    # y.y.y.y=3D address of VPN Server

In the radius.conf
 ldap vpnldap1 {
   server =3D "x.x.x.x"
   identity =3D "cn=3DDirectory Manager"
   password =3D **********
   basedn =3D "ou=3DPeople, dc:blah, dc=3Dcl"
   filter =3D "(&(uid=3D%u)(PostOfficeBox=3D00000001))"
   authtype =3D ldap
   set_asuth_type =3D yes
}

ldap vpnldap2 {
   server =3D "x.x.x.x"
   identity =3D "cn=3DDirectory Manager"
   password =3D **********
   basedn =3D "ou=3DPeople, dc:blah, dc=3Dcl"
   filter =3D "(&(uid=3D%u)(PostOfficeBox=3D00000002))"
   authtype =3D ldap
   set_asuth_type =3D yes
}
....
authorize {
    files
    Autz-Type LDAPVPN1 {
       vpnldap1
       }
Autz-Type LDAPVPN2 {
       vpnldap2
       }
}
....
authentication {
    Auth-Type LDAPVPN1 {
       vpnldap1
       }
    Auth-Type LDAPVPN2 {=E7
       vpnldap2
       }
}
....
ippool vpnusers1 {
    range-start    =3D 10.0.0.10
    range-stop    =3D 10.0.0.19
    netmask        =3D 255.255.255.0
    cache-size    =3D 10
    session-db    =3D ${raddbdir}/db.vpnusers1-session
    ip-index        =3D ${raddbdir}/db.vpnusers1-index
    override        =3D yes
}=20

ippool vpnusers2 {
    range-start    =3D 10.0.0.20
    range-stop    =3D 10.0.0.29
    netmask        =3D 255.255.255.0
    cache-size    =3D 10
    session-db    =3D ${raddbdir}/db.vpnusers2-session
    ip-index        =3D ${raddbdir}/db.vpnusers2-index
    override        =3D yes
}=20


Please help me with that, because I don't know what's wrong in my config.

Thanks so much.

Osvaldo H. Campos Molina
Administrador de Red
STI - Univ. de Chile