You're assuming FreeRADIUS will magically strip off the 'isakmp-group-id=' part of the value... AVPairs are Ciscos own invention they are not part of the RADIUS standard.

It's difficult to do because the order of AVPairs sometimes changes and the == operator will only check the first instance of the attribute.

If you care about it being reliable between Cisco NAS upgrade to 3.0x and i'll send you some unlang policies that deal with Cisco-AVPairs properly. If you don't, you can use the following...

authorize {
# Comment out files
# files
# Insert at the end of the authorize section
update request {
Auth-Type := "%{control:Auth-Type}"
}
}

post-auth {
# Add 
files.authorize
}

In the users file change

Auth-Type := ntlm_auth_vpn_osw, NAS-IP-Address == 10.1.1.1, Cisco-AVPair == " CiscoGroup "

to

Auth-Type == ntlm_auth_vpn_osw, NAS-IP-Address == 10.1.1.1, Cisco-AVPair == "isakmp-group-id=CiscoGroup"

-Arran

On 27 Jul 2011, at 09:52, Jevos, Peter wrote:

Hi ,
My cisco sends to radius it’s ip address, and isakmp-group-id ( or profile name )
Debug from radius –X :
 
        Cisco-AVPair = "isakmp-group-id=CiscoGroup"
         Acct-Session-Id = "61286"
        User-Name = "domain\\user"
        Cisco-AVPair = "connect-progress=No Progress"
        Acct-Authentic = Local
        Acct-Status-Type = Start
        NAS-Port-Type = Virtual
        NAS-Port = 20
        NAS-IP-Address = 10.1.1.1
 
How should I configure freeradius to accept request for this group (isakmp-group-id=CiscoGroup ) only for users, that are authenticated against Auth-Type := ntlm_auth_vpn_osw ( already used and working ) ?
However other groups ( or profiles ) should be authenticated against Auth-Type := vpn_auth_name
I tried this settings in the Users file  but It doesn’t work
 
DEFAULT          Auth-Type := ntlm_auth_vpn_osw, NAS-IP-Address == 10.1.1.1, Cisco-AVPair == " CiscoGroup "
                            Service-Type = Framed-User,
                           Framed-Protocol = PPP,
 
DEFAULT          Auth-Type := vpn_auth_name
                           Service-Type = Framed-User,
                          Framed-Protocol = PPP,
 
Thanks
 
pet
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Arran Cudbard-Bell
a.cudbardb@freeradius.org

RADIUS - Half the complexity of Diameter