Kevin Ehlers wrote:
I'm having a really hard time with proxying or just dealing with CoA's. The documentation just isn't working for me.
Well... it's as clear as we know how.
I can configure the coa server. I can get the originate-coa server up too. I can send CoA's to the server, but I can't get it to proxy them or re-send them as if it was originating the CoA. I see that they're being processed when looking at debug mode. But I just don't know how to do anything with them.
See raddb/sites-available/coa. It says you can set Proxy-To-Realm in order to proxy the packets. This is *exactly* like setting Proxy-To-Realm for any other packet. recv-coa { ... update control { Proxy-To-Realm := "foo" } ... }
I want to be able to send a CoA request from PacketFence (or another management server) to freeradius, and have it relay that CoA to a specific switch. E.g. I have determined that a user needs to be quarantined, so I run a script on the backend, and part of that requires having that user re-authenticate and get assigned a quarantine vlan. PF determines which switch they're on, sends a CoA to FreeRadius, FreeRadius then sends the CoA to the correct switch.
That should work. It's been tested...
Is there a way to do this without configuring a client entry for every edge device?
No. RADIUS requires a shared secret for every edge device. FreeRADIUS can do networks (192.168/16), but that's about it.
Should I be using the proxy.conf in some way? I'm not really clear about how to use the virtual servers in regard to proxying.
You don't. They're independent. You configure virtual servers. You configure home servers. You tie them together with Proxy-To-Realm. Alan DeKok.