Hi all,

I've spent many hours now trying to get dynamics clients working the way I would like them too.

But I've now got to the point where I need to reach out to the list for help.

I appreciate this is a long email with a lot of questions but I have worked hard to get this working myself... I just need some pointers now...

I'm running freeradius 2.2.5 on Ubuntu 14.04 with MySQL 5.5

Thank you very much all for all your help,

Kev/.

Deep breath...

1) Is it possible to 'key' all clients by the NAS-IP-Address field rather than the source IP address field?

I do appreciate that RFC2865 states that is MUST NOT be used, but that was back in 2000, when Cloud and SaaS hosting didn't exist.

Being how flexible freeradius is, I was wondering if this would be possible or has been done before.

2) Can Dynamics Clients also be keyed by NAS-IP-Address (naturally linked to q1)?

I've built my freeradius with the raw module and can do all the dynamic clients SQL queries using NAS-IP-Address fine, BUT freeradius refuses to cache the client secret with the message:

rad_recv: Access-Request packet from host 192.168.26.119 port 37350, id=43, length=86

server dynamic_client_server {

rlm_raw: NAS-IP-Address = 10.10.10.10

rlm_sql (sql): Reserving sql socket id: 1

rlm_sql_mysql: query: SELECT secret FROM nas WHERE nas-ip-address='10.10.10.10'

rlm_sql (sql): Released sql socket id: 1

} # server dynamic_client_server

- Cannot add client 192.168.26.119: IP address 10.10.10.10 do not match

Ignoring request to authentication address * port 1812 from unknown client 192.168.26.119 port 37350

Ready to process requests.

This happens when in my dynamic_clients update control, I have:

FreeRADIUS-Client-IP-Address = "%{raw:NAS-IP-Address}"

All works great if I use the source IP address but I'd like to use NAS-IP-Address.

3) Can a dynamic client set to match 0.0.0.0/0, support loading a 0.0.0.0/0 client from sql on start up?

If I have a client defined in my nas table with the nasname 0.0.0.0/0, I get the following message on start up:

rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas

rlm_sql (sql): Read entry nasname=0.0.0.0/0,shortname=All,secret=xxxxxxxx

rlm_sql (sql): Adding client 0.0.0.0 (All, server=<none>) to clients list

Failed to add duplicate client All

rlm_sql (sql): Released sql socket id: 4

rlm_sql (sql): Failed to add client 0.0.0.0 (All) to clients list. Maybe there's a duplicate?

Failed to load clients from SQL.

This does of course tell me what the problem is but is there a way to have a 0.0.0.0/0 client?

I've tested having 0.0.0.0/1 and 128.0.0.0/1 as two separate clients pointing to one dynamic clients virtual server, like this:

client dynamic_bottom {

ipaddr = 0.0.0.0

netmask = 1

dynamic_clients = dynamic_client_server

lifetime = 3600

}

client dynamic_top {

ipaddr = 128.0.0.0

netmask = 1

dynamic_clients = dynamic_client_server

lifetime = 3600

}

server dynamic_client_server {

authorize {

if ("%{sql:SELECT nasname FROM nas ...

Now this does start up fine without error and reports:

rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas

rlm_sql (sql): Read entry nasname=0.0.0.0/0,shortname=All,secret=xxxxxxxx

rlm_sql (sql): Adding client 0.0.0.0 (All, server=<none>) to clients list

rlm_sql (sql): Released sql socket id: 4

But then when I try a radtest (now using normal source address matching) the client still gets looked up by the dynamic client, even though this 'All' entry should match any v4 IP address:

rad_recv: Access-Request packet from host 192.168.26.119 port 44846, id=20, length=86

server dynamic_client_server {

rlm_raw: NAS-IP-Address = 10.10.10.10

rlm_sql (sql): Reserving sql socket id: 3

rlm_sql_mysql: query: SELECT nasname FROM nas ...

Is the 'read nas list on start up' stripping the /netmask and only adding 0.0.0.0 as a single hots entry?

Is it possible to 'see' the list of know clients within freeradius when it is running, be them loaded at start up or learned by dynamic_clients?

4) Do dynamic clients support network address range client definition lookups in sql, i.e. nasname = 192.168.1.0/24?

I've got my dynamic clients lookup sql queries working to find matching network entries when the request only has a single source IP address (using decimal ip address value comparisons and order by netmask sql queries), and the returned nasname from the sql entry to the dynamic client IS a network range but I think freeradius only caches it as a single host.

It works but I think it only adds the entry as a single host, when I try from a different host in the same subnet, I see another dynamic client sql lookup.

The documentation in dymanics_clients says you can do the same as you can with the normal clients file, which does support networks.