Hi: In my years running a dialup ISP, I used Cistron Radius and Cisco and Lucent NAS's. I am no using FreeRadius and a Cisco router to authenticate pptp VPN users. The default IP address pool is defined in the Cisco like this (parsed): interface Virtual-Template1 peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ! ip local pool vpnpool 192.168.0.1 192.168.0.254 That works fine authenticating unix system users using this raddb/users config (one of the supplied samples): DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP I now want to assign a few users different, static IPs using this: testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP This sort of thing used to work fine with Cisco dialup NAS's and Cistron, even though the NAS had no pool using that IP range in its config...radius just forced it to override the default pool, but in this case, it just keeps assigning an IP from the NAS pool (and yes, I have the above statement ABOVE the DEFAULT statement). Is there something else that needs to be done to allow this? Thanks in advance! James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
I now want to assign a few users different, static IPs using this:
testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP
This sort of thing used to work fine with Cisco dialup NAS's and Cistron, even though the NAS had no pool using that IP range in its config...radius just forced it to override the default pool, but in this case, it just keeps assigning an IP from the NAS pool (and yes, I have the above statement ABOVE the DEFAULT statement).
Is Framed-IP-Address in the Access-Accept packet? You should probably return Service-Type as well. If attribute is not in the accept packet post the debug. Ivan Kalik Kalik Informatika ISP
On Wed, 7 Jan 2009, tnt@kalik.net wrote:
I now want to assign a few users different, static IPs using this:
testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP
This sort of thing used to work fine with Cisco dialup NAS's and Cistron, even though the NAS had no pool using that IP range in its config...radius just forced it to override the default pool, but in this case, it just keeps assigning an IP from the NAS pool (and yes, I have the above statement ABOVE the DEFAULT statement).
Is Framed-IP-Address in the Access-Accept packet? You should probably return Service-Type as well. If attribute is not in the accept packet post the debug.
It appears to be. From debug, after "Login OK": +- entering group post-auth ++[exec] returns noop Framed-Protocol == PPP Framed-IP-Address = 192.168.1.2 (The address I want) Framed-IP-Netmask = 255.255.255.0 Framed-Compression = Van-Jacobson-TCP-IP Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 195 with timestamp +79 Ready to process requests. However, that is not the IP that my client shows...it shows 192.168.0.2, which is from the pool defined in the Cisco router's config. It seems to be overriding the radius users' config. James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
I now want to assign a few users different, static IPs using this:
testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP
This sort of thing used to work fine with Cisco dialup NAS's and Cistron, even though the NAS had no pool using that IP range in its config...radius just forced it to override the default pool, but in this case, it just keeps assigning an IP from the NAS pool (and yes, I have the above statement ABOVE the DEFAULT statement).
Is Framed-IP-Address in the Access-Accept packet? You should probably return Service-Type as well. If attribute is not in the accept packet post the debug.
It appears to be. From debug, after "Login OK": +- entering group post-auth ++[exec] returns noop Framed-Protocol == PPP Framed-IP-Address = 192.168.1.2 (The address I want) Framed-IP-Netmask = 255.255.255.0 Framed-Compression = Van-Jacobson-TCP-IP Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 195 with timestamp +79 Ready to process requests. However, that is not the IP that my client shows...it shows 192.168.0.2, which is from the pool defined in the Cisco router's config. It seems to be overriding the radius users' config. ---------------------------------------------------------------------- Hi James I was running into this problem on my Redback. The issue was the Redback wanted an IP address in the same subnet so I had to setup 192.168.1.1/24 as a sub interface to allow subscribers to be assigned addresses in the 192.168.1.x/24 range. My Shasta was completely different and would allow any IP address to be returned via radius and it would allow the IP to be used. Cheers, Jeff,
On Wed, 7 Jan 2009, Jeff Crowe wrote:
I was running into this problem on my Redback. The issue was the Redback wanted an IP address in the same subnet so I had to setup 192.168.1.1/24 as a sub interface to allow subscribers to be assigned addresses in the 192.168.1.x/24 range. My Shasta was completely different and would allow any IP address to be returned via radius and it would allow the IP to be used.
Ok, I just tried assigning a secondary IP from that subnet to faste0/0, since I can't assign secondary IPs to the VirtualTemplate I/F, since it's IP unnumbered eth0/0. No go. What I would expect from the Cisco, judging from my past experience with AS5200s, is for it to allow radius to assign whatever address it wants, but simply not route it until I fix that part of it, which is fine. One fix I would think would start to work would be to simply add this new subnet to the pool on the Cisco. However, then the DEFAULT users would start to assign from that pool as well, unless I figure out a way to force it to assign from the first subnet. If there's a way to force that, I'd appreciate pointers. I saw the "ippool" option, but I'm not clear how that co-exists with the pool already configured on the Cisco. Perhaps you need both, it's just not clear to me. James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
Sorry for the top-post, but I'm replying to myself and I want to keep my questions clear. I tried creating two different "ippools" in the radiusd.conf using the different ranges I want to use, but the client ignored it and went only to the pool that the Cisco has. I then changed the Cisco pool to include the entire range of IPs from both pools, but it still doesn't seem to recognize the FreeRadius pools, and defaults to whatever the first IP is in the Cisco pool. I find the examples given in the radiusd.conf a little incomplete, but this is what I tried (IPs given are just examples) ippool users_pool { range-start = 172.16.1.2 range-stop = 172.16.30.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes } ippool admin_pool { range-start = 172.16.30.2 range-stop = 172.16.30.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes } The above seems to be clear from the example...but the example for the raddb/users file is incomplete...here is what I tried: testuser Service-Type == Framed-User Group == users, Pool-Name :="users_pool", Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP I'm a little unlcear about the "Group" attribute above, and whether it pertains to unix groups at all, which I haven't done anything to yet. In any case, any pointers on how to make different users use different IP pools would be greatly appreciated. On Wed, 7 Jan 2009, up@3.am wrote:
On Wed, 7 Jan 2009, Jeff Crowe wrote:
I was running into this problem on my Redback. The issue was the Redback wanted an IP address in the same subnet so I had to setup 192.168.1.1/24 as a sub interface to allow subscribers to be assigned addresses in the 192.168.1.x/24 range. My Shasta was completely different and would allow any IP address to be returned via radius and it would allow the IP to be used.
Ok, I just tried assigning a secondary IP from that subnet to faste0/0, since I can't assign secondary IPs to the VirtualTemplate I/F, since it's IP unnumbered eth0/0. No go. What I would expect from the Cisco, judging from my past experience with AS5200s, is for it to allow radius to assign whatever address it wants, but simply not route it until I fix that part of it, which is fine.
One fix I would think would start to work would be to simply add this new subnet to the pool on the Cisco. However, then the DEFAULT users would start to assign from that pool as well, unless I figure out a way to force it to assign from the first subnet. If there's a way to force that, I'd appreciate pointers. I saw the "ippool" option, but I'm not clear how that co-exists with the pool already configured on the Cisco. Perhaps you need both, it's just not clear to me.
James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am ========================================================================= - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
ippool users_pool { range-start = 172.16.1.2 range-stop = 172.16.30.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes }
ippool admin_pool { range-start = 172.16.30.2 range-stop = 172.16.30.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes }
Change override to no. You don't want the pool to override static IP addresses.
The above seems to be clear from the example...but the example for the raddb/users file is incomplete...here is what I tried:
testuser Service-Type == Framed-User Group == users, Pool-Name :="users_pool", Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.0, Framed-Compression = Van-Jacobson-TCP-IP
Group and Pool-Name should be on the first line. There should be attribute Service-Type = Framed-User in the reply as well.
I'm a little unlcear about the "Group" attribute above, and whether it pertains to unix groups at all, which I haven't done anything to yet. In any case, any pointers on how to make different users use different IP pools would be greatly appreciated.
Yes, Group is the attribute for unix groups. Tip: use netmask 255.255.255.255 for point to point connections. They don't need network, gateway or broadcast addresses. Ivan Kalik Kalik Informatika ISP
participants (3)
-
Jeff Crowe -
tnt＠kalik.net -
up＠3.am