All, I'm moving our legacy switches over to the VMPS support in FreeRadius 2 and I'm aware there are others on the list who have done this. I'm seeing several different formats of VMPS request. The "easy" ones are from older switches e.g. cisco 1900s: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 2207055872 VMPS-Client-IP-Address = 172.28.72.65 VMPS-Port-Name = "22" VMPS-VLAN-Name = "PROD" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:01:4a:f8:93:e5 However, newer switches e.g. Cisco 3500XL are sending Reconfirm-Request packets with no MAC (but with a cookie): VMPS-Packet-Type = VMPS-Reconfirm-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13320 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "PROD" VMPS-Unknown = 0x01 VMPS-Cookie = 00:1b:78:a5:96:e0 How do I need to respond to these? It seems that if I return a Join-Response it will simply be obeyed, but I'm worried it will explode later. Do I need to return a Reconfirm-Reponse with a Deny if the requested vlan is different to the desired on, or a permit otherwise? We're also seeing from the newer switches join packets with no MAC or cookie, but an ethernet header: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13329 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/3" VMPS-VLAN-Name = "--NONE--" VMPS-Unknown = 0x00 VMPS-Ethernet-Frame = 0xffffffffffff001636e46d1b08004500015... What's the easiest way to get the MAC address out of these?
Phil Mayers wrote:
All,
I'm moving our legacy switches over to the VMPS support in FreeRadius 2 and I'm aware there are others on the list who have done this.
I'm seeing several different formats of VMPS request. The "easy" ones are from older switches e.g. cisco 1900s:
VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 2207055872 VMPS-Client-IP-Address = 172.28.72.65 VMPS-Port-Name = "22" VMPS-VLAN-Name = "PROD" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:01:4a:f8:93:e5
However, newer switches e.g. Cisco 3500XL are sending Reconfirm-Request packets with no MAC (but with a cookie):
VMPS-Packet-Type = VMPS-Reconfirm-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13320 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "PROD" VMPS-Unknown = 0x01 VMPS-Cookie = 00:1b:78:a5:96:e0
How do I need to respond to these? It seems that if I return a Join-Response it will simply be obeyed, but I'm worried it will explode
All, From what I can tell, the following is true: The actual value of reply:VMPS-Packet-Type seems to be irrelevant - VMPS replies do not contain anything to distinguish between Join and Reconfirm responses
later. Do I need to return a Reconfirm-Reponse with a Deny if the
The value of VQP-Error-Code may make a difference; the code in OpenVMPS seems to work like this: * request comes in * extract ethernet address from mac field (0xc06) other mac field (0xc08, which FreeRadius calls VMPS-Cookie) or packet header * lookup vlan for this ethernet address * if lookup.vlan not defined: fail * if lookup.vlan=='' or lookup.vlan=='--NONE--': fail * if request.vlan!='' and request.vlan!='--NONE--' and request.vlan!=lookup.vlan: fail else: ok So broadly, if there is a vlan in the request other than '' (empty string) or '--NONE--' it must match the returned vlan; else a deny (vmps mode == open) or shutdown (vmps mode == closed) error code is returned. HOWEVER - at least on Cisco 3500XL running the IOS I have, returning a permit with a different vlan than the request seems to work...
requested vlan is different to the desired on, or a permit otherwise?
We're also seeing from the newer switches join packets with no MAC or cookie, but an ethernet header:
VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13329 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/3" VMPS-VLAN-Name = "--NONE--" VMPS-Unknown = 0x00 VMPS-Ethernet-Frame = 0xffffffffffff001636e46d1b08004500015...
What's the easiest way to get the MAC address out of these?
I used this in the end: # the mac address can be in several places... if ("%{VMPS-Ethernet-Frame}" =~ /0x............(..)(..)(..)(..)(..)(..).*/) { update request { MyMac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } else { update request { MyMac = "%{%{VMPS-Cookie}:-%{VMPS-MAC}}" } }
Phil Mayers wrote:
The value of VQP-Error-Code may make a difference; the code in OpenVMPS seems to work like this:
Do you have some sample "unlang" config we can add to the server examples?
What's the easiest way to get the MAC address out of these?
I used this in the end:
# the mac address can be in several places... if ("%{VMPS-Ethernet-Frame}" =~ /0x............(..)(..)(..)(..)(..)(..).*/) { update request { MyMac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}"
Wow... I guess that works, but wow. It's been a while since I used regular expressions to parse raw packets. Also, in 2.0.1, you don't need "%{..}" for VMPS-Ethernet-Frame. You can just put the bare name before the =~ operator. Alan DeKok.
Alan DeKok wrote:
Phil Mayers wrote:
The value of VQP-Error-Code may make a difference; the code in OpenVMPS seems to work like this:
Do you have some sample "unlang" config we can add to the server examples?
We're currently using something almost identical to this (minor edits to remove site-specific vlan assignment policy with a "switch/case"): modules { $INCLUDE postgresql.conf exec logger { wait = no input_pairs = request shell_escape = yes output = none program = "/usr/bin/logger -t vmpsd -- ALLOW: %{MyMac} -> %{reply:VMPS-VLAN-Name}, switch %{VMPS-Client-IP-Address} port % {VMPS-Port-Name}" } } server { listen { ... type = vmps } vmps { # the mac address can be in several places... if ("%{VMPS-Ethernet-Frame}" =~ /0x............(..)(..)(..)(..)(..)(..).*/) { update request { MyMac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } else { update request { MyMac = "%{%{VMPS-Cookie}:-%{VMPS-MAC}}" } } # required VMPS reply attributes update reply { VMPS-Packet-Type = VMPS-Join-Response VMPS-Cookie = "%{MyMac}" } # lookup the zone in sql update reply { VMPS-VLAN-Name = "%{sql:select ... where mac='%{MyMac}'}" } # an instance of the exec module logging to a similar format # that openvmps used, for easy of operator transition :o) logger } }
What's the easiest way to get the MAC address out of these? I used this in the end:
# the mac address can be in several places... if ("%{VMPS-Ethernet-Frame}" =~ /0x............(..)(..)(..)(..)(..)(..).*/) { update request { MyMac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}"
Wow... I guess that works, but wow. It's been a while since I used regular expressions to parse raw packets.
Yeah. It's pretty disgusting :o) I originally tried: /......(......).*/ ...but of course the "octets" AVP is rendered to the hex 0xNN.. format prior to the regexp match being applied.
Also, in 2.0.1, you don't need "%{..}" for VMPS-Ethernet-Frame. You can just put the bare name before the =~ operator.
Yeah, I am waiting a change approval to update the software (sigh).
Phil Mayers wrote:
We're currently using something almost identical to this (minor edits to remove site-specific vlan assignment policy with a "switch/case"):
Nice. I've added it to raddb/sites-available/vmps, with some edits.
modules { $INCLUDE postgresql.conf exec logger { ... program = "/usr/bin/logger -t vmpsd -- ALLOW: %{MyMac} -> %{reply:VMPS-VLAN-Name}, switch %{VMPS-Client-IP-Address} port % {VMPS-Port-Name}"
Hmm... it shouldn't be too hard to add a syslog module. There's on on bugzilla, but it has issues... Alan DeKok.
participants (2)
-
Alan DeKok -
Phil Mayers