We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either. Is there a way radiusd can log the UDP port on which a packet entered a virtual server? I think this might be our only way of distinguishing these clients. Thanks, Jonathan
Yes and you could run many virtual servers listening on different ports. alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
On 23/06/14 14:30, Jonathan Gazeley wrote:
We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either.
Is there a way radiusd can log the UDP port on which a packet entered a virtual server? I think this might be our only way of distinguishing these clients.
Packet-Src-Port I think.
On 23-06-14 15:30, Jonathan Gazeley wrote:
We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either.
Is there a way radiusd can log the UDP port on which a packet entered a virtual server?
Yes, the attribute control:Packet-Src-Port
I think this might be our only way of distinguishing these clients.
Keep in mind the source port isn't guaranteed to be stable. -- Herwin Weststrate
On 23 Jun 2014, at 14:42, Herwin Weststrate <herwin@quarantainenet.nl> wrote:
On 23-06-14 15:30, Jonathan Gazeley wrote:
We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either.
Is there a way radiusd can log the UDP port on which a packet entered a virtual server?
Yes, the attribute control:Packet-Src-Port
control:Packet-Src-Port? Fairly sure that won't work... unless some magic has gone into the server which I don't know about. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 23 Jun 2014, at 14:30, Jonathan Gazeley <jonathan.gazeley@bristol.ac.uk> wrote:
We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either.
Is there a way radiusd can log the UDP port on which a packet entered a virtual server? I think this might be our only way of distinguishing these clients.
%{Packet-Src-Port} at least in v3.0.x YMMV with v2.0.x. You'd be better of putting in a feature request for NAS-Identifier if your vendor doesn't support it already. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (5)
-
Alan Buxey -
Arran Cudbard-Bell -
Herwin Weststrate -
Jonathan Gazeley -
Phil Mayers