update reply: "Juniper-Primary-Dns"
Hi, Trying to implement setting custom values for DNS servers based on some condition. Following attributes are needed in radius reply: Juniper-Primary-Dns Juniper-Secondary-Dns Following snip was added to '/etc/raddb/sites-enabled/default' : ... if ( User-Name =~ /test2/i ) { if ( NAS-Port-Id =~ /147.235.4./i ) { update reply { Juniper-Primary-Dns := "109.226.x.x" Juniper-Secondary-Dns := "109.226.x.x" } } } ... When testing this, values are added to reply, this was confirmed by enabling "reply_log" in freeradius. Example: Tue Jun 16 18:54:07 2015 Packet-Type = Access-Accept Juniper-Primary-Dns = 109.226.x.x Juniper-Secondary-Dns = 109.226.x.x Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP ERX-Egress-Statistics := enable ERX-Ingress-Statistics := enable ERX-Egress-Policy-Name := "100MB" ERX-Ingress-Policy-Name := "4mb" Framed-MTU = 1512 Framed-Pool := "fast" But, this is not passed to the client, NAS still overrides this with default values. User authentication uses LDAP to store user profiles, if we add these two attributes to the user via his LDAP profile, then the change is accepted. Condition was tested on "authorize" and on "post-auth" sections, same result in both cases. Assistance would be appreciated, thanks. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]
On Jun 16, 2015, at 12:25 PM, Amir Tal <amir@ccc.co.il> wrote:
When testing this, values are added to reply, this was confirmed by enabling "reply_log" in freeradius.
You can also check the debug output, which is also useful.
But, this is not passed to the client, NAS still overrides this with default values.
Then the NAS is broken.
User authentication uses LDAP to store user profiles, if we add these two attributes to the user via his LDAP profile, then the change is accepted.
Does the NAS connect to the LDAP server? If so, that explains it. If not, then run the server in debugging mode. The attributes in the two responses will be different. Make the "unlang" rule return the same attributes as what is seen from LDAP. It will then work. Alan DeKok.
Amir Tal <amir@ccc.co.il> writes:
When testing this, values are added to reply, this was confirmed by enabling "reply_log" in freeradius. Example: Tue Jun 16 18:54:07 2015 Packet-Type = Access-Accept Juniper-Primary-Dns = 109.226.x.x Juniper-Secondary-Dns = 109.226.x.x Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP ERX-Egress-Statistics := enable ERX-Ingress-Statistics := enable ERX-Egress-Policy-Name := "100MB" ERX-Ingress-Policy-Name := "4mb" Framed-MTU = 1512 Framed-Pool := "fast"
But, this is not passed to the client, NAS still overrides this with default values.
Which NAS platform is this? Note that the ERX-* and Juniper-* VSAs don't usually mix. Assuming this is an MX, I believe you have to use Unisphere (aka ERX) VSAs for the subscriber management stuff. See http://www.juniper.net/techpubs/en_US/junos14.1/topics/reference/general/aaa... The clue is in the "The AAA Service Framework uses vendor ID 4874". The Juniper-*-Dns VSAs are defined by vendor ID 2636. I assume you are looking for Unisphere-Primary-Dns and Unisphere-Secondary-Dns in modern FR, or ERX-Primary-Dns and ERX-Secondary-Dns in the legacy FR. Bjørn
participants (3)
-
Alan DeKok -
Amir Tal -
Bjørn Mork