Re: Dynamic Attributes Based on NAS Type !
Stefan A. wrote:
If you read it ‚one of the ideas of having different virtual servers is separation of policies for different NASses’ you are right.
Suman was asking on how to send several NASses into the same policy.
The simplest way to do it is to set *generic* policies, and then re-write them in post-auth. For example, define a "Policy-Name" attribute in the dictionary, and set it somewhere in the "authorize" section. Then: post-auth { ... if ("%{client:nas_type}" == "foo") { // map policies for client foo } elsif ("%{client:nas_type}" == "bar") { // map policies for client bar } ... } The underlying issue is that different NAS vendors have defined different attributes for the same functionality. An even simpler solution is to just return all of the VSAs to each NAS. As was said earlier, each NAS will ignore the ones it doesn't understand, and apply the ones it does. Alan DeKok.
Last night i also dreamt of sending all VSA to NAS but i was not sure what will be the outcome so thanks for the info. I have never worked with policies but it seems to be important so i will try to learn the same. Regards Suman On Sun, Oct 9, 2011 at 2:01 PM, Alan DeKok <aland@deployingradius.com>wrote:
Stefan A. wrote:
If you read it ‚one of the ideas of having different virtual servers is separation of policies for different NASses’ you are right.
Suman was asking on how to send several NASses into the same policy.
The simplest way to do it is to set *generic* policies, and then re-write them in post-auth. For example, define a "Policy-Name" attribute in the dictionary, and set it somewhere in the "authorize" section. Then:
post-auth { ...
if ("%{client:nas_type}" == "foo") { // map policies for client foo
} elsif ("%{client:nas_type}" == "bar") { // map policies for client bar } ... }
The underlying issue is that different NAS vendors have defined different attributes for the same functionality.
An even simpler solution is to just return all of the VSAs to each NAS. As was said earlier, each NAS will ignore the ones it doesn't understand, and apply the ones it does.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan wrote:
if ("%{client:nas_type}" == "foo") { // map policies for client foo
}
What would you recommend to do, if your client is a proxy server? NAS-ID?
An even simpler solution is to just return all of the VSAs to each NAS. As was said earlier, each NAS will ignore the ones it doesn't understand, and apply the ones it does.
Nice idea, as long as a NAS vendor does not introduce another or additional way(/attribute) to do things in never NAS OS Versions. In that case you would possible get in trouble if you have both NAS OS versions in your network and feed them with mixed attributes. Starent did this in the past, where they had a bunch of QoS attributes in one Version and a single Attribute (177) to handle them all at once in never versions. Regards Stefan
participants (3)
-
Alan DeKok -
Stefan A. -
Suman Dash