solution---Re: Re: help--- IPsec VPN on radius
Hi All, Found the solution from one of the previous posts. http://lists.cistron.nl/pipermail/freeradius-users/2005-July/msg00273.html I just the did the same, added the below line in the dictionary file at /usr/local/share/freeradius/dictionary VALUE Service-Type outbound 5 Please let me know if this is correct to do. Regards, Dave. On Wed, 18 Nov 2009 16:47:05 +0530 wrote
Hi,
Found the problem, it is with the service type attribute.
I am getting this error on the freeradius
/usr/local/etc/raddb/users[24719]: Parse error (reply) for entry tatablue-vpn.vsnl.net: Unknown value outbound for attribute Service-Type
How to rectify this problem of "outbound" service type.
Regards,
Dave
On Wed, 18 Nov 2009 16:22:30 +0530 wrote
Hi,
I am trying to configure this on Free Radius;
# setup for IPSec VPDN,
ezvpn Password := "cisco"
Service-Type = outbound,
Cisco-Avpair = "ipsec:tunnel-password=cisco123",
Cisco-Avpair="ipsec:tunnel-type*esp",
Cisco-Avpair="ipsec:group-lock=1",
Cisco-Avpair="ipsec:key-exchange=ike",
Cisco-Avpair="ipsec:addr-pool=hw-pool",
test@ezvpn Password := "test123"
Cisco-Avpair="ipsec:tunnel-type*esp",
Cisco-Avpair="ipsec:group-lock=1",
Cisco-Avpair="ipsec:key-exchange=ike",
Cisco-Avpair="ipsec:addr-pool=hw-pool",
Now, When I run the freeRadius, I get this error in the log file
/usr/local/etc/raddb/users[24374]: Parse error (reply) for entry ezvpn: Unknown value outbound for attribute Service-Type
Errors reading /usr/local/etc/raddb/users
Please tell what is the correct config to get it working.
Regards,
Dave.
Yagnesh Dave wrote:
Found the solution from one of the previous posts.
http://lists.cistron.nl/pipermail/freeradius-users/2005-July/msg00273.html
I just the did the same, added the below line in the dictionary file at /usr/local/share/freeradius/dictionary
VALUE Service-Type outbound 5
Or, you could use the RFC name, and the name which is in dictionary.rfc2865: "Outbound-User" Alan DeKok.
Alan DeKok <aland@deployingradius.com> writes:
Yagnesh Dave wrote:
Found the solution from one of the previous posts.
http://lists.cistron.nl/pipermail/freeradius-users/2005-July/msg00273.html
I just the did the same, added the below line in the dictionary file at /usr/local/share/freeradius/dictionary
VALUE Service-Type outbound 5
Or, you could use the RFC name, and the name which is in dictionary.rfc2865: "Outbound-User"
BTW, I am wondering if this redefinition should have been moved to dictionary.ascend.illegal?: bjorn@canardo:/usr/local/src/git/freeradius$ grep ' Service-Type' share/dictionary.ascend VALUE Service-Type Dialout-Framed-User 5 Such duplicate definitions confuse me whenever I look at the output from radclient... Another one I've been hit by recently is this one (which seems to be very deliberate): VALUE Acct-Status-Type Alive 3 # dup VALUE Acct-Status-Type Interim-Update 3 Deliberate or not, this broke a FR 1.0 based perl module doing "if ($RAD_REQUEST{'Acct-Status-Type'} eq 'Alive') {}) {...}" Bjørn
Bjørn Mork wrote:
BTW, I am wondering if this redefinition should have been moved to dictionary.ascend.illegal?:
bjorn@canardo:/usr/local/src/git/freeradius$ grep ' Service-Type' share/dictionary.ascend VALUE Service-Type Dialout-Framed-User 5
I've moved it to dictionary.compat. That way it doesn't break existing systems, and it doesn't over-ride the RFC definitions.
Another one I've been hit by recently is this one (which seems to be very deliberate):
VALUE Acct-Status-Type Alive 3 # dup VALUE Acct-Status-Type Interim-Update 3
Deliberate or not, this broke a FR 1.0 based perl module doing "if ($RAD_REQUEST{'Acct-Status-Type'} eq 'Alive') {}) {...}"
The "Interim-Update" is the standard name. "Alive" is an old, and unofficial name. Alan DeKok.
participants (3)
-
Alan DeKok -
Bjørn Mork -
Yagnesh Dave