Hello Everyone, Further to my post late last year I'm hoping to get more help on my issue which still remains un-resolved. Is there a wild card I can use all the time with one NAS that will match on any domain while NAS2 needs to have a specific user? Let me first present the flow just in case I don't explain myself correctly: 1PPPOE User -> 2Telco LAC -> 3Telco Radius -> 4Our Radius -> 5Telco Radius -> 6Telco LAC -> 7Our LNS -> 8Our Radius 1. User initiates a PPPOE request 2. Telco LAC sees the request and forwards it to their Radius server 3. Telco Radius server proxies the request to our Radius expecting us to respond with Tunnel information to aid their LAC establish a L2TP tunnel to our LNS 4. Our radius sends the Tunnel information back to Telco Radius 5. Telco radius forwards the Tunnel information to the Telco LAC 6. Telco LAC uses that tunnel info to initiate an L2TP tunnel to our LNS 7. After the tunnel is established our LNS then forwards the PPPOE request to our Radius server for authenticating the user and get the IP information The flow above seems to be doing a double level authentication which gives me issues. The reason I have issues is because the same reply I'm sending to the Telco's LAC/Radius I'm now sending to my LNS thus creating a loop (Tunnel parameters that should not go to my LNS at all) Can anyone think of a way to remedy this? My solution might be to only respond with the Tunnel info to the Telco's LAC/Radius while I respond with the IP info to the PPPOE request from my LNS only. Any help is appreciated. (I'm currently using groups to achieve this but it does not work yet) Thank you Adrian -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, November 02, 2007 8:45 AM To: FreeRadius users mailing list Subject: Re: NAS-Group? - different replies to different NASes? Adrian wrote:

Since both requests are addressed to domain.com how can I selectively allow only certain responses to NAS A and others to NAS B?

Match on the Client-IP-Address, or on the NAS-IP-Address attribute. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hello Ivan, The Telco wants me to send those parameters to them. I have no choice in that. I'm confused because with every other Telco the setup was straight forward, I setup a tunnel/vpnd-group+virtual template from our LNS to the Telco's LAC and the requests for the user authentication comes from their LAC through my LNS all the time. With this Telco, I see the same request twice. Once from their Radius and then from my LNS. The problem is distinguishing between them and answering differently. Maybe I don't even have to do that, is just that I'm not sure how to do it otherwise. For now I'll do some reading on "unlang" as per Alan's request and see how that goes. Thanks Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, February 22, 2008 6:32 AM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes?

4. Our radius sends the Tunnel information back to Telco Radius

Why? It will be the same every time for every user. Configure tunnel parametars on the (virtual) interface. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hello Ivan, Can you point me in the right direction with doing separate requests based on the NAS-IP-Address Attribute? Do I do this in the radius.conf file or in the mysql DB somehow under the groups? Currently I use the nas list from the flat file and the DB for everything else including groups. Thanks Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, February 22, 2008 10:22 AM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes? NAS-IP-Address should be different in LAC and LNS requests. And unlang works in version 2.0 not 1.1.x (later post). Ivan Kalik Kalik Informatika ISP Dana 22/2/2008, "Adrian" <adrian@dsl4u.ca> piše:

Hello Ivan,

The Telco wants me to send those parameters to them. I have no choice in that. I'm confused because with every other Telco the setup was straight forward, I setup a tunnel/vpnd-group+virtual template from our LNS to the Telco's LAC and the requests for the user authentication comes from their LAC through my LNS all the time. With this Telco, I see the same request twice. Once from their Radius and then from my LNS. The problem is distinguishing between them and answering differently.

Maybe I don't even have to do that, is just that I'm not sure how to do it otherwise.

For now I'll do some reading on "unlang" as per Alan's request and see how that goes.

Thanks Adrian

-----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, February 22, 2008 6:32 AM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes?

...

4. Our radius sends the Tunnel information back to Telco Radius

Why? It will be the same every time for every user. Configure tunnel parametars on the (virtual) interface.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I'm not sure we use the users file (I have the radius.conf pointed to sql.conf). This is what I thought might have to happen but I'm not sure if it makes sense. Create 2 Groups in radgroupreply like this: Telco_LAC_Group - with all the tunnel attributes LNS_Group - which all the users would be assigned to and whatever attributes they need to share. In "radgroupcheck" enter a NAS-IP-Address check for the Telco_LAC_Group that matches on the LAC's IPs. In "usergroup" assign the user to the LNS_Group Everything else remains the same as before (radreply and radcheck with the specific user info) Does that make sense? Any other way to group attributes for specific NASes? Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Sunday, February 24, 2008 3:57 PM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes? You would normally use a DEFAULT entry in users file. In 2.0 you can use unlang and do it in sql. Ivan Kalik Kalik Informatika ISP Dana 24/2/2008, "Adrian" <adrian@dsl4u.ca> piše:

Hello Ivan,

Can you point me in the right direction with doing separate requests based on the NAS-IP-Address Attribute? Do I do this in the radius.conf file or in the mysql DB somehow under the groups?

Currently I use the nas list from the flat file and the DB for everything else including groups.

Thanks Adrian

-----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, February 22, 2008 10:22 AM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes?

NAS-IP-Address should be different in LAC and LNS requests. And unlang works in version 2.0 not 1.1.x (later post).

Ivan Kalik Kalik Informatika ISP

Dana 22/2/2008, "Adrian" <adrian@dsl4u.ca> piše:

...

Hello Ivan,

The Telco wants me to send those parameters to them. I have no choice in that. I'm confused because with every other Telco the setup was straight forward, I setup a tunnel/vpnd-group+virtual template from our LNS to the Telco's LAC and the requests for the user authentication comes from their LAC through my LNS all the time. With this Telco, I see the same request twice. Once from their Radius and then from my LNS. The problem is distinguishing between them and answering differently.

Maybe I don't even have to do that, is just that I'm not sure how to do it otherwise.

For now I'll do some reading on "unlang" as per Alan's request and see how that goes.

Thanks Adrian

-----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, February 22, 2008 6:32 AM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes?

...

4. Our radius sends the Tunnel information back to Telco Radius

Why? It will be the same every time for every user. Configure tunnel parametars on the (virtual) interface.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hello Alan, Ivan I think I might have another issue, as per the documentation the first item to be checked is the radcheck table for any attributes. Since my user exists in there I don't think the request will fall through to the radgroupcheck table anymore. The issue becomes more complicated since I want to send the LAC a different response, on the same user, than my LNS. What if I add another column in the radcheck table that is called "NAS-Group" for example. Then modify the sql.conf (I suspect a SQL statement in there) to do a check against that new field for allowing authentications? Also, if at the same time I add a new column in Radcheckgroup (or maybe in the nas table) that has the same field name as the "NAS-Group" above and in there I assign each LNS/LAC a NAS-Group Identifier? Will that even be remotely possible? Remember, my original problem is that I need to send the Telco's Proxy Radius (based on an individual user) a specific set of attributes that will be passed on to their LAC. Once on their LAC that same request will filter through to my LNS and I do not wish to send my LNS the same specific attributes but the rather standard IP/Netmask/Framed-Route attributes. PS. Thank you all for putting up with my questions. Thanks Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, February 26, 2008 3:57 AM To: FreeRadius users mailing list Subject: Re: NAS-Group? - different replies to different NASes? Adrian wrote:

Create 2 Groups in radgroupreply like this: Telco_LAC_Group - with all the tunnel attributes LNS_Group - which all the users would be assigned to and whatever attributes they need to share.

In "radgroupcheck" enter a NAS-IP-Address check for the Telco_LAC_Group that matches on the LAC's IPs. In "usergroup" assign the user to the LNS_Group Everything else remains the same as before (radreply and radcheck with the specific user info)

Does that make sense?

It should work.

Any other way to group attributes for specific NASes?

Many. But without knowing details of your needs and configurations, it's a little hard to make suggestions. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hello Ivan, All I'm hearing is that I need to go to version 2.0. Maybe that is the next step for me :) I will definitely consider that as it seems to be the only "simpler" option. As for answering your question: ++++++++++++++++++++++++++++++++++++ Q: What? Tunnel attributes are going to be different for each user? Can you explain in more detail how is that suposed to work. A: I have a set of "master" tunnel attributes that I always have to send to this Telco. i.e. Service-type, Tunnel-Type, Tunnel-Preference, Tunnel-password, Tunnel-Server-Endpoint..etc The way this Telco obtains these attributes is by sending the Username/Password combination my way. (i.e. I need to authenticate userxyz@telco.com). Once I see that user come through from their boxes (3 Static IPs) I have to send back to them the tunnel attributes above. Once the tunnel attributes were sent, they establish an L2TP tunnel to my LNS and my LNS now asks my Radius server again to authenticate the user. So I see the same userxyz@telco.com requesting to be authenticated. Since I currently cannot distinguish between NASes I am sending the same Tunnel Attributes to my LNS which causes my LNS to try to initiate a tunnel back to itself (because the Tunnel-Server-Endpoint attribute is the actual LNS). ++++++++++++++++++++++++++++++++++++++ My hope was to create a grouped response (with the tunnel attributes) to the Telco's NAS IPs and create a different group response for my LNS IPs which will exclude the Tunnel information and just include the basic Framed-IP-Address. Framed-Route Attributes. Since the common factor here is the Username/Password combination I have a hard time assigning the same username/password to multiple groups unless I distinguish between the NAS Groups first (ie Telco's NAS versus my NAS). Based on the RLM_SQL documentation the first table the authentication hits is the radcheck table, then radreply and then the usergroup table. If there are any changes to be made, I think it first has to be done in these tables somewhere. That's my dilemma, Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, February 26, 2008 9:22 AM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes?

I think I might have another issue, as per the documentation the first item to be checked is the radcheck table for any attributes. Since my user exists in there I don't think the request will fall through to the radgroupcheck table anymore.

It will. In 2.x groups are handled properly in sql and you can separate groups on bases of NAS-IP-Address.

The issue becomes more complicated since I want to send the LAC a different response, on the same user, than my LNS.

So configure the replies in radgroupreply.

What if I add another column in the radcheck table that is called "NAS-Group" for example. Then modify the sql.conf (I suspect a SQL statement in there) to do a check against that new field for allowing authentications? Also, if at the same time I add a new column in Radcheckgroup (or maybe in the nas table) that has the same field name as the "NAS-Group" above and in there I assign each LNS/LAC a NAS-Group Identifier?

Will that even be remotely possible?

Not like that. Since NAS-Group is not in the request how are you going to check it? You can check (a single) NAS-IP-Address that way. But there is no dire need to do that since you can check it as an attribute. If there are multiple addresses you will need to use regexp or huntgroups.

Remember, my original problem is that I need to send the Telco's Proxy Radius (based on an individual user) a specific set of attributes that will be passed on to their LAC.

What? Tunnel attributes are going to be different for each user? Can you explain in more detail how is that suposed to work. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Ivan Kalik wrote:

...

A: I have a set of "master" tunnel attributes that I always have to send to this Telco. i.e. Service-type, Tunnel-Type, Tunnel-Preference, Tunnel-password, Tunnel-Server-Endpoint..etc The way this Telco obtains these attributes is by sending the Username/Password combination my way. (i.e. I need to authenticate userxyz@telco.com). Once I see that user come through from their boxes (3 Static IPs) I have to send back to them the tunnel attributes above. Once the tunnel attributes were sent, they establish an L2TP tunnel to my LNS and my LNS now asks my Radius server again to authenticate the user. So I see the same userxyz@telco.com requesting to be authenticated. Since I currently cannot distinguish between NASes I am sending the same Tunnel Attributes to my LNS which causes my LNS to try to initiate a tunnel back to itself (because the Tunnel-Server-Endpoint attribute is the actual LNS). ++++++++++++++++++++++++++++++++++++++

This is very strange.

No, that's a pretty standard setup for resold ADSL, certainly in the UK and I think other countries as well.

That information should be on telco radius server, not yours. It should not have to proxy requests to you. They ought to know the tunnel endpoint - *they* gave you the IP to set on your router when they leased you the line.

From the sound of it, it's not a leased line or similar; as I say, resold ADSL generally works this way.

Hello Ivan, I haven't had much luck with setting this up. We use a mysql DB and in the sql.conf file I don't use the DEFAULT Profile section nor do we use the users file. I've spoken with a few friends and they were able to get this working but in a flat-file environment (I.e using the users file and using the DEFAULT you've mentioned below) Is there a way to get this working with SQL without hacking the SLQ statements? I was thinking of modifying the authorization query in sql.conf (authorize_group_check_query) to utilize a Huntgroup-Name Attribute in the radgroupcheck table. Not sure if this will even work. Here is the original query: authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName,${groupcheck_table}.Att ribute,${g roupcheck_table}.Value,${groupcheck_table}.op FROM ${groupcheck_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQ L-User-Name}' AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName ORDER BY ${groupcheck_table}.id" Here is the proposed changed query: authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName,${groupcheck_table}.Att ribute,${g roupcheck_table}.Value,${groupcheck_table}.op FROM ${groupcheck_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQ L-User-Name}' AND ${usergroup_table}.NASGroup = ${groupcheck_table}.NASGroup ORDER BY ${groupcheck_table}.id" For the above to work I would have to introduce a new column in the usergroup table called NASGroup and also in the radcheckgroup table. This sounds like a lot of work and maybe unnecessary. I'm pretty sure this works with huntgroups and flat files...how can I make it work with SQL? Will my answer be turning up "Default Profile" under the sql.conf file of the radius server? Best regards, Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Adrian Sent: Tuesday, February 26, 2008 5:09 PM To: 'FreeRadius users mailing list' Subject: RE: NAS-Group? - different replies to different NASes? Thanks Ivan, I will give that a try. Thanks for all your help. Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Tuesday, February 26, 2008 2:37 PM To: FreeRadius users mailing list Subject: RE: NAS-Group? - different replies to different NASes?

A: I have a set of "master" tunnel attributes that I always have to send to this Telco. i.e. Service-type, Tunnel-Type, Tunnel-Preference, Tunnel-password, Tunnel-Server-Endpoint..etc The way this Telco obtains these attributes is by sending the Username/Password combination my way. (i.e. I need to authenticate userxyz@telco.com). Once I see that user come through from their boxes (3 Static IPs) I have to send back to them the tunnel attributes above. Once the tunnel attributes were sent, they establish an L2TP tunnel to my LNS

and

my LNS now asks my Radius server again to authenticate the user. So I see the same userxyz@telco.com requesting to be authenticated. Since I currently cannot distinguish between NASes I am sending the same Tunnel Attributes to my LNS which causes my LNS to try to initiate a tunnel back to itself (because the Tunnel-Server-Endpoint attribute is the actual LNS). ++++++++++++++++++++++++++++++++++++++

This is very strange. That information should be on telco radius server, not yours. It should not have to proxy requests to you. They ought to know the tunnel endpoint - *they* gave you the IP to set on your router when they leased you the line. Simplest thing to do is to create a huntgroup caled LAC and place those static IPs there. Then put something like this i your users file: DEFAULT Huntgroup-Name == "LAC", Auth-Type := Accept Reply-Message = "You are one strange telco", and list other reply attributes that you need to send them. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Adrian wrote:

Can I use a combination or the users file and the SQL at the same time?

Yes. The default configuration makes it clear that you can use *many* different modules at the same time.

I'm thinking of enabling the users file and enter all the DEFAULT entries in there but still keep the users in SQL and have authentication fall-trhough the users file to the SQL file.

Will this work?

Yes. Alan DeKok.

In "radgroupcheck" enter a NAS-IP-Address check for the Telco_LAC_Group that matches on the LAC's IPs.

That might be a problem. You need a single match. If you can make a regexp that matches all the IPs you will be fine. But all need to match a single statement. Ivan Kalik Kalik Informatika ISP

Hello Alan, I'll do some reading as per your suggestions. Does it matter what version of FreeRadius I use? I currently have 1.17 installed using mysql. Adrian -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, February 22, 2008 8:36 AM To: FreeRadius users mailing list Subject: Re: NAS-Group? - different replies to different NASes? Adrian wrote:

Is there a wild card I can use all the time with one NAS that will match on any domain while NAS2 needs to have a specific user?

Just configure a regular expression... See "man unlang". Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html