Monitor current NAS list with dynamic clients
Hi I'm using FR with Dynamic Clients from SQL. Is it possible to know the current cache of NASes known to radius at a certain time? I'm having problems when I move NAS from one IP to another, I had a lifetime of 86400 but even if I move it after one week the new address is still not recognized, and radius packets ignored. thanks -- Lorenzo Milesi - lorenzo.milesi@yetopen.it YetOpen S.r.l. - http://www.yetopen.it/
Restart freeradius after updating nas table on database. Clayton A. Alves <http://claytonaalves.github.com> *claytonaalves* +55 66 9233-3406 2014-04-15 6:27 GMT-04:00 Lorenzo Milesi <maxxer@ufficyo.com>:
Hi I'm using FR with Dynamic Clients from SQL. Is it possible to know the current cache of NASes known to radius at a certain time? I'm having problems when I move NAS from one IP to another, I had a lifetime of 86400 but even if I move it after one week the new address is still not recognized, and radius packets ignored.
thanks -- Lorenzo Milesi - lorenzo.milesi@yetopen.it
YetOpen S.r.l. - http://www.yetopen.it/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Lorenzo Milesi wrote:
I'm using FR with Dynamic Clients from SQL.
Are you sure? See raddb/sites-available/dynamic-clients for how to read clients dynamically from SQL. If you're not using that, you don't have dynamic clients. You're probably just using "read_clients = yes" from SQL. That is very different. It reads those clients at startup, and then never again.
I'm having problems when I move NAS from one IP to another,
NASes shouldn't move IPs very often. RADIUS depends on NASes having static IP addresses. Alan DeKok.
Are you sure?
See raddb/sites-available/dynamic-clients for how to read clients dynamically from SQL. If you're not using that, you don't have dynamic clients.
This is the content of my dnyamic-clients file in sites-enabled (as taken from [1]) : # client dymamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 86400 } server dynamic_client_server { authorize { if("%{raw:Called-Station-Id}"){ if ("%{sql: select count(*) from nas where community='%{raw:Called-Station-Id}'}" == 1) { update control { FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" FreeRADIUS-Client-Require-MA = no FreeRADIUS-Client-Secret = "%{sql: select nas.secret from nas where nas.community='%{raw:Called-Station-Id}'}" FreeRADIUS-Client-Shortname = "%{sql: select shortname from nas where community='%{raw:Called-Station-Id}'}" FreeRADIUS-Client-NAS-Type = "other" } ok } } } }
NASes shouldn't move IPs very often. RADIUS depends on NASes having static IP addresses.
I know, that's why I mostly use VPN for NASes on dynamic connections. But in certain cases I do testing with my office IP address, then after some days I deploy the same NAS to customer's connection and I get failed logins. Restarting radius fixes the login, but this means dynamic clients configuration is not working... thanks for the help [1] http://sourceforge.net/apps/trac/hotcakes/wiki/YfiTechDynamicClients -- Lorenzo Milesi - lorenzo.milesi@yetopen.it YetOpen S.r.l. - http://www.yetopen.it/
Lorenzo Milesi wrote:
This is the content of my dnyamic-clients file in sites-enabled (as taken from [1]) :
Well... many third-party web sites are horrifically wrong. The server DOES come with extensive documentation on how to configure dynamic clients.
I know, that's why I mostly use VPN for NASes on dynamic connections. But in certain cases I do testing with my office IP address, then after some days I deploy the same NAS to customer's connection and I get failed logins. Restarting radius fixes the login, but this means dynamic clients configuration is not working...
See the FAQ for "it doesn't work. And be sure that you *don't* have static clients defined. And look at the debug output. Nothing else will tell you what's going on. The alternative is to randomly make changes to the configuration... and then to never pay attention to what the server is doing. That's a good way to waste a lot of time. Alan DeKok.
You're probably just using "read_clients = yes" from SQL. That is very different. It reads those clients at startup, and then never again.
This is probably where my fault is. I've enabled dynamic clients, but ALSO read_clients = yes! I'll disable that and check out how it ends. Thanks again! -- Lorenzo Milesi - lorenzo.milesi@yetopen.it YetOpen S.r.l. - http://www.yetopen.it/
You can have both. We do.
But I suppose that NASes read on startup are not read dynamically. Isn't it? -- Lorenzo Milesi - lorenzo.milesi@yetopen.it YetOpen S.r.l. - http://www.yetopen.it/
Correct. If an entry for a NAS client already exists (ie was read at server startup) then the dynamic client mechanism isn't called (only unknown clients trigger the dynamic path) alan
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Alan DeKok -
Clayton Alves -
Lorenzo Milesi