Virtual server by client data
Hi, Is there any way to use virtual servs depending on client VLAN ? I mean : If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2 BR,
On Wed, Aug 29, 2012 at 3:22 PM, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
Hi,
Is there any way to use virtual servs depending on client VLAN ? I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2
Depends. One of the following should be applicable (1) If the NAS is different (i.e. each VLAN has its own NAS), you can take a look at raddb/sites-available/dynamic-clients. Basically it can choose a virtual server based on Packet-Src-IP-Address attribute (i.e. the NAS IP as seen by FR) (2) If the request is plain PAP/MSCHAP, you should be able to tell the default virtual server to proxy it to another virtual server using unlang and Proxy-To-Realm (3) use the same virtual server, but do selective processing (with unlang) based on some attributes that the NAS sends. e.g. if an attribute has value A, call module sql1, while if the value is B, call module sql2. -- Fajar
Hi, Thanks for reply.
Depends.
One of the following should be applicable (1) If the NAS is different (i.e. each VLAN has its own NAS), you can take a look at raddb/sites-available/dynamic-clients. Basically it can choose a virtual server based on Packet-Src-IP-Address attribute (i.e. the NAS IP as seen by FR)
Same NAS for all VLAN
(2) If the request is plain PAP/MSCHAP, you should be able to tell the default virtual server to proxy it to another virtual server using unlang and Proxy-To-Realm It is. (EAP/TTLS with PAP) I can't see what you mean here. (3) use the same virtual server, but do selective processing (with unlang) based on some attributes that the NAS sends. e.g. if an attribute has value A, call module sql1, while if the value is B, call module sql2. This is a way but i'd like to use 2 differents config (config should change in futur for each vlan)
On Wed, Aug 29, 2012 at 3:46 PM, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
(2) If the request is plain PAP/MSCHAP, you should be able to tell the default virtual server to proxy it to another virtual server using unlang and Proxy-To-Realm
It is. (EAP/TTLS with PAP) I can't see what you mean here.
proxy.conf says # If you specify a virtual_server here, then requests # will be proxied internally to that virtual server. # These requests CANNOT be proxied again, however. I'm not sure if EAP/TTLS's use of inner-tunnel qualifies as "proxied again". I assume it is. I might be wrong though, in which case you can try if ( check_whatever_attribute_your_NAS_sends_that_contains_client_VLAN ) { update control { Proxy-To-Realm := "realm_of_the_virtual_server" } }
(3) use the same virtual server, but do selective processing (with unlang) based on some attributes that the NAS sends. e.g. if an attribute has value A, call module sql1, while if the value is B, call module sql2.
This is a way but i'd like to use 2 differents config (config should change in futur for each vlan)
IMHO this is the best method, which should be sufficient for most needs. -- Fajar
Le 29/08/2012 10:36, Fajar A. Nugraha a écrit :
(3) use the same virtual server, but do selective processing (with unlang) based on some attributes that the NAS sends. e.g. if an attribute has value A, call module sql1, while if the value is B, call module sql2. Actually i'm not sure that all NAS send Calling-Station-Id with the same format. I mean when configuring VLANs on NAS, sometiles you can set a name to the vlan.
VLAN 1 = tagada VLAN 2 = tougoudou And depending on NAS, Calling-Station-Id should be 00-11-22-33-44-55:1 or 00-11-22-33-44-55:tagada
BILLOT wrote:
Is there any way to use virtual servs depending on client VLAN ?
RADIUS is IP based, not VLAN based. Packets don't arrive on different VLANs. They arrive on different IPs.
I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2
The server will have a different IP on each VLAN. You can configure different virtual servers per "listen" section. See raddb/sites-available/README Alan DeKok.
Le 29/08/2012 10:58, Alan DeKok a écrit :
BILLOT wrote:
Is there any way to use virtual servs depending on client VLAN ? RADIUS is IP based, not VLAN based. Packets don't arrive on different VLANs. They arrive on different IPs. Thanks. I can also use different ports, i only need NAS that can be configured with several Radius servers.
I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2 The server will have a different IP on each VLAN. You can configure different virtual servers per "listen" section. See raddb/sites-available/README
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 29 Aug 2012, at 09:22, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
Hi,
Is there any way to use virtual servs depending on client VLAN ? I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2
Yes, bind the virtual servers to IP interfaces on those VLANs using a listen section. -Arran
On Wed, Aug 29, 2012 at 3:22 PM, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
Hi,
Is there any way to use virtual servs depending on client VLAN ? I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2
Just to clarify: by "client" here do you mean "NAS", or "end user device" (e.g. laptop)? -- Fajar
Le 29/08/2012 11:16, Fajar A. Nugraha a écrit :
On Wed, Aug 29, 2012 at 3:22 PM, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
Hi,
Is there any way to use virtual servs depending on client VLAN ? I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2 Just to clarify: by "client" here do you mean "NAS", or "end user device" (e.g. laptop)?
End user device. NAS is on one particular VLAN, directly connected to radius, clients are behind it on other vlans. So the ip is the same for all vlans. But i need different configs for each client vlans.
On 29 Aug 2012, at 10:58, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
Le 29/08/2012 11:16, Fajar A. Nugraha a écrit :
On Wed, Aug 29, 2012 at 3:22 PM, BILLOT <emmanuel.billot@ac-orleans-tours.fr> wrote:
Hi,
Is there any way to use virtual servs depending on client VLAN ? I mean :
If packet arrive with VLAN1 then use virtual server 1 If packet arrive with VLAN2 then use virtual server 2 Just to clarify: by "client" here do you mean "NAS", or "end user device" (e.g. laptop)?
End user device. NAS is on one particular VLAN, directly connected to radius, clients are behind it on other vlans. So the ip is the same for all vlans. But i need different configs for each client vlans.
Then you need to bind realms to the virtual servers there are examples in proxy.conf, and use normal proxying logic to forward to them. -Arran
Le 29/08/2012 11:58, BILLOT a écrit :
Le 29/08/2012 11:16, Fajar A. Nugraha a écrit : Here is an extract of data sent to radius
NAS-IP-Address = 172.21.175.129 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-52:WIFI-ELEVES" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" Called-Station-Id = "2C-B0-5D-A4-52-52:WIFI-TEST" could be Called-Station-Id = "2C-B0-5D-A4-52-52:WIFI-PROD" and in each case i need a different config (complete) so a different server (virtual server, i have only one radius)
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
BILLOT -
Fajar A. Nugraha