Hi My current network is running DSL services (PPPoE), Dial-Up services and VPN services. All NAS devices are Cisco - 7206VXR BRAS for DSL, AS5300 for Dial-Up and Cisco PIX520 for VPN (EasyVPN). Currently all those NASes uses one common FreeRadius (all data is in MySQL). The problem is that DSL user can configure their PPPoE connection as username from Dial-Up user (eg. ppp/ppp) and there will be no rate-limit on his connection (VirtualAccess interface). Silimar problem with VPNs - sometimes we have duplicated login names... Is any way to resolv this issue other than installing 3 FreeRadiuses using different MySQL databases, and different TCP/UDP ports ? I was wondering about class in MySQL database, eg. class = 0 Dialup class = 1 DSL class = 2 VPN class = ... ... And and 'class' varible into USERS and NAS tables. I'm looking for ready solution for above described problem. Robert Hass
Robert Hass <robhass@gmail.com> wrote:
The problem is that DSL user can configure their PPPoE connection as username from Dial-Up user (eg. ppp/ppp) and there will be no rate-limit on his connection (VirtualAccess interface). Silimar problem with VPNs - sometimes we have duplicated login names...
Duplicate names make it more complicated. If the names were unique. you'd just put the users into different groups.
Is any way to resolv this issue other than installing 3 FreeRadiuses using different MySQL databases, and different TCP/UDP ports ?
Configure 3 Autz-Type's. (see doc/Autz-Type). Put 3 SQL databases in there, one for each cass of users. In the "users" file, key off of the Client-IP-Address, and set Autz-Type. Alan DeKok.
Duplicate names make it more complicated. If the names were unique. you'd just put the users into different groups.
Can you give me some example ? Becouse different groups gives me only ability to set uniq parameters (like static IP address, QoS). In this case user 'ppp' doesn't have any special abilities. It's just Framed-User which can logon to Dial-Up and also DSL (PPPoE)...
using different MySQL databases, and different TCP/UDP ports ?
Configure 3 Autz-Type's. (see doc/Autz-Type). Put 3 SQL databases in there, one for each cass of users. In the "users" file, key off of the Client-IP-Address, and set Autz-Type.
Thanks, I will check this out. Robert
"Robert Hass" <robhass@gmail.com> wrote:
Can you give me some example ? Becouse different groups gives me only ability to set uniq parameters (like static IP address, QoS). In this case user 'ppp' doesn't have any special abilities. It's just Framed-User which can logon to Dial-Up and also DSL (PPPoE)...
I have no idea what you mean by that. You're seem to be referring to some special local configuration that you haven't described. ALan DeKok.
Hello i am trying to put my freeradius server to work as follows i need a group of user let say group A i need they can connect 1 hour daily and 25 hours mounthly with a session-timeout of 30 minutes second group of user let say group B with 50 hours mounthly and no daily limit and another group without any limits I know probably this is realy easy to do but i am trying to understand how freeradius works i will like to know if any one knows a realy good handbook of freeradius Thank in advance
I don't know how those equipments are configured, but can you configure them to send some special attribute to radius? If your DSL device sends something like "Connect-Info == DSL", so you can put Connect-Info == DSL to the users in DSL group in radgroupcheck table. Have I made myself clear? The idea is making radius to check if the user that is in group dsl (or dial-up, or vpn) has the attribute relative to his group. Best regards, Leandro. Robert Hass escreveu:
Hi
My current network is running DSL services (PPPoE), Dial-Up services and VPN services. All NAS devices are Cisco - 7206VXR BRAS for DSL, AS5300 for Dial-Up and Cisco PIX520 for VPN (EasyVPN). Currently all those NASes uses one common FreeRadius (all data is in MySQL).
The problem is that DSL user can configure their PPPoE connection as username from Dial-Up user (eg. ppp/ppp) and there will be no rate-limit on his connection (VirtualAccess interface). Silimar problem with VPNs - sometimes we have duplicated login names...
Is any way to resolv this issue other than installing 3 FreeRadiuses using different MySQL databases, and different TCP/UDP ports ?
I was wondering about class in MySQL database, eg.
class = 0 Dialup class = 1 DSL class = 2 VPN class = ... ...
And and 'class' varible into USERS and NAS tables. I'm looking for ready solution for above described problem.
Robert Hass - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay
participants (4)
-
Alan DeKok -
Grupo de atención a usuarios -
Leandro Pereira de Lima e Silva - ViaLink -
Robert Hass