Different Authentication for several devices (several Nas-Ip-Address)

nicolaskarp＠free.fr

23 Jul 2007 23 Jul '07

5:13 a.m.

Hello, Thank you for your help but I don't understand how you can make it. Here my configuration that I try: #Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 } # Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 } preproxy { files overwrite_nasip dev_equipment } Here what I want : 1. If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi 2. the proxy forwards the access-request to the radius server 3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi Thank you for your assistance Nicolas.

Show replies by date

nicolaskarp＠free.fr

23 Jul 23 Jul

10:53 a.m.

New subject: Different Authentication for several devices (several Nas-Ip-Address)

Re-Hello ;-) I search how i can do this but i don't find... I want to do this : If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Dev" else If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Prod" else Do nothing. fi fi I don't know how check the NAS-IP-ADDRESS attribute and rewrite an other attribute (Calling-Station-ID).. Thank you for your help !! NicolaS. Selon nicolaskarp@free.fr:

...

Hello,

Thank you for your help but I don't understand how you can make it.

Here my configuration that I try:

#Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 }

# Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 }

preproxy { files overwrite_nasip dev_equipment }

Here what I want :

1.

If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

2. the proxy forwards the access-request to the radius server

3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi

Thank you for your assistance

Nicolas.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Alan DeKok

11:08 a.m.

New subject: Different Authentication for several devices (several Nas-Ip-Address)

nicolaskarp@free.fr wrote:

...

I want to do this :

If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Dev" else If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Prod" else Do nothing. fi fi

I don't know how check the NAS-IP-ADDRESS attribute and rewrite an other attribute (Calling-Station-ID)..

In what will become 2.0, it's pretty much that easy. Check out the CVS head. Alan DeKok.

tnt＠kalik.co.yu

11:10 a.m.

New subject: Different Authentication for several devices (severalNas-Ip-Address)

OK. If you devices put their IP addresses in Called-Station-Id field there is no need to do rewrites. You can use regexp operators to controll access as Called-Station-Id attribute is a string. NAS1 NAS-IP-Address == proxyIP, Called-Station-Id =~ "^192.168.48." Dev group(s) in reply NAS2 NAS-IP-Address == proxyIP, Called-Station-Id =~ "^192.168.49." Prod group(s) in reply Ivan Kalik Kalik Informatika ISP You can leave this out proxy IP check if all traffic comes over the proxy. You might need to escape periods in regexp. Dana 23/7/2007, "nicolaskarp@free.fr" <nicolaskarp@free.fr> piše:

...

Re-Hello ;-)

I search how i can do this but i don't find...

I want to do this :

If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Dev" else If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Prod" else Do nothing. fi fi

I don't know how check the NAS-IP-ADDRESS attribute and rewrite an other attribute (Calling-Station-ID)..

Thank you for your help !!

NicolaS.

Selon nicolaskarp@free.fr:

...
Hello,

Thank you for your help but I don't understand how you can make it.

Here my configuration that I try:

#Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 }

# Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 }

preproxy { files overwrite_nasip dev_equipment }

Here what I want :

1.

If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

2. the proxy forwards the access-request to the radius server

3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi

Thank you for your assistance

Nicolas.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

nicolaskarp＠free.fr

11:30 a.m.

New subject: Different Authentication for several devices (severalNas-Ip-Address)

Called-Station-Id isn't equal to Nas-Ip-Address, it equal to the PC where I initiate telnet Connection. It's not equal to my Nas-Ip :( So, i would change the called-station-id to Nas-Ip-Adress and Nas-Ip-Address to proxy address. Any idea ? Selon tnt@kalik.co.yu:

...

OK. If you devices put their IP addresses in Called-Station-Id field there is no need to do rewrites. You can use regexp operators to controll access as Called-Station-Id attribute is a string.

NAS1 NAS-IP-Address == proxyIP, Called-Station-Id =~ "^192.168.48." Dev group(s) in reply

NAS2 NAS-IP-Address == proxyIP, Called-Station-Id =~ "^192.168.49." Prod group(s) in reply

Ivan Kalik Kalik Informatika ISP

You can leave this out proxy IP check if all traffic comes over the proxy. You might need to escape periods in regexp.

Dana 23/7/2007, "nicolaskarp@free.fr" <nicolaskarp@free.fr> pi¹e:

...
Re-Hello ;-)

I search how i can do this but i don't find...

I want to do this :

If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Dev" else If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Prod" else Do nothing. fi fi

I don't know how check the NAS-IP-ADDRESS attribute and rewrite an other attribute (Calling-Station-ID)..

Thank you for your help !!

NicolaS.

Selon nicolaskarp@free.fr:

...
Hello,

Thank you for your help but I don't understand how you can make it.

Here my configuration that I try:

#Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 }

# Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 }

preproxy { files overwrite_nasip dev_equipment }

Here what I want :

1.

If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

2. the proxy forwards the access-request to the radius server

3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi

Thank you for your assistance

Nicolas.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hugh Messenger

12:28 p.m.

New subject: Different Authentication for several devices(severalNas-Ip-Address)

nicolaskarp@free.fr said

...

If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

You might try: DEFAULT NAS-IP-Address =~ "^192\.168\.48\." Calling-Station-Id := Dev Fall-Through = 1 DEFAULT NAS-IP-Address =~ "^192\.168\.48\." Calling-Station-Id := Prod Fall-Through = 1 DEFAULT NAS-IP-Address !~ "^(192\.168\.48\.|192\.168\.49\.)" Calling-Station-Id := Any Fall-Through = 1 -- hugh

nicolas

3:45 p.m.

New subject: Different Authentication for several devices(severalNas-Ip-Address)

In the USERS file or Pre_Proxy_Users file ? Thanks ! Nicolas. Hugh Messenger wrote:

...

nicolaskarp@free.fr said

...
If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

You might try:

DEFAULT NAS-IP-Address =~ "^192\.168\.48\." Calling-Station-Id := Dev Fall-Through = 1

DEFAULT NAS-IP-Address =~ "^192\.168\.48\." Calling-Station-Id := Prod Fall-Through = 1

DEFAULT NAS-IP-Address !~ "^(192\.168\.48\.|192\.168\.49\.)" Calling-Station-Id := Any Fall-Through = 1

-- hugh

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hugh Messenger

4:04 p.m.

New subject: Different Authentication forseveral devices(severalNas-Ip-Address)

Nicolas said:

...

In the USERS file or Pre_Proxy_Users file ?

I believe that would be the preproxy_users. BTW, I made a typo, that second DEFAULT should be for .49, not .48.

...

Thanks !

Nicolas.

-- hugh

tnt＠kalik.co.yu

4:46 p.m.

New subject: Different Authentication forseveral devices(severalNas-Ip-Address)

Just a couple of small corrections: Calling-Station-Id := "Dev" not Calling-Station-Id := Dev (those are strings); same for other entries. You might be able to remove that last entry - you are not going to test for "Any" in huntgroups anyway? As I understood you only want to restrict access to Dev and Prod server groups. The name of the file is in radiusd.conf, where you uncomment "files". Ivan Kalik Kalik Informatika ISP Dana 23/7/2007, "nicolas" <nicolaskarp@free.fr> piše:

...

In the USERS file or Pre_Proxy_Users file ?

Thanks !

Nicolas.

Hugh Messenger wrote:

...
nicolaskarp@free.fr said

...
If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

You might try:

DEFAULT NAS-IP-Address =~ "^192\.168\.48\." Calling-Station-Id := Dev Fall-Through = 1

DEFAULT NAS-IP-Address =~ "^192\.168\.48\." Calling-Station-Id := Prod Fall-Through = 1

DEFAULT NAS-IP-Address !~ "^(192\.168\.48\.|192\.168\.49\.)" Calling-Station-Id := Any Fall-Through = 1

-- hugh

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

nicolaskarp＠free.fr

11:31 a.m.

New subject: Different Authentication for several devices (severalNas-Ip-Address)

Moreover, i use a proxy because in the huntgroup file, i can't use a CIDR network just a Host IP. Selon tnt@kalik.co.yu:

...

OK. If you devices put their IP addresses in Called-Station-Id field there is no need to do rewrites. You can use regexp operators to controll access as Called-Station-Id attribute is a string.

NAS1 NAS-IP-Address == proxyIP, Called-Station-Id =~ "^192.168.48." Dev group(s) in reply

NAS2 NAS-IP-Address == proxyIP, Called-Station-Id =~ "^192.168.49." Prod group(s) in reply

Ivan Kalik Kalik Informatika ISP

You can leave this out proxy IP check if all traffic comes over the proxy. You might need to escape periods in regexp.

Dana 23/7/2007, "nicolaskarp@free.fr" <nicolaskarp@free.fr> pi¹e:

...
Re-Hello ;-)

I search how i can do this but i don't find...

I want to do this :

If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Dev" else If NAS-IP-Address == 192.168.48.0/24 --> Rewrite Calling-station-id to "Prod" else Do nothing. fi fi

I don't know how check the NAS-IP-ADDRESS attribute and rewrite an other attribute (Calling-Station-ID)..

Thank you for your help !!

NicolaS.

Selon nicolaskarp@free.fr:

...
Hello,

Thank you for your help but I don't understand how you can make it.

Here my configuration that I try:

#Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 }

# Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 }

preproxy { files overwrite_nasip dev_equipment }

Here what I want :

1.

If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi

2. the proxy forwards the access-request to the radius server

3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi

Thank you for your assistance

Nicolas.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6925

Age (days ago)

6925

Last active (days ago)

List overview

Download

9 comments

5 participants

participants (5)

Alan DeKok
Hugh Messenger
nicolas
nicolaskarp＠free.fr
tnt＠kalik.co.yu