Question on Virtual Servers and inner-tunnel
Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE
On 01/25/2011 11:18 PM, Brett Littrell wrote:
with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests?
No. It is set in "eap.conf"; see the "virtual_server" option under the peap and ttls stanzas. You can also override (per-request) to use a different virtual server in the outer tunnel e.g. /etc/raddb/sites-available/default: authorize { ... if (EAP-Message) { if (...some lookup...) { update control { # this directs the inner tunnel from this EAP # session to the named virtual server Virtual-Server := "somedifferentthing" } } } ... } Something that might not be obvious also - the virtual server name actually comes from the: server NAME { authorize { .. } } ..."NAME" option on the server{} block. By convention and to avoid confusion the filename in /etc/raddb/sites-{available,enabled} is the same, but it doesn't need to be (and in fact doesn't need to be in a separate file)
Brett Littrell wrote:
Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server
Yes.
yet in the comments is says it specifically handles inner tunnel requests.
So? Some families have two cars. One for each of two adults.
I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests.
It's *designed* work with inner-tunnel requests. But see the file in version 2.1.10: you can use it as a normal server for testing.
So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests?
See eap.conf. Look for "inner-tunnel" Alan DeKok.
Hi All, You guys really explained it well, appreciate it. I really wanted to know to try and get an idea of how this works and figure out the best way to set this up and clarifying that really helped. And yes I did get Gary joking and I do not mind a little eldow in the ribs joking, just as long as he does not mind pay backs in other email..HeHe:) I do appreciate Alex popping is on my behalf as well, it is nice to see someone out there helping out the new guys. Anyway, I think I have enough info to do some damage, hopefully I won't spam the list with to many more questions:) FYI: You guys are great, and I think I speak for everyone new to freeradius that we appreciate your help. PS: What is up with Garys email? or is it my threaded view? Gary's email keeps popping up as a new email and not as a threaded response? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE
Brett Littrell <Blittrell@musd.org> wrote:
PS: What is up with Garys email? or is it my threaded view? Gary's email keeps popping up as a new email and not as a threaded response?
I guess corporate policy is to use a broken email client as well as an SMTP server that adds a 'legally-holds-no-water' disclaimer. The last mail client I saw doing this was Novell Groupwise <shudder/> Incase you did not know, if you look at the headers for the other emails here, you will see a 'References' line, that is what makes threading work...it's also the tell tell sign when folk hit 'Reply' rather than 'Compose' when they want to post a *new* thread to the mailing list. Now if you fix your email client for text/plain only... :) </email-nazi> -- Alexander Clouter .sigmonster says: Serving coffee on aircraft causes turbulence.
Must have been a really old version of GW, I use GW here and it seems to thread fine but we are on the latest version. Thanks again.. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE
On Wednesday, January 26, 2011 at 8:48 AM, in message <vrv518-hm1.ln1@chipmunk.wormnet.eu>, Alexander Clouter <alex@digriz.org.uk> wrote:
Brett Littrell <Blittrell@musd.org> wrote:
PS: What is up with Garys email? or is it my threaded view? Gary's email keeps popping up as a new email and not as a threaded response?
I guess corporate policy is to use a broken email client as well as an SMTP server that adds a 'legally-holds-no-water' disclaimer. The last mail client I saw doing this was Novell Groupwise <shudder/> Incase you did not know, if you look at the headers for the other emails here, you will see a 'References' line, that is what makes threading work...it's also the tell tell sign when folk hit 'Reply' rather than 'Compose' when they want to post a *new* thread to the mailing list. Now if you fix your email client for text/plain only... :) </email-nazi> -- Alexander Clouter .sigmonster says: Serving coffee on aircraft causes turbulence. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Alexander Clouter -
Brett Littrell -
Phil Mayers