Different DHCP Pools based on User
Hi, is there some possibility to configure the following scenario: We have multiple Users, say Alice and Bob and Charles (and many more). All of them authenticate via a FreeRadius Server and need an IP via DHCP, but Alice needs IPs from 10.1.0.0/24, Bob from 1xx.xxx.28.0/24 and Charles from 192.168.10.0/24. I couldn't find an example of this or remotely similar scenarios. Thanks in advantage! Paul
Framed-Pool in radreply On Fri, Jun 15, 2018 at 1:03 PM, Paul via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Hi,
is there some possibility to configure the following scenario:
We have multiple Users, say Alice and Bob and Charles (and many more).
All of them authenticate via a FreeRadius Server and need an IP via DHCP,
but Alice needs IPs from 10.1.0.0/24, Bob from 1xx.xxx.28.0/24 and Charles from 192.168.10.0/24.
I couldn't find an example of this or remotely similar scenarios.
Thanks in advantage!
Paul - List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
-- Carl Peterson *PORT NETWORKS* 401 E Pratt St, Ste 2553 Baltimore, MD 21202 (410) 637-3707
Hi, thanks for your reply. I think Framed-Pool is not a solution for my problem. I might need to explain the problem a little bit more. All Users are authenticated via Radius by an Access-Point (without own DHCP Server) and need IPs from different Pools. I would like to realize this via FreeRadius DHCP. So the FreeRadius Authentication-Server remembers the User with associated MAC and if the user requests a IP from the FreeRadius DHCP it would assign the user one from the specified pool Best Regards Paul On 15.06.2018 19:15, Carl Peterson wrote:
Framed-Pool in radreply
On Fri, Jun 15, 2018 at 1:03 PM, Paul via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Hi,
is there some possibility to configure the following scenario:
We have multiple Users, say Alice and Bob and Charles (and many more).
All of them authenticate via a FreeRadius Server and need an IP via DHCP,
but Alice needs IPs from 10.1.0.0/24, Bob from 1xx.xxx.28.0/24 and Charles from 192.168.10.0/24.
I couldn't find an example of this or remotely similar scenarios.
Thanks in advantage!
Paul - List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
On Jun 16, 2018, at 6:34 AM, Paul via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
All Users are authenticated via Radius by an Access-Point (without own DHCP Server) and need IPs from different Pools.
I would like to realize this via FreeRadius DHCP.
That's possible.
So the FreeRadius Authentication-Server remembers the User with associated MAC and if the user requests a IP from the FreeRadius DHCP it would assign the user one from the specified pool
When you say "FreeRADIUS remembers the user with associated MAC", what that means is "write the username and MAC to a database". Then, when FreeRADIUS receives a DHCP request with that MAC, it can use that to look up the user. And then apply the pool information. Which database do you want to use? FreeRADIUS doesn't have an in-memory database, so you will need to use something like SQL or Redis. Alan DeKok.
Hi, thanks for your answer! I'm using MySQL for my current setup (pretty much standard setup with standard schema) My problem is: * How to save the MAC <-> User Associations in the Database? * How to configure DHCP to use this Association? Thanks! Paul On 16.06.2018 13:51, Alan DeKok wrote:
On Jun 16, 2018, at 6:34 AM, Paul via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
All Users are authenticated via Radius by an Access-Point (without own DHCP Server) and need IPs from different Pools.
I would like to realize this via FreeRadius DHCP.
That's possible.
So the FreeRadius Authentication-Server remembers the User with associated MAC and if the user requests a IP from the FreeRadius DHCP it would assign the user one from the specified pool
When you say "FreeRADIUS remembers the user with associated MAC", what that means is "write the username and MAC to a database".
Then, when FreeRADIUS receives a DHCP request with that MAC, it can use that to look up the user. And then apply the pool information.
Which database do you want to use? FreeRADIUS doesn't have an in-memory database, so you will need to use something like SQL or Redis.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 16, 2018, at 9:27 AM, Paul via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
thanks for your answer! I'm using MySQL for my current setup (pretty much standard setup with standard schema)
My problem is: * How to save the MAC <-> User Associations in the Database?
Since this is non-standard, you will have to create this association yourself. Create a new table in SQL. Have 2 columns: MAC and User-Name. Make in index on User-Name. Then in the post-auth section, add something like: update reply { Tmp-String-0 := "%{sql:REPLACE INTO table (username, mac) VALUES (%{User-Name}, %{Calling-Station-Id})}" } You'll need to use the real table name instead of "table".
* How to configure DHCP to use this Association?
In the DHCP configuration, SELECT the User-Name from the MAC address: dhcp DHCP-Discover { ... update request { User-Name := "%{sql:SELECT username FROM table WHERE mac = '%{DHCP-Client-Hardware-Address}'}" } ... } And then the User-Name *should* show up. As with anything, you will need to test this. Ensure that the MAC *is* in the Calling-Station-Id. Make sure it's the same format as DHCP-Client-Hardware-Address. The details need finishing, but the above configuration should get you over the most complex portion. Alan DeKok.
Good evening, in a wifi setup we almost had the same requirements (the networks to choose from where a bit different, but that's beside the point). What I did was to save an ip-pool name with the user attribute in the radcheck table (https://wiki.freeradius.org/guide/SQL-HOWTO-for-freeradius-3.x-on-Debian-Ubu...). So now it looks more or less like this (at least the view creating it): +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ | 1 | fredf | Cleartext-Password | wilma | := | | 2 | fredf | Pool-Name | vpn | := | Then the pool name gets logged to radpostauth (you have to alter the query to do so). The dhcp module then queries radpostauth for the last successful authentication from the given mac address and now has the pool-name to work with in the dhcp-ippool module. Best regards Thore P.S: You might have to sanitize the mac address depending on the vendor of the wifi hardware. On Sat, Jun 16, 2018 at 03:27:00PM +0200, Paul via Freeradius-Users wrote:
Hi,
thanks for your answer! I'm using MySQL for my current setup (pretty much standard setup with standard schema)
My problem is: * How to save the MAC <-> User Associations in the Database? * How to configure DHCP to use this Association?
Thanks!
Paul
On 16.06.2018 13:51, Alan DeKok wrote:
On Jun 16, 2018, at 6:34 AM, Paul via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
All Users are authenticated via Radius by an Access-Point (without own DHCP Server) and need IPs from different Pools.
I would like to realize this via FreeRadius DHCP.
That's possible.
So the FreeRadius Authentication-Server remembers the User with associated MAC and if the user requests a IP from the FreeRadius DHCP it would assign the user one from the specified pool
When you say "FreeRADIUS remembers the user with associated MAC", what that means is "write the username and MAC to a database".
Then, when FreeRADIUS receives a DHCP request with that MAC, it can use that to look up the user. And then apply the pool information.
Which database do you want to use? FreeRADIUS doesn't have an in-memory database, so you will need to use something like SQL or Redis.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 16, 2018, at 10:18 AM, Thore Krüss <thore@scimeda.de> wrote:
in a wifi setup we almost had the same requirements (the networks to choose from where a bit different, but that's beside the point).
What I did was to save an ip-pool name with the user attribute in the radcheck table (https://wiki.freeradius.org/guide/SQL-HOWTO-for-freeradius-3.x-on-Debian-Ubu...). ... Then the pool name gets logged to radpostauth (you have to alter the query to do so). The dhcp module then queries radpostauth for the last successful authentication from the given mac address and now has the pool-name to work with in the dhcp-ippool module.
That's a lot simpler. I'll see if that can get written up in the docs as a suggestion. Alan DeKok.
participants (4)
-
Alan DeKok -
Carl Peterson -
Paul -
Thore Krüss