Access Accept vs Tunneled reply
I am trying to work out where I would be putting attributes for Access Accept. I am sending the following in a reply: (822) [ttls] Got tunneled reply code 2 WiMAX-Classifer-Direction = Bi-Directional WiMAX-Classifer-Priority = 1 WiMAX-ClassifierID = 1 WiMAX-Downlink-QOS-Id = 1 WiMAX-Uplink-QOS-Id = 1 WiMAX-Transport-Type = Ethernet WiMAX-Direction = Bi-Directional WiMAX-Packet-Data-Flow-Id = 1 WiMAX-QoS-Id = 1 WiMAX-Schedule-Type = Best-Effort WiMAX-Maximum-Sustained-Traffic-Rate = 31457289 WiMAX-VLAN-ID = 192 R3-IF-Name = "vpws" PDFID = 1 MS-CHAP2-Success = 0xc0533d31434143314146453345463545453936444336303741423437383932303738433539 443531373533 MS-MPPE-Recv-Key = 0x7d918cc693141550f2c5b39922ad18da MS-MPPE-Send-Key = 0xe3fb5674a52feb22dee4a8c636909169 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed However, the NAS vendor states that the reply attributes should be sent during this portion of the radius handshake: Sending Access-Accept of id 72 to 172.16.4.2 port 1812 MS-MPPE-Recv-Key = 0x8616d5a2fbb28b308b5ddf419333f8a2a07b79bfbdd679b4161262be7480eb54 MS-MPPE-Send-Key = 0x7f856a84bf226204dc2c4c3f5a25c9d808cb584c1b927dafb1a09ab7a360cfc8 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{sm=1}D8F69CCE1EF580B70933A526924A2D0C" Currently I have the attributes listed as a group reply. How do I send the attributes needed during the access accept packet? David
These values are unique per user. Is there an elegant way to copy this to the post-auth section? David -----Original Message----- From: Alan Buxey [mailto:A.L.M.Buxey@lboro.ac.uk] Sent: Friday, March 11, 2011 8:36 AM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: Access Accept vs Tunneled reply Hi,
I am trying to work out where I would be putting attributes for Access Accept.
add them at the post-auth stage...or add them in the inner-tunnel and copy inner-tunnel to the reply.. thats 2 standard ways alan
David Peterson <davidp@wirelessconnections.net> wrote:
These values are unique per user. Is there an elegant way to copy this to the post-auth section?
The following might help? http://lists.freeradius.org/mailman/htdig/freeradius-users/2011-January/msg0... Cheers -- Alexander Clouter .sigmonster says: What garlic is to food, insanity is to art.
I am wondering if it's a misconfiguration of a group reply. I have those attributes listed as a group-reply. Would putting the attributes in the normal vs the group reply put them in a different portion of the response? David -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.org [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of Alexander Clouter Sent: Friday, March 11, 2011 10:28 AM To: freeradius-users@lists.freeradius.org Subject: Re: Access Accept vs Tunneled reply David Peterson <davidp@wirelessconnections.net> wrote:
These values are unique per user. Is there an elegant way to copy this to the post-auth section?
The following might help? http://lists.freeradius.org/mailman/htdig/freeradius-users/2011-January/msg0 0353.html Cheers -- Alexander Clouter .sigmonster says: What garlic is to food, insanity is to art. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Please correct my assumption if I am off.... I have been working on getting reply attributes sent out to define VLAN's etc on a WiMax NAS. I see the following in radiusd -X: (3495) [ttls] Got tunneled reply code 2 WiMAX-VLAN-ID := 192 WiMAX-Classifer-Direction = Bi-Directional WiMAX-Classifer-Priority = 1 WiMAX-ClassifierID = 1 WiMAX-Downlink-QOS-Id = 1 WiMAX-Uplink-QOS-Id = 1 WiMAX-Transport-Type = Ethernet WiMAX-Direction = Bi-Directional WiMAX-Packet-Data-Flow-Id = 1 WiMAX-QoS-Id = 1 WiMAX-Schedule-Type = Best-Effort WiMAX-Maximum-Sustained-Traffic-Rate = 31457289 WiMAX-R3-IF-Name = "vpws" WiMAX-PDFID = 1 MS-CHAP2-Success = 0x1f533d38324436443835383335433145344237364441413938463137364443453038334643 374646363245 MS-MPPE-Recv-Key = 0xaaa52b27b269158aa25a2c3c36612ec4 MS-MPPE-Send-Key = 0xfd2e2270200bf84a3c9e34afe8eed5c1 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (3495) [ttls] Got tunneled Access-Accept Which would suggest that I am sending those TLV's in a radius packet. However, I ran Wireshark and do not see these TLV's in any radius packet. What would stop freeradius from creating these TLV's in the packet. I am thinking my dictionary.wimax additions are to blame or perhaps I need to use different operators. Any thoughts would be greatly appreciated. David -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.org [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of David Peterson Sent: Friday, March 11, 2011 11:55 AM To: 'FreeRadius users mailing list' Subject: RE: Access Accept vs Tunneled reply I am wondering if it's a misconfiguration of a group reply. I have those attributes listed as a group-reply. Would putting the attributes in the normal vs the group reply put them in a different portion of the response? David -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.or freeradius-users-bounces+g [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of Alexander Clouter Sent: Friday, March 11, 2011 10:28 AM To: freeradius-users@lists.freeradius.org Subject: Re: Access Accept vs Tunneled reply David Peterson <davidp@wirelessconnections.net> wrote:
These values are unique per user. Is there an elegant way to copy this to the post-auth section?
The following might help? http://lists.freeradius.org/mailman/htdig/freeradius-users/2011-January/msg0 0353.html Cheers -- Alexander Clouter .sigmonster says: What garlic is to food, insanity is to art. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
David Peterson wrote:
Please correct my assumption if I am off.... I have been working on getting reply attributes sent out to define VLAN's etc on a WiMax NAS. I see the following in radiusd -X:
(3495) [ttls] Got tunneled reply code 2
These are the attributes *inside* of the tunnel. Did you set "use_tunneled_reply = yes" ? Alan DeKok.
I have set: use_tunneled_reply = no copy_request_to_tunnel = no Set for both TTLS and PEAP sections. Should I be setting those to yes? David -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.org [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: Friday, March 11, 2011 1:41 PM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: Access Accept vs Tunneled reply David Peterson wrote:
Please correct my assumption if I am off.... I have been working on getting reply attributes sent out to define VLAN's etc on a WiMax NAS. I see the following in radiusd -X:
(3495) [ttls] Got tunneled reply code 2
These are the attributes *inside* of the tunnel. Did you set "use_tunneled_reply = yes" ? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Perhaps I have broken my install. I see that I have in my radiusd.conf file the following: $INCLUDE ${confdir}/modules/ # Extensible Authentication Protocol # # For all EAP related authentications. # Now in another file, because it is very large. # $INCLUDE eap.conf However, under /raddb/ I have eap.conf and under modules I have a file called eap. Both look to be identical or nearly so. Should I be getting rid of my eap.conf file? David -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.org [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of David Peterson Sent: Friday, March 11, 2011 1:47 PM To: FreeRadius users mailing list Subject: RE: Access Accept vs Tunneled reply I have set: use_tunneled_reply = no copy_request_to_tunnel = no Set for both TTLS and PEAP sections. Should I be setting those to yes? David -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.or freeradius-users-bounces+g [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: Friday, March 11, 2011 1:41 PM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: Access Accept vs Tunneled reply David Peterson wrote:
Please correct my assumption if I am off.... I have been working on getting reply attributes sent out to define VLAN's etc on a WiMax NAS. I see the following in radiusd -X:
(3495) [ttls] Got tunneled reply code 2
These are the attributes *inside* of the tunnel. Did you set "use_tunneled_reply = yes" ? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
David Peterson wrote:
Perhaps I have broken my install. I see that I have in my radiusd.conf file the following: ... However, under /raddb/ I have eap.conf and under modules I have a file called eap. Both look to be identical or nearly so.
Should I be getting rid of my eap.conf file?
Yes. You installed the git "master" branch on top of a pre-existing installation of 2.1.x. Alan DeKok.
Hello. I am using freeradius2 on my CentOS5. It's working great. But now I have one problem. I need to use wireless and pppoe together in my network. Users must login both in wireless and pppoe. wireless using MAC format 00-00-00-00-00 and pppoe 00:00:00:00:00 How can i indicate calling-station-id for one user for both, wireless and pppoe? I tried both format together like this: user1 Calling-Station-Id == 00-00-00-00-00 user1 Calling-Station-Id == 00:00:00:00:00 but no success. I am using mikrotik and ubiquity products as NAS and ubiquity as clients. Please help me. Sorry for my poor English. Looking up "00-00-00-00"... Please wait...
ziko wrote:
Hello. I am using freeradius2 on my CentOS5. It's working great. But now I have one problem. I need to use wireless and pppoe together in my network. Users must login both in wireless and pppoe. wireless using MAC format 00-00-00-00-00 and pppoe 00:00:00:00:00 How can i indicate calling-station-id for one user for both, wireless and pppoe?
In 2.1.11 (released real soon now), see raddb/policy.conf, rewrite.called_station_id. Alan DeKok.
You need to check the Calling-Station-Id format sent by the NAS. Start radius in debug more and send a auth request, the debug will show whether your NAS sends Calling-Station-Id or not . If it sends the Calling-Station-Id you can clearly see the format of the same. Best Regads Suman Dash On Sun, Mar 13, 2011 at 5:07 PM, ziko <emobuxuti@yahoo.com> wrote:
Hello. I am using freeradius2 on my CentOS5. It's working great. But now I have one problem. I need to use wireless and pppoe together in my network. Users must login both in wireless and pppoe. wireless using MAC format 00-00-00-00-00 and pppoe 00:00:00:00:00 How can i indicate calling-station-id for one user for both, wireless and pppoe?
I tried both format together like this:
user1 Calling-Station-Id == 00-00-00-00-00 user1 Calling-Station-Id == 00:00:00:00:00
but no success.
I am using mikrotik and ubiquity products as NAS and ubiquity as clients.
Please help me.
Sorry for my poor English. *Looking up "00-00-00-00"*... Please wait...
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sun, Mar 13, 2011 at 04:37:06AM -0700, ziko wrote:
I tried both format together like this: user1 Calling-Station-Id == 00-00-00-00-00 user1 Calling-Station-Id == 00:00:00:00:00 but no success.
You could do a rewrite: if (Calling-Station-Id =~ /^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i) { update request { Calling-Station-Id = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } }
thank you guys. I will try. Thank you! ________________________________ From: Brian Candler <B.Candler@pobox.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Mon, March 14, 2011 11:42:09 AM Subject: Re: Calling-Station-Id problem On Sun, Mar 13, 2011 at 04:37:06AM -0700, ziko wrote:
I tried both format together like this: user1 Calling-Station-Id == 00-00-00-00-00 user1 Calling-Station-Id == 00:00:00:00:00 but no success.
You could do a rewrite: if (Calling-Station-Id =~ /^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i) { update request { Calling-Station-Id = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
David Peterson <davidp@wirelessconnections.net> wrote:
I am wondering if it's a misconfiguration of a group reply. I have those attributes listed as a group-reply. Would putting the attributes in the normal vs the group reply put them in a different portion of the response?
As you have the User-Name/whatever-wimax utilises now movable from the inner-layer to the outer you can just do you policy on the outer layer instead. Do authentication on the inner-tunnel, whilst authorisation keep to the outer layer... Cheers -- Alexander Clouter .sigmonster says: Stay the curse.
Progress at last guys! Thanks for all the help! Now seeing this both outside the tunnel as well as in the pcap. Now to make my attribute conform with the NAS. (175) ++[wimax] returns updated Sending Access-Accept of id 103 to 172.16.4.2 port 1812 WiMAX-VLAN-ID = 192 WiMAX-Classifer-Direction = Bi-Directional WiMAX-Classifer-Priority = 1 WiMAX-ClassifierID = 1 WiMAX-Downlink-QOS-Id = 1 WiMAX-Uplink-QOS-Id = 1 WiMAX-Transport-Type = Ethernet WiMAX-Direction = Bi-Directional WiMAX-Packet-Data-Flow-Id = 1 WiMAX-QoS-Id = 1 WiMAX-Schedule-Type = Best-Effort WiMAX-Maximum-Sustained-Traffic-Rate = 31457289 WiMAX-R3-IF-Name = "vpws" WiMAX-PDFID = 1 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{sm=1}3FF9EF10336DD9EF3892DC1ED1EF2696" WiMAX-IP-Technology = CMIP4 WiMAX-FA-RK-Key = 0x8287ac45d467483a74dadc2337a59574b7e49e0f WiMAX-MSK = 0x WiMAX-MSK = 0x3d0788c7f457fdbb4b69dffbfba26496064025dce735232348d8d76397faf1e2644b33e0cf 27ffe7a0953a0a8180fd58b8286b3d3caaf2f215f88b054b11171b WiMAX-FA-RK-SPI = 1832484922 (175) Finished request. -----Original Message----- From: freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradius.org [mailto:freeradius-users-bounces+david.peterson=acc-corp.net@lists.freeradiu s.org] On Behalf Of Alexander Clouter Sent: Friday, March 11, 2011 1:34 PM To: freeradius-users@lists.freeradius.org Subject: Re: Access Accept vs Tunneled reply David Peterson <davidp@wirelessconnections.net> wrote:
I am wondering if it's a misconfiguration of a group reply. I have those attributes listed as a group-reply. Would putting the attributes in the normal vs the group reply put them in a different portion of the response?
As you have the User-Name/whatever-wimax utilises now movable from the inner-layer to the outer you can just do you policy on the outer layer instead. Do authentication on the inner-tunnel, whilst authorisation keep to the outer layer... Cheers -- Alexander Clouter .sigmonster says: Stay the curse. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (8)
-
Alan Buxey -
Alan DeKok -
Alexander Clouter -
Brian Candler -
David Peterson -
Phil Mayers -
Suman Dash -
ziko