Ascend-Data-Filter with srcip from ippool
Hello, I'm trying to use Ascend-data-filters together with IP-pool DEFAULT Pool-Name := test_pool Fall-Through = Yes DEFAULT User-Name := "test_...", Cleartext-Password := test Service-Type = Framed-User, Framed-Protocol = PPP, Session-Timeout = 65000, Idle-Timeout = 3600, Ascend-Maximum-Time = 64000, Ascend-Idle-Limit = 3600, Ascend-Data-Filter := "ip in forward srcip %{Framed-IP-Address}/32 dstip 1.1.1.2/32" The pool is working well, but the filter doesn't: Login OK: [test_001/test] (from client bb-10k port 808583209) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: 172.16.1.7/808583209 rlm_ippool: Found a stale entry for ip/port: 172.16.100.135/808583209 rlm_ippool: num: 0 rlm_ippool: Searching for an entry for nas/port: 172.16.1.7/808583209 rlm_ippool: Allocating ip to nas/port: 172.16.1.7/808583209 rlm_ippool: num: 1 rlm_ippool: Allocated ip 172.16.103.107 to client on nas 172.16.1.7,port 808583209 modcall[post-auth]: module "test_pool" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 195 to 172.16.1.7 port 21646 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 65000 Idle-Timeout = 3600 Ascend-Maximum-Time = 64000 Ascend-Idle-Limit = 3600 Ascend-Data-Filter := "ip in forward dstip 1.1.1.2/32 0" Framed-IP-Address = 172.16.103.107 Framed-IP-Netmask = 255.255.255.0 Looks like IP is taken from pool after users-file got processed. I wouldn't know how to change that order or where to add the filter then. Pls let me know whether this should work in some way and how to configure it then? Kind Regards, Andreas
Andreas Kalb (akalb) wrote:
I'm trying to use Ascend-data-filters together with IP-pool ... DEFAULT User-Name := "test_...", Cleartext-Password := test ... Ascend-Data-Filter := "ip in forward srcip %{Framed-IP-Address}/32 dstip 1.1.1.2/32"
The pool is working well, but the filter doesn't:
Because there's no Framed-IP-Address attribute in the request. Use %{reply:Framed-IP-Address}. For version 1.x, this is documented in doc/variables.txt.
Login OK: [test_001/test] (from client bb-10k port 808583209) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 ... rlm_ippool: Allocated ip 172.16.103.107 to client on nas 172.16.1.7,port 808583209
Which runs after the "files" module. So the "files" module doesn't have access to the IP address.
Looks like IP is taken from pool after users-file got processed. I wouldn't know how to change that order or where to add the filter then.
Read the documentation and see the examples. The modules are processed in the order that they are listed in radiusd.conf.
Pls let me know whether this should work in some way and how to configure it then?
It's pretty easy to do in 2.0. See "man unlang". I suggest you upgrade. What you want to do will be a LOT easier in 2.0. Alan DeKok.
Hello Alan, pls see my response inline "akalb>". Thx for your quick feedback. Kind Regards, Andreas -----Original Message----- From: freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Montag, 31. März 2008 16:29 To: FreeRadius users mailing list Subject: Re: Ascend-Data-Filter with srcip from ippool Andreas Kalb (akalb) wrote:
I'm trying to use Ascend-data-filters together with IP-pool ... DEFAULT User-Name := "test_...", Cleartext-Password := test ... Ascend-Data-Filter := "ip in forward srcip %{Framed-IP-Address}/32 dstip 1.1.1.2/32"
The pool is working well, but the filter doesn't:
Because there's no Framed-IP-Address attribute in the request. Use %{reply:Framed-IP-Address}. For version 1.x, this is documented in doc/variables.txt. akalb> Had a try with: akalb> akalb> Ascend-Data-Filter := "ip in forward srcip %{reply:Framed-IP-Address}/32 dstip 1.1.1.2/32" akalb> akalb> also, no difference. I expect because of order of modules you mentioned later.
Login OK: [test_001/test] (from client bb-10k port 808583209) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 ... rlm_ippool: Allocated ip 172.16.103.107 to client on nas 172.16.1.7,port 808583209
Which runs after the "files" module. So the "files" module doesn't have access to the IP address. akalb> Not sure how to see/change this: # Livingston-style 'users' file files { ... ippool test_pool { ... files files ...
Looks like IP is taken from pool after users-file got processed. I wouldn't know how to change that order or where to add the filter then.
Read the documentation and see the examples. The modules are processed in the order that they are listed in radiusd.conf. akalb> I tried to look it up, but was unable so far, sorry. I need to mention that I'm new to FreeRadius at all, sorry.
Pls let me know whether this should work in some way and how to configure it then?
It's pretty easy to do in 2.0. See "man unlang". I suggest you upgrade. What you want to do will be a LOT easier in 2.0. akalb> I'll do right away. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello, sorry for my ignorance, I'm still a novice on FreeRadius :-( After installing 2.0.3 I'm even facing more trouble (most likely because parts of radiusd.conf are split now and I'm unsure how to get the ippool called). Where was the related functionality moved to? Kind Regards, Andreas -----Original Message----- From: freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Montag, 31. März 2008 16:29 To: FreeRadius users mailing list Subject: Re: Ascend-Data-Filter with srcip from ippool Andreas Kalb (akalb) wrote:
I'm trying to use Ascend-data-filters together with IP-pool ... DEFAULT User-Name := "test_...", Cleartext-Password := test ... Ascend-Data-Filter := "ip in forward srcip %{Framed-IP-Address}/32 dstip 1.1.1.2/32"
The pool is working well, but the filter doesn't:
Because there's no Framed-IP-Address attribute in the request. Use %{reply:Framed-IP-Address}. For version 1.x, this is documented in doc/variables.txt.
Login OK: [test_001/test] (from client bb-10k port 808583209) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 ... rlm_ippool: Allocated ip 172.16.103.107 to client on nas 172.16.1.7,port 808583209
Which runs after the "files" module. So the "files" module doesn't have access to the IP address.
Looks like IP is taken from pool after users-file got processed. I wouldn't know how to change that order or where to add the filter then.
Read the documentation and see the examples. The modules are processed in the order that they are listed in radiusd.conf.
Pls let me know whether this should work in some way and how to configure it then?
It's pretty easy to do in 2.0. See "man unlang". I suggest you upgrade. What you want to do will be a LOT easier in 2.0. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Andreas Kalb (akalb) wrote:
Hello,
sorry for my ignorance, I'm still a novice on FreeRadius :-( After installing 2.0.3 I'm even facing more trouble (most likely because parts of radiusd.conf are split now and I'm unsure how to get the ippool called).
Where was the related functionality moved to?
raddb/sites-available/default Alan DeKok.
Hello, I'm unfortunately still not getting it to work anymore after upgrade to 2.0.3. I added the following to sites-available/default at top of document: server bb-10k { client 172.16.1.6 { ... ... accounting { detail unix radutmp test_pool } ... post-auth { test_pool } ... ippool test_pool { range-start = 172.16.100.1 range-stop = 172.16.103.254 ... and then get: /usr/local/etc/raddb/sites-enabled/default[70]: Failed to find module "test_pool". /usr/local/etc/raddb/sites-enabled/default[66]: Errors parsing accounting section. So now I wonder how to specify the ippool section there. Kind Regards, Andreas -----Original Message----- From: freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Montag, 31. März 2008 19:59 To: FreeRadius users mailing list Subject: Re: Ascend-Data-Filter with srcip from ippool Andreas Kalb (akalb) wrote:
Hello,
sorry for my ignorance, I'm still a novice on FreeRadius :-( After installing 2.0.3 I'm even facing more trouble (most likely because parts of radiusd.conf are split now and I'm unsure how to get the ippool called).
Where was the related functionality moved to?
raddb/sites-available/default Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Andreas Kalb (akalb) wrote:
I'm unfortunately still not getting it to work anymore after upgrade to 2.0.3.
I added the following to sites-available/default at top of document:
server bb-10k {
I'm not sure why. As the documentation suggests, starting with the default configuration is the best idea.
accounting { ... post-auth {
And no "authorize" or "authenticate" section.
ippool test_pool { range-start = 172.16.100.1
Module configurations belong in the "modules" section of radiusd.conf. They do NOT go in a server section.
and then get: /usr/local/etc/raddb/sites-enabled/default[70]: Failed to find module "test_pool". /usr/local/etc/raddb/sites-enabled/default[66]: Errors parsing accounting section.
So now I wonder how to specify the ippool section there.
You don't. Again, start with the default configuration. Add ONE module: test_pool. Configure it, and get it to assign IP addresses. Then, once that works, configure the ascend filter attributes AFTER the "test_pool" module has been run in the "post-auth" section. Alan DeKok.
Hello Alan, I started from that by adding my own ippool to radiusd.conf after main_pool (line 1800, ippool test_pool {...). I understood from your reply, that I need to call it from sites-available/default and added "test_pool" right after main_pool in sites-available/default (in sections accounting and post-auth, as specified in radiusd.conf), but when starting the deamon I got: /usr/local/etc/raddb/radiusd.conf[1800]: Invalid version in module 'rlm_ippool' /usr/local/etc/raddb/sites-enabled/default[308]: Failed to find module "test_pool". /usr/local/etc/raddb/sites-enabled/default[285]: Errors parsing accounting section. That mades me think I need to move the pool there either, sorry. Kind Regards, Andreas -----Original Message----- From: freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Dienstag, 1. April 2008 07:46 To: FreeRadius users mailing list Subject: Re: Ascend-Data-Filter with srcip from ippool Andreas Kalb (akalb) wrote:
I'm unfortunately still not getting it to work anymore after upgrade to 2.0.3.
I added the following to sites-available/default at top of document:
server bb-10k {
I'm not sure why. As the documentation suggests, starting with the default configuration is the best idea.
accounting { ... post-auth {
And no "authorize" or "authenticate" section.
ippool test_pool { range-start = 172.16.100.1
Module configurations belong in the "modules" section of radiusd.conf. They do NOT go in a server section.
and then get: /usr/local/etc/raddb/sites-enabled/default[70]: Failed to find module "test_pool". /usr/local/etc/raddb/sites-enabled/default[66]: Errors parsing accounting section.
So now I wonder how to specify the ippool section there.
You don't. Again, start with the default configuration. Add ONE module: test_pool. Configure it, and get it to assign IP addresses. Then, once that works, configure the ascend filter attributes AFTER the "test_pool" module has been run in the "post-auth" section. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Andreas Kalb (akalb) wrote: ... but
when starting the deamon I got:
/usr/local/etc/raddb/radiusd.conf[1800]: Invalid version in module 'rlm_ippool'
You have installed multiple versions of the server. Delete the modules installed by the older versions.
That mades me think I need to move the pool there either, sorry.
No. The default examples are correct. Alan DeKok.
Hello again, based on the last experience having different servers existing, I build the system from scratch and stood as closely as possible to defaults. All is working well concerning the ip-pool. It was the duplicated server, Alan pointed out. Now I'm back to my original problem, where I wanted to use an Ascend-filter with entries matching IP-address from pool. I still don't know, how to change order of modules to make the IP-address known to the files-module and appreciated your uidance again. Kind Regards, Andreas users: DEFAULT User-Name := "test_...", Pool-Name := test_pool, Cleartext-Password := cisco Service-Type == Framed-User, Framed-Protocol = PPP, Session-Timeout = 65000, Idle-Timeout = 3600, Ascend-Maximum-Time = 64000, Ascend-Idle-Limit = 3600, Ascend-Data-Filter := "ip in forward srcip %{reply:Framed-IP-Address}/32 dstip 1.1.1.2/32" debugs: ... ++[unix] returns notfound users: Matched entry DEFAULT at line 125 expand: ip in forward srcip %{reply:Framed-IP-Address}/32 dstip 1.1.1.2/32 -> ip in forward srcip /32 dstip 1.1.1.2/32 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "cisco" rlm_pap: Using clear text password "cisco" rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [test_001/cisco] (from client bb-10k port 808583209) +- entering group post-auth expand: %{NAS-IP-Address} %{NAS-Port} -> 172.16.1.7 808583209 rlm_ippool: MD5 on 'key' directive maps to: 4c8d9b7e94410e9a58cd8ec24b47f8b1 rlm_ippool: Searching for an entry for key: '4c8d9b7e94410e9a58cd8ec24b47f8b1' rlm_ippool: Allocating ip to key: '4c8d9b7e94410e9a58cd8ec24b47f8b1' rlm_ippool: num: 1 rlm_ippool: Allocated ip 172.16.100.69 to client key: 4c8d9b7e94410e9a58cd8ec24b47f8b1 ++[test_pool] returns ok Service-Type == Framed-User Framed-Protocol = PPP Session-Timeout = 65000 Idle-Timeout = 3600 Ascend-Maximum-Time = 64000 Ascend-Idle-Limit = 3600 Ascend-Data-Filter := "ip in forward dstip 1.1.1.2/32 0" Framed-IP-Address = 172.16.100.69 Framed-IP-Netmask = 255.255.255.0 Finished request 1.
Andreas Kalb (akalb) wrote:
Now I'm back to my original problem, where I wanted to use an Ascend-filter with entries matching IP-address from pool. I still don't know, how to change order of modules to make the IP-address known to the files-module and appreciated your uidance again.
You don't have to. You can add the ascend data filter via "unlang", in the "post-auth" section, right after the "test_pool" module is called: post-auth { ... test-pool if (ok) { update reply { ... Ascend-Data-Filter := "ip in forward srcip %{reply:Framed-IP-Address}/32 dstip 1.1.1.2/32" ... } } Again, this is documented. See "man unlang", and the examples. Alan DeKok.
Hello Alan, as I see your result I better understand unlang and the mighty of it. Thx for your patience. All working perfectly well now. Kind Regards, Andreas -----Original Message----- From: freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces+akalb=cisco.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Mittwoch, 2. April 2008 08:19 To: FreeRadius users mailing list Subject: Re: Ascend-Data-Filter with srcip from ippool Andreas Kalb (akalb) wrote:
Now I'm back to my original problem, where I wanted to use an Ascend-filter with entries matching IP-address from pool. I still don't know, how to change order of modules to make the IP-address known to the files-module and appreciated your uidance again.
You don't have to. You can add the ascend data filter via "unlang", in the "post-auth" section, right after the "test_pool" module is called: post-auth { ... test-pool if (ok) { update reply { ... Ascend-Data-Filter := "ip in forward srcip %{reply:Framed-IP-Address}/32 dstip 1.1.1.2/32" ... } } Again, this is documented. See "man unlang", and the examples. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Andreas Kalb (akalb)