Cisco ignores Framed-IP-Address from freeradius
Hello, I use freeradius 2.1.1-7 and a CISCO router (IOS 12.4(6)T9) to provide VPN connections. I would like my CISCO router to assign static IP address to remote VPN users thanks to the Freeradius server. My freeradius server is configured to give static ip address to users. I can check it with radtest : [root@host ~]# radtest toto@domain.com mypassword 127.0.0.1 0 testing123 Sending Access-Request of id 152 to 127.0.0.1 port 1812 User-Name = "toto@domain.com" User-Password = "mypassword" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=152, length=69 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 15.1.1.99 Framed-IP-Netmask = 255.255.255.0 and the CISCO router gets it ... Log Buffer (32768 bytes): Jul 3 17:50:35.368: RADIUS/ENCODE(00000058):Orig. component type = VPN_IPSEC Jul 3 17:50:35.368: RADIUS: AAA Unsupported Attr: interface [158] 13 Jul 3 17:50:35.368: RADIUS: 32 31 33 2E 34 31 2E 31 33 33 2E Jul 3 17:50:35.368: RADIUS/ENCODE(00000058): dropping service type, "radius-ser ver attribute 6 on-for-login-auth" is off Jul 3 17:50:35.368: RADIUS(00000058): Config NAS IP: 0.0.0.0 Jul 3 17:50:35.368: RADIUS/ENCODE(00000058): acct_session_id: 72 Jul 3 17:50:35.368: RADIUS(00000058): sending Jul 3 17:50:35.368: RADIUS/ENCODE: Best Local IP-Address X.X.X.X for Radius -Server Y.Y.Y.Y Jul 3 17:50:35.368: RADIUS(00000058): Send Access-Request to Y.Y.Y.Y:1812 i d 1645/50, len 112 Jul 3 17:50:35.368: RADIUS: authenticator 73 C3 A8 1F E5 ED BA C6 - B0 39 12 7 4 33 3C 80 A7 Jul 3 17:50:35.372: RADIUS: User-Name [1] 25 "toto@domain.com" Jul 3 17:50:35.372: RADIUS: User-Password [2] 18 * Jul 3 17:50:35.372: RADIUS: Calling-Station-Id [31] 16 "A.B.C.D" Jul 3 17:50:35.372: RADIUS: NAS-Port-Type [61] 6 Virtual [5] Jul 3 17:50:35.372: RADIUS: NAS-Port [5] 6 3 Jul 3 17:50:35.372: RADIUS: NAS-Port-Id [87] 15 "E.F.G.H" Jul 3 17:50:35.372: RADIUS: NAS-IP-Address [4] 6 X.X.X.X Jul 3 17:50:35.440: RADIUS: Received from id 1645/50 Y.Y.Y.Y:1812, Access-A ccept, len 44 Jul 3 17:50:35.444: RADIUS: authenticator 86 A5 0A EA BE DF 30 E0 - 11 E3 24 5 4 9B 2C C6 77 Jul 3 17:50:35.444: RADIUS: Service-Type [6] 6 Framed [2] Jul 3 17:50:35.444: RADIUS: Framed-Protocol [7] 6 PPP [1] Jul 3 17:50:35.444: RADIUS: Framed-IP-Address [8] 6 15.1.1.99 Jul 3 17:50:35.444: RADIUS: Framed-IP-Netmask [9] 6 255.255.255.0 Jul 3 17:50:35.444: RADIUS(00000058): Received from id 1645/50 Jul 3 17:50:35.444: RADIUS: Constructed " ppp negotiate" Jul 3 17:50:37.852: RADIUS/ENCODE(00000058):Orig.. component type = VPN_IPSEC Jul 3 17:50:37.852: RADIUS(00000058): Config NAS IP: 0.0.0.0 Jul 3 17:50:37.852: RADIUS(00000058): sending Jul 3 17:50:37.852: RADIUS/ENCODE: Best Local IP-Address X.X.X.X for Radius -Server Y.Y.Y.Y Jul 3 17:50:37.852: RADIUS(00000058): Send Accounting-Request to Y.Y.Y.Y:18 13 id 1646/33, len 112 Jul 3 17:50:37.852: RADIUS: authenticator AE 34 03 31 02 D0 C3 19 - 16 B0 6F D D 1E 26 FE 66 Jul 3 17:50:37.852: RADIUS: Acct-Session-Id [44] 10 "00000048" Jul 3 17:50:37.852: RADIUS: Framed-IP-Address [8] 6 15.1.1.18 Jul 3 17:50:37.852: RADIUS: User-Name [1] 25 "toto@domain.com" Jul 3 17:50:37.852: RADIUS: Acct-Authentic [45] 6 RADIUS [1] Jul 3 17:50:37.852: RADIUS: Acct-Status-Type [40] 6 Start [1] Jul 3 17:50:37.852: RADIUS: NAS-Port-Type [61] 6 Virtual [5] Jul 3 17:50:37.852: RADIUS: NAS-Port [5] 6 3 Jul 3 17:50:37.852: RADIUS: NAS-Port-Id [87] 15 "E.F.G.H" Jul 3 17:50:37.852: RADIUS: NAS-IP-Address [4] 6 X.X.X.X Jul 3 17:50:37.852: RADIUS: Acct-Delay-Time [41] 6 0 Jul 3 17:50:37.856: RADIUS: Received from id 1646/33 Y.Y.Y.Y:1813, Accounti ng-response, len 20 Jul 3 17:50:37.856: RADIUS: authenticator B8 26 8E 14 AE AB AF AA - 67 C3 3C 1 F 62 4D 70 5B .. but never assign it to remote users, the cisco router assigns an IP address from its local pool. The interesting lines of my cisco configuration are : aaa new-model ! ! aaa authentication login ClientAuth group radius aaa authorization network ClienAuth group radius local aaa accounting delay-start aaa accounting network ClientAuth start-stop group radius crypto isakmp client configuration address-pool local vpnpool crypto map rasvpn client authentication list ClientAuth crypto map rasvpn client accounting list ClientAuth crypto map rasvpn isakmp authorization list ClientAuth crypto map rasvpn client configuration address respond crypto map rasvpn 10 ipsec-isakmp dynamic dynmap I also tried with the cisco av-pair attribute with no luck ... Does anybody know what the problem could be ? Thanks! Fred
On Mon, 6 Jul 2009, Gilloteau Frederic wrote:
Hello, I use freeradius 2.1.1-7 and a CISCO router (IOS 12.4(6)T9) to provide VPN connections. and the CISCO router gets it ...
.. but never assign it to remote users, the cisco router assigns an IP address from its local pool. The interesting lines of my cisco configuration are : aaa new-model ! ! aaa authentication login ClientAuth group radius aaa authorization network ClienAuth group radius local aaa accounting delay-start aaa accounting network ClientAuth start-stop group radius I had a similar problem...it was with my aaa config. Try: aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default group radius local James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
Hi James, Thank you for your reply! I tried many aaa configurations but it does not solve the problem for me Using 'debug radius' and 'debug isakmp error' on the CISCO, I can see that it complains about "Unknown attr 0x4E24, 0x4E25, ..." and then ISAKMP also complains with the same attributes CONFIG_MODE_UNKNOWN 0x4E24 ... -----Message d'origine----- De : freeradius-users-bounces+frederic_gilloteau=yahoo.fr@lists.freeradius.org [mailto:freeradius-users-bounces+frederic_gilloteau=yahoo.fr@lists.freeradiu s.org] De la part de up@3.am Envoyé : lundi 6 juillet 2009 17:38 À : FreeRadius users mailing list Objet : Re: Cisco ignores Framed-IP-Address from freeradius On Mon, 6 Jul 2009, Gilloteau Frederic wrote:
Hello, I use freeradius 2.1.1-7 and a CISCO router (IOS 12.4(6)T9) to provide VPN connections. and the CISCO router gets it ...
.. but never assign it to remote users, the cisco router assigns an IP address from its local pool. The interesting lines of my cisco configuration are : aaa new-model ! ! aaa authentication login ClientAuth group radius aaa authorization network ClientAuth group radius local aaa accounting delay-start aaa accounting network ClientAuth start-stop group radius I had a similar problem...it was with my aaa config. Try: aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default group radius local James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am ========================================================================= - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I would like my CISCO router to assign static IP address to remote VPN users thanks to the Freeradius server. My freeradius server is configured to give static ip address to users.
Fine, how about Cisco?
and the CISCO router gets it ...
.. but never assign it to remote users, the cisco router assigns an IP address from its local pool.
The interesting lines of my cisco configuration are :
...
crypto isakmp client configuration address-pool local vpnpool ...
So, just as you have configured it! Ivan Kalik Kalik Informatika ISP
participants (4)
-
Fred -
Gilloteau Frederic
-
Ivan Kalik -
up＠3.am