user authentication including ingress/egress policing
Hello all, As this is my first question to this mailing list, I hope I do it the right way :-) First, this is the version I’m using: marijn@server1:~$ freeradius -v freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 Copyright (C) 1999-2011 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. I’m not sure about the ‘radiusd’ command. I don’t want to eat my keyboard so livingston is a no, but what about yardradius? marijn@server1:~$ radiusd -xx -l stdout -f The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Anyhow, on to my question. I’m a network engineer at an ISP which delivers Internet connections to business clients. Since IP Space is running out, we decided to use subscriber management on the MX router. Now, although we’ve got this part working (using Framed-IP-Address and Framed-Netmask attributes), even with QinQ, now comes the part where we want to limit bandwidth on QinQ connections. Juniper itself says that I should use RADIUS VSA’s 26-10 and 26-11 or Ingress/Egress-Policy-Name. Other documents say I should use the unisphere dictionary using Unisphere-Ingress/Egress-Policy-Name. However, this dictionary was not part of my configuration. I decided to ‘just add’ the dictionary to /usr/share/freeradius directory and add an $INCLUDE to the main dictionary file. Then I restarted the service. Unfortunately it’s still not working. What am I missing here? This is how I built up the radreply records, the username is the same as where the IP address and netmask are configured. If you need any other output, please ask. I don’t know where to look anymore. Marijn
On Fri, Apr 07, 2017 at 08:38:03AM +0200, Marijn van Gool wrote:
marijn@server1:~$ freeradius -v freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03
That is really old, and no longer supported. You should look to upgrade.
I’m not sure about the ‘radiusd’ command. I don’t want to eat my keyboard so livingston is a no, but what about yardradius?
The standard daemon name for FreeRADIUS is 'radiusd'. On Debian based systems (inc. Ubuntu) it's renamed to 'freeradius' instead. On your system use 'freeradius' instead of 'radiusd'.
Juniper itself says that I should use RADIUS VSA’s 26-10 and 26-11 or Ingress/Egress-Policy-Name. Other documents say I should use the unisphere dictionary using Unisphere-Ingress/Egress-Policy-Name.
Cross-referencing their dictionary, in FreeRADIUS you need to use the attributes ERX-Ingress-Policy-Name and ERX-Egress-Policy-Name.
However, this dictionary was not part of my configuration.
It is in 2.1.12. https://github.com/FreeRADIUS/freeradius-server/blob/release_2_1_12/share/di... Not all RADIUS servers use the same format dictionary files. You can't just drop theirs in place and expect it to work.
Unfortunately it’s still not working. What am I missing here?
The debug output of 'freeradius -X' will tell you everything the server is doing. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks for your reply. The request doesn’t even reach the radius server because the juniper log says this: Apr 7 09:05:34 profile_request_handler: session 279033, operation add, ifdev 154, err code 49, daemon "dfwd", msg "Missing inet input filter name.", retry “FALSE" I use $junos-input-filter and $junos-output-filter which are supposed to be linked with the Radius attributes you describe. But it’s nowhere to be found in the RADIUS request message to the freeradius server. If I configure this firewall filter statically in the Juniper, it works perfectly. I guess I have to look further into the Juniper side. Too bad this log message doesn’t help me any further and there’s no point in googling it because not many people use it. Marijn
On Fri, Apr 07, 2017 at 11:10:55AM +0200, Marijn van Gool wrote:
The request doesn’t even reach the radius server because the juniper log says this: ... I guess I have to look further into the Juniper side. Too bad this log message doesn’t help me any further and there’s no point in googling it because not many people use it.
Sounds like you need to fix the Juniper side first. If the requests aren't getting to FreeRADIUS then there's not a lot that anyone here can help with. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, So, I finally got all the information back from the freeradius server: Apr 7 12:16:58.908321 Parsing RADIUS message for session-id:283768 Apr 7 12:16:58.908383 radius-access-accept: Framed-IP-Address received: 10.110.110.2 Apr 7 12:16:58.908440 radius-access-accept: Framed-IP-Netmask received: 255.255.255.0 Apr 7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M Apr 7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M The problem now is that $junos-input-filter and $junos-output-filter are not being substituted by the police-17M, and there is no log saying that anything’s wrong. Is there a Juniper expert here that could perhaps get me on the right track? I feel i;m very close. I know this is not a specific RADIUS question? But I need all help there is. Marijn
On Fri, Apr 07, 2017 at 04:53:09PM +0200, Marijn van Gool wrote:
So, I finally got all the information back from the freeradius server:
Apr 7 12:16:58.908321 Parsing RADIUS message for session-id:283768 Apr 7 12:16:58.908383 radius-access-accept: Framed-IP-Address received: 10.110.110.2 Apr 7 12:16:58.908440 radius-access-accept: Framed-IP-Netmask received: 255.255.255.0 Apr 7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M Apr 7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M
That's good.
Is there a Juniper expert here that could perhaps get me on the right track? I feel i;m very close.
Certainly not me. Looks like you need to contact Juniper's support now. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Apr 7, 2017, at 3:38 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Fri, Apr 07, 2017 at 04:53:09PM +0200, Marijn van Gool wrote:
So, I finally got all the information back from the freeradius server:
Apr 7 12:16:58.908321 Parsing RADIUS message for session-id:283768 Apr 7 12:16:58.908383 radius-access-accept: Framed-IP-Address received: 10.110.110.2 Apr 7 12:16:58.908440 radius-access-accept: Framed-IP-Netmask received: 255.255.255.0 Apr 7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M Apr 7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M
That's good.
Is there a Juniper expert here that could perhaps get me on the right track? I feel i;m very close.
Certainly not me. Looks like you need to contact Juniper's support now.
Yes, that's what JTAC is for. Only been waiting three days now for them to associate our support contract with our routers... -Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Yes, that's what JTAC is for. Only been waiting three days now for them to associate our support contract with our routers...
Well, it gives you time to write scripts to pull all your private keys out of the mammoth diag dumps that the first level tech has been told to demand before escalating your case. Nothing makes my face fall like the realization that I have to file a ticket to one of our vendors.
On Apr 7, 2017, at 3:55 PM, Brian Julin <BJulin@clarku.edu> wrote:
Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Yes, that's what JTAC is for. Only been waiting three days now for them to associate our support contract with our routers...
Well, it gives you time to write scripts to pull all your private keys out of the mammoth diag dumps
which on an SRX3xx series takes 10 minutes to generate! Makes me long for 'show tech all'.
that the first level tech has been told to demand before escalating your case. Nothing makes my face fall like the realization that I have to file a ticket to one of our vendors.
...and so begins the six month epic of stupidity. -Arran
participants (4)
-
Arran Cudbard-Bell -
Brian Julin -
Marijn van Gool -
Matthew Newton