Question on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device.
Hi, We are looking for help or guidance on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device. Currently installed: freeradius-server-2.1.12, running on Linux Cent OS 6.4 - x64, Cisco HA 5.3 running on a Cisco SAMI blade in a 7604 Brief Background: Our application is providing a "proxy" alternative Cisco HOME AGENT and DAY PASS service for the Carriers that have subscribers that do not have roaming agreements with the Home Carrier they are attempting to register too, that are currently not served & dropped with no service, today. We have completed live production test with a Tier 2 Carrier and found out from lab testing to live testing that we would not be able to ignore the MN-AAA key and "hotline" the user with a AAA profile using a "local" config with the Cisco as stated in the Cisco HA 5.3 documentation (Typical Cisco document). We now have to use the "remote" capabilities of the Cisco HA for authentication and authorization, versus local Cisco HA config. Question: We now need to use the FreeRadius to manage both the MN-HA and MN-AAA keys and respond back to the Cisco HA properly to complete the device registration back to the Cisco HA. We have used the "3gpp2-mn-ha-shared-key" for the MN-HA attribute and response to the Cisco HA & tested this successfully, but are not able to find or determine what attribute to use for the response back to the Cisco HA for the "chap password" & "chap challenge" for the MN-AAA, which we are receiving from the Cisco HA. We are trying to determine if such an attribute exist and if so, which one will do the trick. I hope this is enough information and understandable in such a short write up. Please let me know if you have any suggestions or can point us in the right direction for the resources to resolve this. Thanks, Milton
Milton Volz wrote:
We are looking for help or guidance on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device.
In a general sense, *all* attributes are available to be in a response. That probably doesn't help much, though.
We now need to use the FreeRadius to manage both the MN-HA and MN-AAA keys and respond back to the Cisco HA properly to complete the device registration back to the Cisco HA. We have used the "3gpp2-mn-ha-shared-key" for the MN-HA attribute and response to the Cisco HA & tested this successfully, but are not able to find or determine what attribute to use for the response back to the Cisco HA for the "chap password" & "chap challenge" for the MN-AAA, which we are receiving from the Cisco HA. We are trying to determine if such an attribute exist and if so, which one will do the trick.
The only answer here is to read the 3GPP specs. Or maybe the Cisco specs. That should say what to do when you receive a CHAP authentication request.
I hope this is enough information and understandable in such a short write up. Please let me know if you have any suggestions or can point us in the right direction for the resources to resolve this.
It's a lot of buzzwords in a short post. But as with most things RADIUS, the answers are nearly always the same. Yes, FreeRADIUS can do anything. But *when* to do things, and *what* to do is not documented. IN fact, we can't document it. Your issue is likely answered in the 3GPP specs, and we're not 3GPP people. But you should be able to read those specs, and then get FreeRADIUS to return the right thing. Alan DeKok.
On 20.11.2013 23:33, Alan DeKok wrote:
Milton Volz wrote:
We are looking for help or guidance on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device.
In a general sense, *all* attributes are available to be in a response. That probably doesn't help much, though.
We now need to use the FreeRadius to manage both the MN-HA and MN-AAA keys and respond back to the Cisco HA properly to complete the device registration back to the Cisco HA. We have used the "3gpp2-mn-ha-shared-key" for the MN-HA attribute and response to the Cisco HA & tested this successfully, but are not able to find or determine what attribute to use for the response back to the Cisco HA for the "chap password" & "chap challenge" for the MN-AAA, which we are receiving from the Cisco HA. We are trying to determine if such an attribute exist and if so, which one will do the trick.
The only answer here is to read the 3GPP specs. Or maybe the Cisco specs. That should say what to do when you receive a CHAP authentication request.
Refer to 3GPP2 X.S0011 "cdma2000 Wireless IP Network Standard" document. It is available for download from www.3gpp2.org. Part 2 "Simple IP and Mobile IP Access Services", section 4 "MIP4 Operation", subsection 4.4 "RADIUS Server Requirements". It seems you already have implemented MN-HA Shared Key Distribution. Maybe you need to implement IKE Pre-shared Secret Distribution. All attributes mentioned in 3GPP2 X.S0011 are defined in freeradius dictionaries and "available" to be sent from freeradius to Home Agent. CHAP-Password and CHAP-Challenge are never sent from RADIUS server to NAS. This is stated in RFC 2865 and also in 3GPP2 X.S0011.
I hope this is enough information and understandable in such a short write up. Please let me know if you have any suggestions or can point us in the right direction for the resources to resolve this.
It's a lot of buzzwords in a short post. But as with most things RADIUS, the answers are nearly always the same. Yes, FreeRADIUS can do anything. But *when* to do things, and *what* to do is not documented.
IN fact, we can't document it. Your issue is likely answered in the 3GPP specs, and we're not 3GPP people. But you should be able to read those specs, and then get FreeRADIUS to return the right thing.
participants (3)
-
Alan DeKok -
Iliya Peregoudov -
Milton Volz