Hi there, i looked around and found nothing which really helped, so i'll ask you :) I want my freeradius to rewrite the vlan attributes for cetrain clients. Setup is like having all users in my ldap, with vlan etc. and all is working fine so far. Now i have an office which has other vlans due to an migration than the main office. Now i want my vlan IDs rewritten by freeradius for that office.
From what i have read, i can do it with rlm_perl or maybe with rlm_attr_rewrite, but i didn't found anything about how exactly... If someone could point me to a doc or so, would be really nice.
Thanksalot! (especially for the freeradius itself :)
Hi there! On Mon, Mar 17, 2008 at 9:56 AM, Alan DeKok <aland@deployingradius.com> wrote:
mrhotstandby@gmail.com wrote:
I want my freeradius to rewrite the vlan attributes for cetrain clients.
From what... to what? Do you have examples?
Sure, thanks for your time btw! My Main Office has three different vlans: 2 -> default/clients 10 -> admin 12 -> special but in my small office, i only have 2 and 23, whereas 2 is like 2 at the main office, and 23 is admin. Special doesn't exist there, so it should be mapped to 2. So what i need is, if my client is the switch in the small office, rewrite 10 to 23, 12 to 2 and leave 2 as 2. Again, thanks!
users file: DEFAULT NAS-IP-Address == office switch/router IP, Ldap-Group == "admin" Tunnel-Private-Group-ID := "23" Same for special group and ID of 2. Just make sure you don't use operator := in Ldap too, since ldap is listed after files by default. Ivan Kalik Kalik Informatika ISP Dana 17/3/2008, "mrhotstandby@gmail.com" <mrhotstandby@gmail.com> piše:
Hi there!
On Mon, Mar 17, 2008 at 9:56 AM, Alan DeKok <aland@deployingradius.com> wrote:
mrhotstandby@gmail.com wrote:
I want my freeradius to rewrite the vlan attributes for cetrain clients.
From what... to what? Do you have examples?
Sure, thanks for your time btw! My Main Office has three different vlans: 2 -> default/clients 10 -> admin 12 -> special
but in my small office, i only have 2 and 23, whereas 2 is like 2 at the main office, and 23 is admin. Special doesn't exist there, so it should be mapped to 2.
So what i need is, if my client is the switch in the small office, rewrite 10 to 23, 12 to 2 and leave 2 as 2.
Again, thanks! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Ivan, thanks for the hint. Just to make sure i understand you correctly.... my ldap query already returned a Tunnel-Private-Group-ID (mappend by the ldap.attrmap), so i can reference on that instead of Ldap-Group...? Like: DEFAULT NAS-IP-Address == 10.0.96.1, Private-Tunnel-Group-ID == "10" Tunnel-Private-Group-ID := "23" ? Thanksalot! 2008/3/17 Ivan Kalik <tnt@kalik.net>:
users file:
DEFAULT NAS-IP-Address == office switch/router IP, Ldap-Group == "admin" Tunnel-Private-Group-ID := "23"
Same for special group and ID of 2. Just make sure you don't use operator := in Ldap too, since ldap is listed after files by default.
Ivan Kalik Kalik Informatika ISP
Dana 17/3/2008, "mrhotstandby@gmail.com" <mrhotstandby@gmail.com> piše:
Hi there!
On Mon, Mar 17, 2008 at 9:56 AM, Alan DeKok <aland@deployingradius.com> wrote:
mrhotstandby@gmail.com wrote:
I want my freeradius to rewrite the vlan attributes for cetrain clients.
From what... to what? Do you have examples?
Sure, thanks for your time btw! My Main Office has three different vlans: 2 -> default/clients 10 -> admin 12 -> special
but in my small office, i only have 2 and 23, whereas 2 is like 2 at the main office, and 23 is admin. Special doesn't exist there, so it should be mapped to 2.
So what i need is, if my client is the switch in the small office, rewrite 10 to 23, 12 to 2 and leave 2 as 2.
Again, thanks!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I don't think so. It's a reply attribute so the check won't match. You will need a perl script to check and update values using reply attributes. Ivan Kalik Kalik Informatika ISP Dana 17/3/2008, "mrhotstandby@gmail.com" <mrhotstandby@gmail.com> piše:
Hi Ivan,
thanks for the hint. Just to make sure i understand you correctly.... my ldap query already returned a Tunnel-Private-Group-ID (mappend by the ldap.attrmap), so i can reference on that instead of Ldap-Group...? Like: DEFAULT NAS-IP-Address == 10.0.96.1, Private-Tunnel-Group-ID == "10" Tunnel-Private-Group-ID := "23"
?
Thanksalot!
2008/3/17 Ivan Kalik <tnt@kalik.net>:
users file:
DEFAULT NAS-IP-Address == office switch/router IP, Ldap-Group == "admin" Tunnel-Private-Group-ID := "23"
Same for special group and ID of 2. Just make sure you don't use operator := in Ldap too, since ldap is listed after files by default.
Ivan Kalik Kalik Informatika ISP
Dana 17/3/2008, "mrhotstandby@gmail.com" <mrhotstandby@gmail.com> piše:
Hi there!
On Mon, Mar 17, 2008 at 9:56 AM, Alan DeKok <aland@deployingradius.com> wrote:
mrhotstandby@gmail.com wrote:
I want my freeradius to rewrite the vlan attributes for cetrain clients.
From what... to what? Do you have examples?
Sure, thanks for your time btw! My Main Office has three different vlans: 2 -> default/clients 10 -> admin 12 -> special
but in my small office, i only have 2 and 23, whereas 2 is like 2 at the main office, and 23 is admin. Special doesn't exist there, so it should be mapped to 2.
So what i need is, if my client is the switch in the small office, rewrite 10 to 23, 12 to 2 and leave 2 as 2.
Again, thanks!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi! mh, ok, sounds bad - what happens if 1000 users "re-connect" to the network.. will i get 1000 forked perl scripts..? And how should the script look like/get implemented? Thanksalot! 2008/3/17 Ivan Kalik <tnt@kalik.net>:
I don't think so. It's a reply attribute so the check won't match. You will need a perl script to check and update values using reply attributes.
Ivan Kalik Kalik Informatika ISP
Dana 17/3/2008, "mrhotstandby@gmail.com" <mrhotstandby@gmail.com> piše:
Hi Ivan,
thanks for the hint. Just to make sure i understand you correctly.... my ldap query already returned a Tunnel-Private-Group-ID (mappend by the ldap.attrmap), so i can reference on that instead of Ldap-Group...? Like: DEFAULT NAS-IP-Address == 10.0.96.1, Private-Tunnel-Group-ID == "10" Tunnel-Private-Group-ID := "23"
?
Thanksalot!
2008/3/17 Ivan Kalik <tnt@kalik.net>:
users file:
DEFAULT NAS-IP-Address == office switch/router IP, Ldap-Group == "admin" Tunnel-Private-Group-ID := "23"
Same for special group and ID of 2. Just make sure you don't use operator := in Ldap too, since ldap is listed after files by default.
Ivan Kalik Kalik Informatika ISP
Dana 17/3/2008, "mrhotstandby@gmail.com" <mrhotstandby@gmail.com> piše:
Hi there!
On Mon, Mar 17, 2008 at 9:56 AM, Alan DeKok <aland@deployingradius.com> wrote:
mrhotstandby@gmail.com wrote:
I want my freeradius to rewrite the vlan attributes for cetrain clients.
From what... to what? Do you have examples?
Sure, thanks for your time btw! My Main Office has three different vlans: 2 -> default/clients 10 -> admin 12 -> special
but in my small office, i only have 2 and 23, whereas 2 is like 2 at the main office, and 23 is admin. Special doesn't exist there, so it should be mapped to 2.
So what i need is, if my client is the switch in the small office, rewrite 10 to 23, 12 to 2 and leave 2 as 2.
Again, thanks!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
mh, ok, sounds bad - what happens if 1000 users "re-connect" to the network...
Ldap is likely to be much more of a problem than a perl script.
And how should the script look like/get implemented?
http://wiki.freeradius.org/Rlm_perl You do the same as in users file - check NAS-IP-Address (RAD_REQUEST) and tunnel ID (RAD_REPLY) and then update tunnel ID in the cases that match the criteria. Ivan Kalik Kalik Informatika ISP
Hi there, On Mon, Mar 17, 2008 at 4:49 PM, Ivan Kalik <tnt@kalik.net> wrote:
mh, ok, sounds bad - what happens if 1000 users "re-connect" to the network...
Ldap is likely to be much more of a problem than a perl script.
For that reason its a cluster :D
And how should the script look like/get implemented?
http://wiki.freeradius.org/Rlm_perl
You do the same as in users file - check NAS-IP-Address (RAD_REQUEST) and tunnel ID (RAD_REPLY) and then update tunnel ID in the cases that match the criteria.
okay, and i need my stuff in post-auth? sorry for asking that much, but the page is not that clear to me... but i try my best :) Thanksalot!
participants (3)
-
Alan DeKok -
Ivan Kalik -
mrhotstandby＠gmail.com