One client, multiple NAS-Port-Types
Hello, I am looking for some guidance on configuring clients that will send requests with different NAS-Port-Type’s. Devices: HP Procurve, Cisco, Aruba wireless controllers Possible NAS-Port-Types: Ethernet, Virtual, Wireless, Async Ex., for an HP procurve switch, the possibilities will be: 1. CLI access (admin) – NAS-Port-Type = Virtual 2. 802.1X (users) – Nas-Port-Type = Ethernet In this case, I would like to send CLI and 802.1x requests to different virtual servers, because I accomplish #1 painlessly with ldap, and #2 gets more complicated with ads and eduroam in the mix. I have read through clients.conf and do not believe it can be done there. Where is the most appropriate place to separate the requests? Thank-you, Dave -- View this message in context: http://freeradius.1045715.n5.nabble.com/One-client-multiple-NAS-Port-Types-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
DaveA <daldwinc@uwaterloo.ca> wrote:
I am looking for some guidance on configuring clients that will send requests with different NAS-Port-Type???s.
Devices: HP Procurve, Cisco, Aruba wireless controllers Possible NAS-Port-Types: Ethernet, Virtual, Wireless, Async
Ex., for an HP procurve switch, the possibilities will be: 1. CLI access (admin) ??? NAS-Port-Type = Virtual 2. 802.1X (users) ??? Nas-Port-Type = Ethernet
In this case, I would like to send CLI and 802.1x requests to different virtual servers, because I accomplish #1 painlessly with ldap, and #2 gets more complicated with ads and eduroam in the mix.
The switch (NAS) will support sending those different requests to different RADIUS servers. Assign two different IP's to your RADIUS servers and send the relevent request to the relevent FreeRADIUS virtual server. The solution is in the NAS, not FreeRADIUS :) Cheers -- Alexander Clouter .sigmonster says: Them as has, gets.
On Jun 1, 2011, at 10:53 AM, Alexander Clouter wrote:
DaveA <daldwinc@uwaterloo.ca> wrote:
I am looking for some guidance on configuring clients that will send requests with different NAS-Port-Type???s.
Devices: HP Procurve, Cisco, Aruba wireless controllers Possible NAS-Port-Types: Ethernet, Virtual, Wireless, Async
Ex., for an HP procurve switch, the possibilities will be: 1. CLI access (admin) ??? NAS-Port-Type = Virtual 2. 802.1X (users) ??? Nas-Port-Type = Ethernet
In this case, I would like to send CLI and 802.1x requests to different virtual servers, because I accomplish #1 painlessly with ldap, and #2 gets more complicated with ads and eduroam in the mix.
The switch (NAS) will support sending those different requests to different RADIUS servers.
Not necessarily. I know with ProCurve gear RADIUS groups were only added in K14, with some of the older platforms like the 2610's and 2600 all requests go to the same server. You can do an internal proxy, but last time I checked multiple chained internal proxies were broken (I tried something very similar a few years ago). So external-server (with listen block)
assignment-logic proxy-to "eap-radius"
eap-radius proxy-to "eap-radius-inner" (breaks here)
Alan DeKok may have fixed it in the interim period. It's a particularly nice setup as it lets you drop in additional servers to support new devices really easily, and then if one type of NAS is smart enough to direct different types of requests (cli, 802.1X) to different servers, you can always use listen blocks in the different virtual servers, so that they can deal with requests sent to a particular IP alias or port, as well as internal requests. Policies can be defined in policy.conf to share code between servers etc... IMHO this is the best way to organise a server that serves many different types of NAS... if only it worked :) -Arran Arran Cudbard-Bell RM-RF Limited - Security consultation and contracting VoIP: +1 916-436-1352 Cell: +44 7854041841
Arran Cudbard-Bell wrote:
You can do an internal proxy, but last time I checked multiple chained internal proxies were broken (I tried something very similar a few years ago).
You can proxy to one virtual server. But that request can't be proxied again. It's too awkward to deal with that.
So
external-server (with listen block)
assignment-logic proxy-to "eap-radius"
eap-radius proxy-to "eap-radius-inner" (breaks here)
Hmm, yes.
Alan DeKok may have fixed it in the interim period.
Nope. :( Most of the code is there (especially in 3.0). But it's disabled because I'm unsure as to what the side effects are, and haven't had any time to look at it.
It's a particularly nice setup as it lets you drop in additional servers to support new devices really easily, and then if one type of NAS is smart enough to direct different types of requests (cli, 802.1X) to different servers, you can always use listen blocks in the different virtual servers, so that they can deal with requests sent to a particular IP alias or port, as well as internal requests.
Policies can be defined in policy.conf to share code between servers etc...
IMHO this is the best way to organise a server that serves many different types of NAS... if only it worked :)
There might be a better way. I'll see if I have time in the next few months. Alan DeKok.
DaveA wrote:
In this case, I would like to send CLI and 802.1x requests to different virtual servers, because I accomplish #1 painlessly with ldap, and #2 gets more complicated with ads and eduroam in the mix.
I have read through clients.conf and do not believe it can be done there. Where is the most appropriate place to separate the requests?
Proxying. Set up a minimal virtual server that proxies to others. You can set a "home server" which is really a virtual server. Alan DeKok.
Alan DeKok wrote:
Proxying. Set up a minimal virtual server that proxies to others.
Okay, this makes sense, but I am still unclear as to where to make the differentiation between NAS-Port-Types. What I envision is something like: If (NAS-Port-Type == Virtual ) { Home_server = admincli } Elsif (NAS-Port-Type == Ethernet ) { Home_server = 8021x } Of course the above is pseudo code.. but I've looked at proxy.conf and both hints and huntgroups and just can't determine where to put this. Thanks for your continued help. Dave -- View this message in context: http://freeradius.1045715.n5.nabble.com/One-client-multiple-NAS-Port-Types-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 02/06/11 16:17, DaveA wrote:
Alan DeKok wrote:
Proxying. Set up a minimal virtual server that proxies to others.
Okay, this makes sense, but I am still unclear as to where to make the differentiation between NAS-Port-Types.
What I envision is something like: If (NAS-Port-Type == Virtual ) { Home_server = admincli } Elsif (NAS-Port-Type == Ethernet ) { Home_server = 8021x }
authorize { ... if (NAS-Port-Type == Virtual) { update control { Proxy-To-Realm := ADMIN_SERVER } } # N.B. maybe do this instead elsif (EAP-Message) { update control { Proxy-To-Realm := EAP_SERVER } } ... } ..and in proxy.conf: home_server EAP { type = auth+acct virtual_server = eap } home_server_pool EAP_POOL { home_server = EAP } realm EAP_SERVER { pool = EAP_POOL }
That looks great, thanks! Last question... Phil Mayers wrote:
authorize { ...
That is the authorize section from /sites-enabled/default, correct? Thanks again, Dave -- View this message in context: http://freeradius.1045715.n5.nabble.com/One-client-multiple-NAS-Port-Types-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (5)
-
Alan DeKok -
Alexander Clouter -
Arran Cudbard-Bell -
DaveA -
Phil Mayers