Can freeRADIUS originate CoA Acks?
The short: I know freeRADIUS can originate CoA packets. I configured this and is working perfectly. However, I am in need of freeRADIUS (acting as proxy) to originate CoA Acks when it receives a CoA packet destined for the NAS. The long: I have a Cisco ACS and a non-Cisco NAS. The NAS does not support CoA. However, ACS is sending CoA packets to the NAS and the NAS must act accordingly (this is a requirement.) In order to meet these requirement, I placed freeRADIUS as a proxy between the NAS and ACS. This is what I already have working: 1. freeRADIUS intercepts Accept packets and modifies before sending to NAS. 2. freeRADIUS intercepts CoA packets and sends SOAP commands to NAS to perform actions in the CoA attributes. 3. freeRADIUS forwards CoA packet to NAS (which NAS ignores.) 4. NAS reacts to SOAP commands as expected. The problem is that since the NAS ignores the CoA packet, it never sends a CoA Ack. As a consequence, ACS's status is outdated since it does not know that the parameters in the CoA yielded results. What I need is a way to have freeRADIUS (acting as proxy) to send a CoA Ack when it intercepts the CoA packet (preferably after the SOAP commands are executed, but not required.) Can this be achieved with freeRADIUS? Or is there an external script I can run to generate and send such a packet to ACS? Thanx in advance. Andre
Chavez, Andres ((HP Networking - Roseville)) wrote:
I know freeRADIUS can originate CoA packets. I configured this and is working perfectly. However, I am in need of freeRADIUS (acting as proxy) to originate CoA Acks when it receives a CoA packet destined for the NAS.
OK... Proxies don't originate anything. They proxy a reply, if it exists.
1. freeRADIUS intercepts Accept packets and modifies before sending to NAS.
2. freeRADIUS intercepts CoA packets and sends SOAP commands to NAS to perform actions in the CoA attributes.
3. freeRADIUS forwards CoA packet to NAS (which NAS ignores.)
That's the issue. Don't forward the CoA packet to the NAS. Instead, have FreeRADIUS just send a CoA-ACK.
What I need is a way to have freeRADIUS (acting as proxy) to send a CoA Ack when it intercepts the CoA packet (preferably after the SOAP commands are executed, but not required.)
You configure it to *not* proxy the COA packet to the NAS. This should be trivial to do in "unlang". Alan DeKok.
On 11 Apr 2014, at 17:29, Alan DeKok <aland@deployingradius.com> wrote:
Chavez, Andres ((HP Networking - Roseville)) wrote:
I know freeRADIUS can originate CoA packets. I configured this and is working perfectly. However, I am in need of freeRADIUS (acting as proxy) to originate CoA Acks when it receives a CoA packet destined for the NAS.
OK... Proxies don't originate anything. They proxy a reply, if it exists.
1. freeRADIUS intercepts Accept packets and modifies before sending to NAS.
2. freeRADIUS intercepts CoA packets and sends SOAP commands to NAS to perform actions in the CoA attributes.
3. freeRADIUS forwards CoA packet to NAS (which NAS ignores.)
That's the issue. Don't forward the CoA packet to the NAS. Instead, have FreeRADIUS just send a CoA-ACK.
As Alan says the proxying part isn't necessary here, the server can just terminate CoA requests locally, there's no need to forward them. You just need a listen section with type CoA. I think Nathan Jenne and Freeman Huang have both worked with FreeRADIUS before, so you might want to talk to them if you're stuck. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Chavez, Andres ((HP Networking - Roseville))