Affect Static IP by Freeradius/ASA5510
Hi Sorry to restart the same subject, but actually i am search .. i am search .... but i don't see any solution ... I use: FreeRadius with a Perl Script A Cisco ASA5510 IOS 8.0 In debug i have: When a user don't have IP, use "Pool" : ============================================================== rad_recv: Access-Request packet from host 10.218.7.243:1025, id=31, length=166 User-Name = "vpn001@xx.fr" User-Password = "XXX" NAS-Port = 1658880 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "62.XX.XX.XX" Calling-Station-Id = "88.XX.XX.XX" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "88.XX.XX.XX" NAS-IP-Address = 10.218.7.243 Cisco-AVPair = "ip:source-ip=88.XX.XX.XXy\223" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "xx.fr" for User-Name = "vpn001@xx.fr" rlm_realm: No such realm "xx.fr" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 154 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 0 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair h323-credit-amount = 100 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 0 modcall: leaving group Perl (returns ok) for request 0 Login OK: [vpn001@xx.fr/XXX] (from client 10.218.7.243 port 1658880 cli 88.XX.XX.XX) Sending Access-Accept of id 31 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP h323-credit-amount = "100" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 4989aa4d Nothing to do. Sleeping until we see a request. ================================================ No problems, the user connect and have a IP of the Pool When i use a user with static IP: ================================================ rad_recv: Access-Request packet from host 10.218.7.243:1025, id=32, length=166 User-Name = "vpn006@xx.fr" User-Password = "XXX" NAS-Port = 1662976 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "62.23.17.71" Calling-Station-Id = "88.XX.XX.XX" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "88.XX.XX.XX" NAS-IP-Address = 10.218.7.243 Cisco-AVPair = "ip:source-ip=88.XX.XX.XXy\223" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "xx.fr" for User-Name = "vpn006@xx.fr" rlm_realm: No such realm "xx.fr" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 154 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 1 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 10.218.3.41 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 1 Using perl at 0x8149a00 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair h323-credit-amount = 100 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 10.218.3.41 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 1 modcall: leaving group Perl (returns ok) for request 1 Login OK: [vpn006@xx.fr/XXX] (from client 10.218.7.243 port 1662976 cli 88.XX.XX.XX) Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP h323-credit-amount = "100" Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 32 with timestamp 4989aa74 Nothing to do. Sleeping until we see a request. ============================================= I see "Framed-IP-Address = 10.218.3.41" but at the end of the logs he have: "Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254" Why he sending 255.255.255.254 ..... It's because i use a client type "cisco" ? because my perl script use "RLM_MODULE_OK" at authenticate and accounting ? Thanks for your help
Phibee Network Operation Center wrote:
I see "Framed-IP-Address = 10.218.3.41" but at the end of the logs he have:
"Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254"
Why he sending 255.255.255.254 .....
Some part of the configuration *you* added does this. The default configuration as shipped with the server doesn't add a Framed-IP-Address of 255.255.255.254. Look at the debug output, and look at the "users" file entries it matches. You could also simply "grep" the configuration files for 255.255.255.254, and see where it comes from. Alan DeKok.
Alan DeKok a écrit :
Phibee Network Operation Center wrote:
I see "Framed-IP-Address = 10.218.3.41" but at the end of the logs he have:
"Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254"
Why he sending 255.255.255.254 .....
Some part of the configuration *you* added does this. The default configuration as shipped with the server doesn't add a Framed-IP-Address of 255.255.255.254.
Look at the debug output, and look at the "users" file entries it matches.
You could also simply "grep" the configuration files for 255.255.255.254, and see where it comes from.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hoooo very thanks Alan ! I have add a "#" into "users": DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes And now, the user have the good IP address !!!!
I see "Framed-IP-Address = 10.218.3.41" but at the end of the logs he have:
"Sending Access-Accept of id 32 to 10.218.7.243 port 1025 Framed-IP-Address = 255.255.255.254"
Why he sending 255.255.255.254 .....
Some part of the configuration *you* added does this. The default configuration as shipped with the server doesn't add a Framed-IP-Address of 255.255.255.254.
Look at the debug output, and look at the "users" file entries it matches.
You could also simply "grep" the configuration files for 255.255.255.254, and see where it comes from.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hoooo very thanks Alan !
I have add a "#" into "users":
DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes
And now, the user have the good IP address !!!!
Can perl overwrite the value from users file? From debug he did give the new address for $RAD_REPLY but it did not overwrite the previous value (from users file). Ivan Kalik Kalik Informatika ISP
tnt@kalik.net wrote:
Can perl overwrite the value from users file? From debug he did give the new address for $RAD_REPLY but it did not overwrite the previous value (from users file).
The perl module is supposed to *replace* the reply attributes with whatever it has. So a "lingering" IP address is strange. Alan DeKok.
Can perl overwrite the value from users file? From debug he did give the new address for $RAD_REPLY but it did not overwrite the previous value (from users file).
The perl module is supposed to *replace* the reply attributes with whatever it has. So a "lingering" IP address is strange.
Alan DeKok. -
I have tested it on 2.1.3 and it works that way - value from users file is replaced by the value entered in perl. The man from Phibee: what freeradius version are you using? That looks like 1.x. You should use latest version for new installations in order to avoid bugs like this. Ivan Kalik Kalik Informatika ISP
participants (3)
-
Alan DeKok -
Phibee Network Operation Center -
tnt＠kalik.net