Hello, I aim at setting up an IPsec tunnel between an IPsec client and an IPsec Gateway using IKEv2 and EAP-TLS for authentication. I am using freeradius as RADIUS server, and the authentication is working well. Currently the Gateway is assigning an IP address from a specific pool to the IKEv2 client. However I'd like the RADIUS server to assign this IP address and send it within the Access-Accept in the Framed-IP-Address attribute (to avoid configuring the IPsec Gateway with the tunnel address). I saw that FreeRADIUS has several IP Pool modules which have the ability to assign dynamic IP address to RADIUS sessions types where the NAS has control over the the users IP, however not for Ethernet. Is there a way (e.g. using DHCP) to assign an IP address to the Ipsec client and send it the Access-Accept in the Framed-IP-Address attribute? Best regards, Laurence
Groebl, Laurence (Laurence) wrote:
However I’d like the RADIUS server to assign this IP address and send it within the Access-Accept in the Framed-IP-Address attribute (to avoid configuring the IPsec Gateway with the tunnel address).
Does the gateway *understand* what it means to have an address in the Access-Accept? If the documentation doesn't say it will work, then it won't work. Alan DeKok.
Hello Alan, Yes, according to the documentation of the Juniper Gateway, the gateway should be able to understand the Radius attribute 8 "Framed-IP-Address" in the Access-Accept message, but it seems that it also need the attribute 88 " Framed-Pool". This is described in "Concepts & Examples ScreenOS Reference Guide, User Authentication document", chapter "Framed Pool and Framed IP Address" page 26, http://www.juniper.net/techpubs/software/screenos/screenos6.3.0/630_ce_UserA... And then the Gateway should be able to send this address in the IKEv2 configuration payload to the IPsec client (this ikev2 interface is already working with local address assignment in the gateway, we tested it). Best regards, Laurence -----Original Message----- From: freeradius-users-bounces+laurence.groebl=alcatel-lucent.com@lists.freeradius.org [mailto:freeradius-users-bounces+laurence.groebl=alcatel-lucent.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Dienstag, 1. März 2011 10:00 To: FreeRadius users mailing list Subject: Re: IP Pool for Ethernet Groebl, Laurence (Laurence) wrote:
However I'd like the RADIUS server to assign this IP address and send it within the Access-Accept in the Framed-IP-Address attribute (to avoid configuring the IPsec Gateway with the tunnel address).
Does the gateway *understand* what it means to have an address in the Access-Accept? If the documentation doesn't say it will work, then it won't work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 01/03/11 10:39, Groebl, Laurence (Laurence) wrote:
Hello Alan,
Yes, according to the documentation of the Juniper Gateway, the gateway should be able to understand the Radius attribute 8 "Framed-IP-Address" in the Access-Accept message, but it seems that it also need the attribute 88 " Framed-Pool".
That doesn't make sense. You can't send it a specific IP, and an attribute telling it to pick an IP from a local pool, and expect any sensible behaviour. Have you tried just sending the Framed-IP-Address? Also, your subject line is wrong - this is nothing to do with "Ethernet"
Hi we indeed already tried sending only the Framed-IP-Address in the Access-Accept and it didn't work, the Gateway didn't assign this address to the IPsec client, but a default IP address. I also didn't understand why the Framed-Pool attribute is a must in the Gateway, Juniper supports only the following cases (extract from the Screen OS documentation): Case 1: Framed-Pool attribute and the Framed-IP-Address attribute are both included in the Access-Accept message. => The Framed-Pool attribute is always ignored by the RADIUS server unless the framed-IP-Address value is 0xFFFFFFFE (255.255.255.254). Then, the device allocates an address from the Framed-Pool attribute sent by the RADIUS server Case 2: Framed-Pool attribute and the Framed-IP-Address attribute are both absent from the Access-Accept message. => The device does not assign an IP address to the end user. Case 3: Framed-IP-Address attribute is included in the Access-Accept message and it has a value of 0xFFFFFFFE (255.255.255.254). BUT Framed-Pool attribute is absent. => The device allocates an IP address from the default IP address pool that is configured for that virtual system. Case 4 : The pool sent out in the Framed-Pool attribute is not configured, or it does not have any IP addresses. An error messages are generated and the negotiation is terminated. Best regards, Laurence -----Original Message----- From: freeradius-users-bounces+laurence.groebl=alcatel-lucent.com@lists.freeradius.org [mailto:freeradius-users-bounces+laurence.groebl=alcatel-lucent.com@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Dienstag, 1. März 2011 11:56 To: freeradius-users@lists.freeradius.org Subject: Re: IP Pool for Ethernet On 01/03/11 10:39, Groebl, Laurence (Laurence) wrote:
Hello Alan,
Yes, according to the documentation of the Juniper Gateway, the gateway should be able to understand the Radius attribute 8 "Framed-IP-Address" in the Access-Accept message, but it seems that it also need the attribute 88 " Framed-Pool".
That doesn't make sense. You can't send it a specific IP, and an attribute telling it to pick an IP from a local pool, and expect any sensible behaviour. Have you tried just sending the Framed-IP-Address? Also, your subject line is wrong - this is nothing to do with "Ethernet" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Groebl, Laurence (Laurence) wrote:
Hello Alan,
Yes, according to the documentation of the Juniper Gateway, the gateway should be able to understand the Radius attribute 8 "Framed-IP-Address" in the Access-Accept message, but it seems that it also need the attribute 88 " Framed-Pool".
This is described in "Concepts & Examples ScreenOS Reference Guide, User Authentication document", chapter "Framed Pool and Framed IP Address" page 26, http://www.juniper.net/techpubs/software/screenos/screenos6.3.0/630_ce_UserA...
And then the Gateway should be able to send this address in the IKEv2 configuration payload to the IPsec client (this ikev2 interface is already working with local address assignment in the gateway, we tested it).
So... send those attributes back in an Access-Accept. You don't need to configure IP Pools to return a bogus Framed-IP-Address. If that works, *then* you should consider configuring IP pools. Until then, you're 2-3 steps ahead of yourself. Alan DeKok.
participants (3)
-
Alan DeKok -
Groebl, Laurence (Laurence) -
Phil Mayers