3com problem with service-type
Hi guys, I have a lot of hp switches and a lot of 3com switches. I have users that I want them to have Administrator privilege and others that will have NAS-Prompt privilege. So, my users files should be like this, so it can work for both brands: userA Password = pass Service-Type = 7, 3Com-User-Access-Level = 1 userB Password = pass Service-Type = 6, 3Com-User-Access-Level = 3 The problem is that 3COM doesnt accept a service-type =7! It only accepts Service-Type = 6! So the 3COM rejects the access-accept from RADIUS for userA. I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address). Does anyone has a solution for my problem? Thanks, Nuno
Nuno Cervaens <Nuno.Cervaens@cern.ch> wrote:
I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address).
Use rlm_passwd. Put the NAS-IP-Address in one column, and the service-type in another. Didn't you ask this question before, and get a response? What was wrong with the previous solution? Alan DeKok.
Didn't you ask this question before, and get a response? What was wrong with the previous solution?
Hi Alan, This was your response some time ago: I don't think that will work. You're allowed ONE Service-Type in a response. You have to configure the server to send Service-Type = 6 for one NAS, and 7 for another. You will need two different entries in the "users" file. Alan DeKok. By doing this I should have in the users files for each user an account for every NAS. And I have a lot of switches and Routers, so thats why I didnt want to populate too much the users file. It didn't seemed too logic. Using huntgroups would look more logic to me. I'll try to use this matching in the huntgroup file proposed by Phil Mayers. Thanks guys, Nuno
I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address).
You should make your huntgroups match on more that just the NAS IP - e.g. switches NAS-IP-Address == a.b.c.d, Service-Type == Framed-User adminaccess NAS-IP-Address == a.b.c.d, Service-Type == Whatever
participants (3)
-
Alan DeKok -
Nuno Cervaens -
Phil Mayers