DEFAULT policy order in Users file
Hi I have at the end of Users file two DEFAULTS statements: DEFAULT Auth-Type := ntlm_auth_vpn_comp NAS-IP-Address == 10.1.1.1, Service-Type = Framed-User, Framed-Protocol = PPP, DEFAULT Auth-Type := vpn_auth_name Service-Type = Framed-User, Framed-Protocol = PPP, So it means, when access request comes from the address 10.1.1.1 use authentication type ntlm_auth_vpn_comp. If access request comes from the other address use Auth-Type vpn_auth_name which is default for everybody The point is that I have more VPN gates and I can decide which authentication will be used for them However it doesn't work, cause every request match only the first DEFAULT statement, despite of that it comes from different NAS-IP-Address then 10.1.1.1 Do you know why it is happen ? Thanks pet
Hi,
However it doesn’t work, cause every request match only the first DEFAULT statement, despite of that it comes from different NAS-IP-Address then 10.1.1.1
Do you know why it is happen ?
because, as documented, your MATCH statement must all be on the first line. the second line onwards is for REPLY attributes! DEFAULT Auth-Type := ntlm_auth_vpn_comp, NAS-IP-Address == 10.1.1.1 Service-Type = Framed-User, Framed-Protocol = PPP alan
However it doesn’t work, cause every request match only the first DEFAULT statement, despite of that it comes from different NAS-IP-Address then 10.1.1.1
Do you know why it is happen ?
because, as documented, your MATCH statement must all be on the first line. the second line onwards is for REPLY attributes! DEFAULT Auth-Type := ntlm_auth_vpn_comp, NAS-IP-Address == 10.1.1.1 Service-Type = Framed-User, Framed-Protocol = PPP alan - Hi Alan Thank you, that works pet
Jevos, Peter wrote:
DEFAULT Auth-Type := ntlm_auth_vpn_comp NAS-IP-Address == 10.1.1.1, Service-Type = Framed-User, Framed-Protocol = PPP, ... So it means, when access request comes from the address 10.1.1.1 use authentication type ntlm_auth_vpn_comp.
No, it doesn't mean that. See the documentation "man users", and the comments in raddb/users.
However it doesn’t work, cause every request match only the first DEFAULT statement, despite of that it comes from different NAS-IP-Address then 10.1.1.1
Do you know why it is happen ?
You didn't configure the "users" file correctly. This is documented. Alan DeKok.
participants (3)
-
Alan Buxey -
Alan DeKok -
Jevos, Peter