Assigning IP address from RADIUS to Cisco PPTP users
Hi: I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems. Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common vpdn-group 1 accept-dialin protocol pptp virtual-template 1 interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated! James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems.
Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS.
Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common
vpdn-group 1 accept-dialin protocol pptp virtual-template 1
interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly
interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated!
http://wiki.freeradius.org/index.php/FAQ#It_still_doesn.27t_work.21 Post the debug of the authentication attempt. Ivan Kalik Kalik Informatika ISP
On Tue, 26 May 2009, Ivan Kalik wrote:
I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems.
Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS.
Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common
vpdn-group 1 accept-dialin protocol pptp virtual-template 1
interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly
interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated!
http://wiki.freeradius.org/index.php/FAQ#It_still_doesn.27t_work.21
Post the debug of the authentication attempt.
Ivan Kalik Kalik Informatika ISP
Hi Ivan: Here it is...I including startup stuff as well: FreeRADIUS Version 2.0.4, for host i686-pc-linux-gnu, built on Jun 4 2008 at 11:29:00 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/etc/raddb/radiusd.conf including configuration file /usr/etc/raddb/clients.conf including configuration file /usr/etc/raddb/eap.conf including configuration file /usr/etc/raddb/policy.conf including files in directory /usr/etc/raddb/sites-enabled/ including configuration file /usr/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/etc/raddb/sites-enabled/default including dictionary file /usr/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/usr/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/var/run/radiusd/radiusd.pid" user = "root" group = "wheel" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "some_secret" nastype = "other" } client 216.1.12.66 { require_message_authenticator = no secret = "another_secret" shortname = "cisco_pptp" nastype = "cisco" } client 192.168.3.36 { require_message_authenticator = no secret = "yet_another" shortname = "s036" nastype = "other" } client 216.1.12.74 { require_message_authenticator = no secret = "one_more_secret" shortname = "utopia" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/etc/raddb/certs/server.pem" certificate_file = "/usr/etc/raddb/certs/server.pem" CA_file = "/usr/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/etc/raddb/certs/dh" random_file = "/usr/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/etc/raddb/users" acctusersfile = "/usr/etc/raddb/acct_users" preproxy_usersfile = "/usr/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/etc/raddb/huntgroups" hints = "/usr/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. Framed-Protocol = PPP User-Name = "testuser" User-Password = "some_password" NAS-Port-Type = Virtual NAS-Port = 62 NAS-Port-Id = "Uniq-Sess-ID62" Service-Type = Framed-User NAS-IP-Address = 216.1.12.66 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry testuser at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "some_password" rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [testuser/some_password] (from client cisco_pptp port 62) +- entering group post-auth ++[exec] returns noop Framed-Protocol == PPP Framed-IP-Address = 172.16.1.2 Framed-IP-Netmask = 255.255.255.255 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 205 with timestamp +17 Ready to process requests. ----------- I'm not using realms, so I'm assuming that realms error is meaningless? James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
Hi! On Tue, May 26, 2009 at 11:34:41AM -0400, up@3.am wrote:
Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. [...] interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Drop this line
no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP
Cisco-AVPair = "ip:addr-pool=vpnpool" Add line above to the DEFAULT user entry. -- Vadim Ostranitsyn (Evil's Flowers, VO45-RIPE, VO15-RIPN) Tomsk Cellular Communications Ltd / Mobile TeleSystems OJSC Work phone: +7(3822)571072, mobile: 500595/+7(913)8200595.
On Wed, 27 May 2009, Vadim Ostranitsyn wrote:
Hi!
On Tue, May 26, 2009 at 11:34:41AM -0400, up@3.am wrote:
Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. [...] interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Drop this line
no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP
Cisco-AVPair = "ip:addr-pool=vpnpool"
Add line above to the DEFAULT user entry.
--
Hi Vadim: This looked promising, but when I remove that line from my Cisco config, I cannot log in at all. It just says that it cannot negotiate a ppp connection (Mac OS X) The debug on radius looks fine (I can supply that again if needed)). Here is the verbose logging from my Mac's /var/log/ppp.log: Tue May 26 23:21:13 2009 : PPTP connecting to server '10.2.2.2' (10.2.2.2) ... Tue May 26 23:21:13 2009 : PPTP connection established. Tue May 26 23:21:13 2009 : using link 0 Tue May 26 23:21:13 2009 : Using interface ppp0 Tue May 26 23:21:13 2009 : Connect: ppp0 <--> socket[34:17] Tue May 26 23:21:13 2009 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xc916 6b8c> <pcomp> <accomp>] Tue May 26 23:21:13 2009 : rcvd [LCP ConfReq id=0x1 <auth pap> <magic 0x3f29a7d2
] Tue May 26 23:21:13 2009 : lcp_reqci: returning CONFACK. Tue May 26 23:21:13 2009 : sent [LCP ConfAck id=0x1 <auth pap> <magic 0x3f29a7d2 ] Tue May 26 23:21:13 2009 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xc916 6b8c> <pcomp> <accomp>] Tue May 26 23:21:13 2009 : sent [LCP EchoReq id=0x0 magic=0xc9166b8c] Tue May 26 23:21:13 2009 : sent [PAP AuthReq id=0x1 user="testuser" password=< hidden>] Tue May 26 23:21:13 2009 : rcvd [LCP EchoRep id=0x0 magic=0x3f29a7d2] Tue May 26 23:21:13 2009 : rcvd [PAP AuthAck id=0x1 ""] Tue May 26 23:21:13 2009 : PAP authentication succeeded Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0 .0.0> <ms-dns3 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPV6CP ConfReq id=0x1 <addr fe80::021e:c2ff:feb 5:8003>] Tue May 26 23:21:13 2009 : sent [ACSCP] 01 01 00 10 01 06 00 00 00 01 02 06 00 0 0 00 01 Tue May 26 23:21:13 2009 : rcvd [IPCP ConfReq id=0x1 <addr 192.168.7.1>] Tue May 26 23:21:13 2009 : ipcp: returning Configure-ACK Tue May 26 23:21:13 2009 : sent [IPCP ConfAck id=0x1 <addr 192.168.7.1>] Tue May 26 23:21:13 2009 : rcvd [CCP ConfReq id=0x1] Tue May 26 23:21:13 2009 : Unsupported protocol 'Compression Control Protocol' ( 0x80fd) received Tue May 26 23:21:13 2009 : sent [LCP ProtRej id=0x2 80 fd 01 01 00 04] Tue May 26 23:21:13 2009 : rcvd [LCP ProtRej id=0x2 80 57 01 01 00 0e 01 0a 02 1 e c2 ff fe b5 80 03] Tue May 26 23:21:13 2009 : rcvd [LCP ProtRej id=0x3 82 35 01 01 00 10 01 06 00 0 0 00 01 02 06 00 00 00 01] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x1 <addr 0.0.0.0> <ms-dns3 0.0 .0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x2 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x2 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x3 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x3 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x4 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x4 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x5 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x5 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x6 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x6 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x7 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x7 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x8 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x8 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x9 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x9 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xa <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xa <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xb <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xb <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xc <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xc <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xd <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xd <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xe <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xe <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xf <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xf <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : IPCP: Maximum Config-Requests exceeded Tue May 26 23:21:13 2009 : sent [LCP TermReq id=0x3 "No network protocols runnin g"] Tue May 26 23:21:14 2009 : rcvd [LCP TermAck id=0x3] Tue May 26 23:21:14 2009 : Connection terminated. Tue May 26 23:21:14 2009 : PPTP disconnecting... Tue May 26 23:21:14 2009 : PPTP disconnected
When I put 'peer default ip address pool vpnpool' back in the Cisco config, it works again: Tue May 26 23:26:48 2009 : PPTP connecting to server '10.2.2.2' (10.2.2.2) ... Tue May 26 23:26:48 2009 : PPTP connection established. Tue May 26 23:26:48 2009 : using link 0 Tue May 26 23:26:48 2009 : Using interface ppp0 Tue May 26 23:26:48 2009 : Connect: ppp0 <--> socket[34:17] Tue May 26 23:26:48 2009 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x3b8a 3df8> <pcomp> <accomp>] Tue May 26 23:26:48 2009 : rcvd [LCP ConfReq id=0x1 <auth pap> <magic 0x3f2ec37a
] Tue May 26 23:26:48 2009 : lcp_reqci: returning CONFACK. Tue May 26 23:26:48 2009 : sent [LCP ConfAck id=0x1 <auth pap> <magic 0x3f2ec37a>] Tue May 26 23:26:48 2009 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x3b8a 3df8> <pcomp> <accomp>] Tue May 26 23:26:48 2009 : sent [LCP EchoReq id=0x0 magic=0x3b8a3df8] Tue May 26 23:26:48 2009 : sent [PAP AuthReq id=0x1 user="testuser" password=<hidden>] Tue May 26 23:26:48 2009 : rcvd [LCP EchoRep id=0x0 magic=0x3f2ec37a] Tue May 26 23:26:48 2009 : rcvd [PAP AuthAck id=0x1 ""] Tue May 26 23:26:48 2009 : PAP authentication succeeded Tue May 26 23:26:48 2009 : sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>] Tue May 26 23:26:48 2009 : sent [IPV6CP ConfReq id=0x1 <addr fe80::021e:c2ff:feb5:8003>] Tue May 26 23:26:48 2009 : sent [ACSCP] 01 01 00 10 01 06 00 00 00 01 02 06 00 0 0 00 01 Tue May 26 23:26:48 2009 : rcvd [IPCP ConfReq id=0x1 <addr 192.168.7.1>] Tue May 26 23:26:48 2009 : ipcp: returning Configure-ACK Tue May 26 23:26:48 2009 : sent [IPCP ConfAck id=0x1 <addr 192.168.7.1>] Tue May 26 23:26:48 2009 : rcvd [CCP ConfReq id=0x1] Tue May 26 23:26:48 2009 : Unsupported protocol 'Compression Control Protocol' (0x80fd) received Tue May 26 23:26:48 2009 : sent [LCP ProtRej id=0x2 80 fd 01 01 00 04] Tue May 26 23:26:48 2009 : rcvd [LCP ProtRej id=0x2 80 57 01 01 00 0e 01 0a 02 1 e c2 ff fe b5 80 03] Tue May 26 23:26:48 2009 : rcvd [LCP ProtRej id=0x3 82 35 01 01 00 10 01 06 00 0 0 00 01 02 06 00 00 00 01] Tue May 26 23:26:48 2009 : rcvd [IPCP ConfRej id=0x1 <ms-dns3 0.0.0.0>] Tue May 26 23:26:48 2009 : sent [IPCP ConfReq id=0x2 <addr 0.0.0.0> <ms-dns1 0.0 .0.0>] Tue May 26 23:26:48 2009 : rcvd [IPCP ConfNak id=0x2 <addr 172.16.30.9> <ms-dns1 10.2.2.2>] Tue May 26 23:26:48 2009 : sent [IPCP ConfReq id=0x3 <addr 172.16.30.9> <ms-dns1 10.2.2.2>] Tue May 26 23:26:48 2009 : rcvd [IPCP ConfAck id=0x3 <addr 172.16.30.9> <ms-dns1 10.2.2.2>] Tue May 26 23:26:48 2009 : ipcp: up Tue May 26 23:26:48 2009 : local IP address 172.16.30.9 Tue May 26 23:26:48 2009 : remote IP address 192.168.7.1 Tue May 26 23:26:48 2009 : primary DNS address 10.1.1.1 Tue May 26 23:26:48 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:26:51 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:26:54 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:26:57 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:27:00 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameters = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:27:03 2009 : No DHCP server replied
James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
FYI: Cisco TAC quickly found my config problem. I took out: aaa authorization network default if-authenticated and replaced it with: aaa authorization network default group radius local and that did it. Thanks for all of your suggestions! Next up is to start defining pools and associating unix groups with them. On Tue, 26 May 2009, up@3.am wrote:
On Wed, 27 May 2009, Vadim Ostranitsyn wrote:
Hi!
On Tue, May 26, 2009 at 11:34:41AM -0400, up@3.am wrote:
Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. [...] interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Drop this line
no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP
Cisco-AVPair = "ip:addr-pool=vpnpool"
Add line above to the DEFAULT user entry.
--
Hi Vadim:
This looked promising, but when I remove that line from my Cisco config, I cannot log in at all. It just says that it cannot negotiate a ppp connection (Mac OS X) The debug on radius looks fine (I can supply that again if needed)). Here is the verbose logging from my Mac's /var/log/ppp.log:
Tue May 26 23:21:13 2009 : PPTP connecting to server '10.2.2.2' (10.2.2.2) ... Tue May 26 23:21:13 2009 : PPTP connection established. Tue May 26 23:21:13 2009 : using link 0 Tue May 26 23:21:13 2009 : Using interface ppp0 Tue May 26 23:21:13 2009 : Connect: ppp0 <--> socket[34:17] Tue May 26 23:21:13 2009 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xc916 6b8c> <pcomp> <accomp>] Tue May 26 23:21:13 2009 : rcvd [LCP ConfReq id=0x1 <auth pap> <magic 0x3f29a7d2
] Tue May 26 23:21:13 2009 : lcp_reqci: returning CONFACK. Tue May 26 23:21:13 2009 : sent [LCP ConfAck id=0x1 <auth pap> <magic 0x3f29a7d2 ] Tue May 26 23:21:13 2009 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xc916 6b8c> <pcomp> <accomp>] Tue May 26 23:21:13 2009 : sent [LCP EchoReq id=0x0 magic=0xc9166b8c] Tue May 26 23:21:13 2009 : sent [PAP AuthReq id=0x1 user="testuser" password=< hidden>] Tue May 26 23:21:13 2009 : rcvd [LCP EchoRep id=0x0 magic=0x3f29a7d2] Tue May 26 23:21:13 2009 : rcvd [PAP AuthAck id=0x1 ""] Tue May 26 23:21:13 2009 : PAP authentication succeeded Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0 .0.0> <ms-dns3 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPV6CP ConfReq id=0x1 <addr fe80::021e:c2ff:feb 5:8003>] Tue May 26 23:21:13 2009 : sent [ACSCP] 01 01 00 10 01 06 00 00 00 01 02 06 00 0 0 00 01 Tue May 26 23:21:13 2009 : rcvd [IPCP ConfReq id=0x1 <addr 192.168.7.1>] Tue May 26 23:21:13 2009 : ipcp: returning Configure-ACK Tue May 26 23:21:13 2009 : sent [IPCP ConfAck id=0x1 <addr 192.168.7.1>] Tue May 26 23:21:13 2009 : rcvd [CCP ConfReq id=0x1] Tue May 26 23:21:13 2009 : Unsupported protocol 'Compression Control Protocol' ( 0x80fd) received Tue May 26 23:21:13 2009 : sent [LCP ProtRej id=0x2 80 fd 01 01 00 04] Tue May 26 23:21:13 2009 : rcvd [LCP ProtRej id=0x2 80 57 01 01 00 0e 01 0a 02 1 e c2 ff fe b5 80 03] Tue May 26 23:21:13 2009 : rcvd [LCP ProtRej id=0x3 82 35 01 01 00 10 01 06 00 0 0 00 01 02 06 00 00 00 01] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x1 <addr 0.0.0.0> <ms-dns3 0.0 .0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x2 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x2 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x3 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x3 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x4 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x4 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x5 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x5 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x6 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x6 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x7 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x7 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x8 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x8 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0x9 <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0x9 <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xa <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xa <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xb <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xb <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xc <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xc <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xd <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xd <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xe <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xe <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : sent [IPCP ConfReq id=0xf <addrs 0.0.0.0 0.0.0.0> <ms -dns1 0.0.0.0>] Tue May 26 23:21:13 2009 : rcvd [IPCP ConfRej id=0xf <addrs 0.0.0.0 0.0.0.0>] Tue May 26 23:21:13 2009 : IPCP: Maximum Config-Requests exceeded Tue May 26 23:21:13 2009 : sent [LCP TermReq id=0x3 "No network protocols runnin g"] Tue May 26 23:21:14 2009 : rcvd [LCP TermAck id=0x3] Tue May 26 23:21:14 2009 : Connection terminated. Tue May 26 23:21:14 2009 : PPTP disconnecting... Tue May 26 23:21:14 2009 : PPTP disconnected
When I put 'peer default ip address pool vpnpool' back in the Cisco config, it works again:
Tue May 26 23:26:48 2009 : PPTP connecting to server '10.2.2.2' (10.2.2.2) ... Tue May 26 23:26:48 2009 : PPTP connection established. Tue May 26 23:26:48 2009 : using link 0 Tue May 26 23:26:48 2009 : Using interface ppp0 Tue May 26 23:26:48 2009 : Connect: ppp0 <--> socket[34:17] Tue May 26 23:26:48 2009 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x3b8a 3df8> <pcomp> <accomp>] Tue May 26 23:26:48 2009 : rcvd [LCP ConfReq id=0x1 <auth pap> <magic 0x3f2ec37a
] Tue May 26 23:26:48 2009 : lcp_reqci: returning CONFACK. Tue May 26 23:26:48 2009 : sent [LCP ConfAck id=0x1 <auth pap> <magic 0x3f2ec37a>] Tue May 26 23:26:48 2009 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x3b8a 3df8> <pcomp> <accomp>] Tue May 26 23:26:48 2009 : sent [LCP EchoReq id=0x0 magic=0x3b8a3df8] Tue May 26 23:26:48 2009 : sent [PAP AuthReq id=0x1 user="testuser" password=<hidden>] Tue May 26 23:26:48 2009 : rcvd [LCP EchoRep id=0x0 magic=0x3f2ec37a] Tue May 26 23:26:48 2009 : rcvd [PAP AuthAck id=0x1 ""] Tue May 26 23:26:48 2009 : PAP authentication succeeded Tue May 26 23:26:48 2009 : sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>] Tue May 26 23:26:48 2009 : sent [IPV6CP ConfReq id=0x1 <addr fe80::021e:c2ff:feb5:8003>] Tue May 26 23:26:48 2009 : sent [ACSCP] 01 01 00 10 01 06 00 00 00 01 02 06 00 0 0 00 01 Tue May 26 23:26:48 2009 : rcvd [IPCP ConfReq id=0x1 <addr 192.168.7.1>] Tue May 26 23:26:48 2009 : ipcp: returning Configure-ACK Tue May 26 23:26:48 2009 : sent [IPCP ConfAck id=0x1 <addr 192.168.7.1>] Tue May 26 23:26:48 2009 : rcvd [CCP ConfReq id=0x1] Tue May 26 23:26:48 2009 : Unsupported protocol 'Compression Control Protocol' (0x80fd) received Tue May 26 23:26:48 2009 : sent [LCP ProtRej id=0x2 80 fd 01 01 00 04] Tue May 26 23:26:48 2009 : rcvd [LCP ProtRej id=0x2 80 57 01 01 00 0e 01 0a 02 1 e c2 ff fe b5 80 03] Tue May 26 23:26:48 2009 : rcvd [LCP ProtRej id=0x3 82 35 01 01 00 10 01 06 00 0 0 00 01 02 06 00 00 00 01] Tue May 26 23:26:48 2009 : rcvd [IPCP ConfRej id=0x1 <ms-dns3 0.0.0.0>] Tue May 26 23:26:48 2009 : sent [IPCP ConfReq id=0x2 <addr 0.0.0.0> <ms-dns1 0.0 .0.0>] Tue May 26 23:26:48 2009 : rcvd [IPCP ConfNak id=0x2 <addr 172.16.30.9> <ms-dns1 10.2.2.2>] Tue May 26 23:26:48 2009 : sent [IPCP ConfReq id=0x3 <addr 172.16.30.9> <ms-dns1 10.2.2.2>] Tue May 26 23:26:48 2009 : rcvd [IPCP ConfAck id=0x3 <addr 172.16.30.9> <ms-dns1 10.2.2.2>] Tue May 26 23:26:48 2009 : ipcp: up Tue May 26 23:26:48 2009 : local IP address 172.16.30.9 Tue May 26 23:26:48 2009 : remote IP address 192.168.7.1 Tue May 26 23:26:48 2009 : primary DNS address 10.1.1.1 Tue May 26 23:26:48 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:26:51 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:26:54 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:26:57 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameter s = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:27:00 2009 : sent [IP data <src addr 172.16.30.9> <dst addr 255.25 5.255.255> <BOOTP Request> <type INFORM> <client id 0x08000000010000> <parameters = 0x6 0x2c 0x2b 0x1 0xf9 0xf>] Tue May 26 23:27:03 2009 : No DHCP server replied
James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am ========================================================================= - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
participants (3)
-
Ivan Kalik -
up@3.am -
Vadim Ostranitsyn