Freeradius reply package forward
I use Freeradius auth with LDAP. Freeradius server send "reply" to client. It's OK. But i want to below package send (forward) another IP address (fortigate firewall). Sending Access-Accept of id 79 to 17.16.10.20 port 46695 Reply-Message = "test string" Service-Type = Framed-User Framed-Protocol = PPP Class = 0x73657669796532 Framed-IP-Address = 17.16.1.101 User-Name = "test12345" Tunnel-Type:0 = VLAN In example i want forward to 17.16.10.1
On Aug 3, 2016, at 12:59 PM, Ali Orhun Akkirman <the.alorak@gmail.com> wrote:
I use Freeradius auth with LDAP. Freeradius server send "reply" to client. It's OK. But i want to below package send (forward) another IP address (fortigate firewall).
Read raddb/proxy.conf. This is documented. Alan DeKok.
Freeradius proxied account package with UserName and various attribute. But it doesn't sent LDAP attributes on PAP(reply or Access-Accept package) auth to another IP adress. On Wed, Aug 3, 2016 at 8:13 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 3, 2016, at 12:59 PM, Ali Orhun Akkirman <the.alorak@gmail.com> wrote:
I use Freeradius auth with LDAP. Freeradius server send "reply" to client. It's OK. But i want to below package send (forward) another IP address (fortigate firewall).
Read raddb/proxy.conf.
This is documented.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ali Orhun Akkirman
On Aug 4, 2016, at 7:13 AM, Ali Orhun Akkirman <the.alorak@gmail.com> wrote:
Freeradius proxied account package with UserName and various attribute. But it doesn't sent LDAP attributes on PAP(reply or Access-Accept package) auth to another IP adress.
The LDAP attributes cannot be put into a RADIUS packet. Perhaps you could explain what your goal is. i.e. talk about the problem you're trying to solve, instead of asking why your solution doesn't work. There are often alternate solutions which work. Alan DeKok.
I have configured Freeradius with LDAP authentication. Freeradius client able to login with LDAP username and password. I'm able to get various attribute to client from Freeradius LDAP module (raddb/module/ldap) and attrmap file (raddb/ldap.attrmap). This reply message to client from Radius Server. When I turn on the proxy configuration, Freeradius can't send reply message"Access-Accept". It sent only "Access-Request" package. I want Freeradius sent reply message to another IP adress. On Thu, Aug 4, 2016 at 10:18 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 4, 2016, at 7:13 AM, Ali Orhun Akkirman <the.alorak@gmail.com> wrote:
Freeradius proxied account package with UserName and various attribute.
But
it doesn't sent LDAP attributes on PAP(reply or Access-Accept package) auth to another IP adress.
The LDAP attributes cannot be put into a RADIUS packet.
Perhaps you could explain what your goal is. i.e. talk about the problem you're trying to solve, instead of asking why your solution doesn't work.
There are often alternate solutions which work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ali Orhun Akkirman
I want to configure SSO integration. https://stuff.purdon.ca/?page_id=354 On Thu, Aug 4, 2016 at 10:18 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 4, 2016, at 7:13 AM, Ali Orhun Akkirman <the.alorak@gmail.com> wrote:
Freeradius proxied account package with UserName and various attribute.
But
it doesn't sent LDAP attributes on PAP(reply or Access-Accept package) auth to another IP adress.
The LDAP attributes cannot be put into a RADIUS packet.
Perhaps you could explain what your goal is. i.e. talk about the problem you're trying to solve, instead of asking why your solution doesn't work.
There are often alternate solutions which work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ali Orhun Akkirman
On Thu, Aug 04, 2016 at 10:36:07AM +0300, Ali Orhun Akkirman wrote:
When I turn on the proxy configuration, Freeradius can't send reply message"Access-Accept". It sent only "Access-Request" package. I want Freeradius sent reply message to another IP adress.
Yes, of course. FreeRADIUS talks back to the RADIUS client that talked to it, not some other random address. On Thu, Aug 04, 2016 at 10:56:05AM +0300, Ali Orhun Akkirman wrote:
I want to configure SSO integration.
Read the first paragraph of that again. Your NAS should apparently be configured to use your FreeRADIUS server for authentication, but your firewall for accounting. Or just proxy the accounting packets through to the firewall, I guess. Which would give you more flexibility in what's sent to the firewall. But trying to send reply packets back to somewhere the request didn't come from is just plain wrong. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Can Freeradius sent reply packages to firewall IP as Accounting Package? Because only reply packages have LDAP attributes. Can I find a different method? On Thu, Aug 4, 2016 at 12:08 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Aug 04, 2016 at 10:36:07AM +0300, Ali Orhun Akkirman wrote:
When I turn on the proxy configuration, Freeradius can't send reply message"Access-Accept". It sent only "Access-Request" package. I want Freeradius sent reply message to another IP adress.
Yes, of course. FreeRADIUS talks back to the RADIUS client that talked to it, not some other random address.
On Thu, Aug 04, 2016 at 10:56:05AM +0300, Ali Orhun Akkirman wrote:
I want to configure SSO integration.
Read the first paragraph of that again. Your NAS should apparently be configured to use your FreeRADIUS server for authentication, but your firewall for accounting.
Or just proxy the accounting packets through to the firewall, I guess. Which would give you more flexibility in what's sent to the firewall.
But trying to send reply packets back to somewhere the request didn't come from is just plain wrong.
Matthew
-- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ali Orhun Akkirman
On Thu, Aug 04, 2016 at 12:35:10PM +0300, Ali Orhun Akkirman wrote:
Can Freeradius sent reply packages to firewall IP as Accounting Package? Because only reply packages have LDAP attributes. Can I find a different method?
As I said before, read the web page you mentioned. "The access point (NAS) sends access requests directly to the radius server but sends accounting requests to the Fortigate." Accounting *requests*. Just set up proxying for accounting packets, and send the accounting requests to the firewall. You can add any LDAP data to the request before it is proxied. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thank you for this information. How do i add "radiusFramedIpAddress" attribute value with replyItem in file of ldap.attrmap to account request package? On Thu, Aug 4, 2016 at 12:50 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Aug 04, 2016 at 12:35:10PM +0300, Ali Orhun Akkirman wrote:
Can Freeradius sent reply packages to firewall IP as Accounting Package? Because only reply packages have LDAP attributes. Can I find a different method?
As I said before, read the web page you mentioned.
"The access point (NAS) sends access requests directly to the radius server but sends accounting requests to the Fortigate."
Accounting *requests*.
Just set up proxying for accounting packets, and send the accounting requests to the firewall. You can add any LDAP data to the request before it is proxied.
Matthew
-- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ali Orhun Akkirman
participants (3)
-
Alan DeKok -
Ali Orhun Akkirman -
Matthew Newton