Proxying based on AVPair (multiple SSIDs)
I'm running multiple access points with multiple SSIDs on each access point. We have some groups that want to run their own RADIUS authentication, and we need to proxy their requests. Cisco access points have radius servers configured only by device not by SSID, so I need another way to figure out which SSID the client connected with. Our certificates don't include an @ sign in the username, nor do I know what authentication method the other groups will use. The only other method I can think of to proxy off of other than realms would be a Cisco AVPair, which is already being sent to the radius server. There is one called SSID, which contains exactly the information I'd like the proxy to forward based on. Anybody know if this is possible with freeradius or another software? If so, any configuration file contents I would need to set this up. Thanks, Jason
Jason Carr <jcarr@andrew.cmu.edu> wrote:
I'm running multiple access points with multiple SSIDs on each access point. We have some groups that want to run their own RADIUS authentication, and we need to proxy their requests. Cisco access points have radius servers configured only by device not by SSID, so I need another way to figure out which SSID the client connected with.
It *may* be in the Access-Request, in a Calling-Station-Id.
The only other method I can think of to proxy off of other than realms would be a Cisco AVPair, which is already being sent to the radius server. There is one called SSID, which contains exactly the information I'd like the proxy to forward based on.
So use that. Use regular expressions to match it. Alan DeKok.
Calling-Station-Id has the MAC address of the access point's SSID which I'd have to collect the list of MACs, too many to filter on. I like the second method but I'm not seeing any documentation on matching based on regular expressions with AVP's. Can you point to a config file that I should be looking in or maybe some doc online? I searched almost all day for something on google. - Jason On Fri, 2005-11-04 at 16:09 -0500, Alan DeKok wrote:
Jason Carr <jcarr@andrew.cmu.edu> wrote:
I'm running multiple access points with multiple SSIDs on each access point. We have some groups that want to run their own RADIUS authentication, and we need to proxy their requests. Cisco access points have radius servers configured only by device not by SSID, so I need another way to figure out which SSID the client connected with.
It *may* be in the Access-Request, in a Calling-Station-Id.
The only other method I can think of to proxy off of other than realms would be a Cisco AVPair, which is already being sent to the radius server. There is one called SSID, which contains exactly the information I'd like the proxy to forward based on.
So use that. Use regular expressions to match it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jason Carr <jcarr@andrew.cmu.edu> wrote:
Calling-Station-Id has the MAC address of the access point's SSID which I'd have to collect the list of MACs, too many to filter on. I like the second method but I'm not seeing any documentation on matching based on regular expressions with AVP's. Can you point to a config file that I should be looking in or maybe some doc online? I searched almost all day for something on google.
"man users". DEFAULT Attribute =~ "a.*b$", ... ... Alan DeKok.
Hi, there is no attribute in the Request you can match on :( We do EAP and at least there is no and i found now way to add one. But there is a way to configure different radius servers per ssid :) You "just" ;) need to specifiy different Radius Server groups. The real order in the config is different and if have written this down from my head so it could well be that there are misstakes. Start and configure your radius servers as usual. radius-server host 10.10.10.1 auth-port 1812 acct-port 1813 key 0 verysecret radius-server host 10.10.10.2 auth-port 1812 acct-port 1813 key 0 verysecret radius-server host 10.10.20.1 auth-port 1812 acct-port 1813 key 0 verysecret radius-server host 10.10.20.1 auth-port 1812 acct-port 1813 key 0 verysecret Then put them into 2 groups: aaa group server radius groupname1 server 10.10.10.1 auth-port 1812 acct-port 1813 server 10.10.10.2 auth-port 1812 acct-port 1813 aaa group server radius groupname2 server 10.10.20.1 auth-port 1812 acct-port 1813 server 10.10.20.2 auth-port 1812 acct-port 1813 Now form 2 login methods. aaa authentication login method_client_group1 group groupname1 aaa authentication login method_client_group2 group groupname2 Now you can go into the SSID config depending on ISO version within the Dot11 interface or bevor but i guess you will be able to find out wourself. Here you reference the login method configured above. ssid Uunet vlan 123 authentication open eap method_client_group1 accounting method_client_group1 ssid UUnet2 vlan 234 authentication open eap method_client_group2 accounting method_client_group2 Off course there is more to have the AP configured properly. If you had them running and used radius bevor i thing you can guess what needs to be done. If you use the Cisco WDS then only teh WDS Aps/Routers/Switch will talk to you radius so the other Radius Servers just need this Ips in there Clients files. If this is no option i would say run multiple instance of your Freeradius Proxy on once Server on different ports and then proxy from them. Have a nice game :) Bye Holger
-----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Saturday, November 05, 2005 4:29 PM To: FreeRadius users mailing list Subject: Re: Proxying based on AVPair (multiple SSIDs)
Jason Carr <jcarr@andrew.cmu.edu> wrote:
Calling-Station-Id has the MAC address of the access point's SSID which I'd have to collect the list of MACs, too many to filter on. I like the second method but I'm not seeing any documentation on matching based on regular expressions with AVP's. Can you point to a config file that I should be looking in or maybe some doc online? I searched almost all day for something on google.
"man users".
DEFAULT Attribute =~ "a.*b$", ... ...
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Holger Steppke -
Jason Carr