VSA byte issue with Redback attribute
Hi all, I have a problem with a FreeRadius server. The guys at the other side says that the reply coming from my server is not correct. Have somebody any idea how to solve this : Maybe I have added the Redback subscriber attribute at the wrong place in the redback dictionary ? I checked the 'Access-Accept' packet coming from the Radius server. The byte that identifies the 'subscriber-profile-name' VSA is incorrect. Jul 8 16:29:32: [0014]: [4/3:1:63/2/2/66258]: %AAA-7-RAD_PKT: aaa_idx 10c3bdca: Received packet (55 bytes) from xx.xx.xx.xx/1812 (f111111@XXXX <mailto:1@x>): 0 02 43 00 37 57 50 fe a1 5a 29 0c 10 c0 34 83 1f 16 e7 cb 53 b8 1a 11 00 00 09 30 *98* 0b 66 6f 72 74 32 65 70 6c 75 73 06 06 00 00 00 02 07 06 00 00 00 48 01 08 06 ff ff ff fe It's sending back 'forteplus', however, the VSA byte (98) is incorrect. It should be '5b' (decimal 91). 66 6f 72 74 65 70 6c 75 73 f o r t e p l u s Have them correct the Radius server. Thank you for your help. Thomas
Thomas LAVIGNE wrote:
I have a problem with a FreeRadius server. The guys at the other side says that the reply coming from my server is not correct. Have somebody any idea how to solve this :
Change the configuration on your server to send the correct reply?
Maybe I have added the Redback subscriber attribute at the wrong place in the redback dictionary ?
So you edited the dictionary? Why?
I checked the 'Access-Accept' packet coming from the Radius server. The byte that identifies the 'subscriber-profile-name' VSA is incorrect.
..
It's sending back 'forteplus', however, the VSA byte (98) is incorrect. It should be '5b' (decimal 91).
The default dictionary.redback has the subscriber profile attribute as 91. Perhaps you shouldn't be editing the dictionary files? Alan DeKok.
Hi, First, thanks Alan for your super quick response. I edited the dictionary because they want that the reply exactly match this string "Redback-Subscriber-Profile-Name" The Attribute 91 is present on the first part of the dictionary as "Red-Profile-name" and is not on the second part "new name". So I added it at the end of the list : ATTRIBUTE Redback-Subscriber-Profile-Name 152 string So maybe with attribute number 91 it will work better ? Sorry but i'm not yet very familiar with FreeRadius. Thanks a lot. Thomas Alan DeKok a écrit :
Thomas LAVIGNE wrote:
I have a problem with a FreeRadius server. The guys at the other side says that the reply coming from my server is not correct. Have somebody any idea how to solve this :
Change the configuration on your server to send the correct reply?
Maybe I have added the Redback subscriber attribute at the wrong place in the redback dictionary ?
So you edited the dictionary? Why?
I checked the 'Access-Accept' packet coming from the Radius server. The byte that identifies the 'subscriber-profile-name' VSA is incorrect.
..
It's sending back 'forteplus', however, the VSA byte (98) is incorrect. It should be '5b' (decimal 91).
The default dictionary.redback has the subscriber profile attribute as 91.
Perhaps you shouldn't be editing the dictionary files?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I edited the dictionary because they want that the reply exactly match this string "Redback-Subscriber-Profile-Name"
VSAs are sent encoded as attribute number not their names (so "matching that string" doesn't make sense). You can rename the attribute, let's say 91, in your server's dictionary to Pretender and return attribute Pretender in the reply. Once it reaches the client it will be decoded to what attribute name is for 91 in client's dictionary.
The Attribute 91 is present on the first part of the dictionary as "Red-Profile-name"
It's Sub-Profile-Name in 2.0.5 dictionary.
So I added it at the end of the list : ATTRIBUTE Redback-Subscriber-Profile-Name 152 string
That's not going to work. Client will not be able to decode that entry. It will not have attribute 152 in it's dictionary.
So maybe with attribute number 91 it will work better ?
Yes. You don't need to bother with renaming it. Just return the attribute name that is in the dictionary for attribute 91. Ivan Kalik Kalik Informatika ISP
Thomas LAVIGNE wrote:
I edited the dictionary because they want that the reply exactly match this string "Redback-Subscriber-Profile-Name"
No. The names are local, and aren't sent in the packet.
The Attribute 91 is present on the first part of the dictionary as "Red-Profile-name" and is not on the second part "new name".
It's "Sub-Profile-Name", and it's the attribute you want to use.
So I added it at the end of the list : ATTRIBUTE Redback-Subscriber-Profile-Name 152 string
And invented a number for it?
So maybe with attribute number 91 it will work better ?
Use "Sub-Profile-Name". There is NO need to edit the dictionary.
Sorry but i'm not yet very familiar with FreeRadius.
Don't edit the dictionaries if you don't know what they do. Alan DeKok.
participants (3)
-
Alan DeKok -
Thomas LAVIGNE -
tnt＠kalik.net