Hi Thomas, I am trying to use freeradius as AAA server with ASNGW to authenticate WiMAX device. Would you be kind enough to provide details on how to configure freeradius for this? I saw that you were successful in getting it working and did not want to reinvent the wheels. Thanks a lot in advance.. Jayanth Thomas Fagart wrote:
Hello,
First thanks again for this new release that adds very interesting features for debug, specially raddebug and radmin.
Using basic setup, Freeradius successfully authenticate request coming from CPE Wimax through ASN Alcatel GW (called WAC) using EAP/TTLS
Fri Apr 3 01:05:10 2009 : Auth: Login OK: [00210400E0D7@test.fr/<via Auth-Type = EAP>] (from client wimax port 0 cli 00-21-04-00-E0-D7) Fri Apr 3 01:05:19 2009 : Auth: Login OK: [cpe2-lab@test.fr/<via Auth-Type = mschap>] (from client wimax port 0 via TLS tunnel)
I now have 2 issues to fill properly the access accept with correct attribute. (This needs might be weird, but it is the way this ASN GW works)
1. I would like that the outer access accept contains attributes coming from the inner access accept
So I tried to use the update outer.reply on post-auth section of the inner-tunnel virtual server
update outer.reply { #User-Name = "%{request:User-Name}" WiMAX-Packet-Data-Flow-Id = "%{request:WiMAX-Packet-Data-Flow-Id}" }
But as I understand, you can only use "request" from the inner tunnel, but not the attribute contained in the reply of the inner tunnel. Is that true ? Is there a way to do that.
To be more precise this is the reply in the inner tunnel
Fri Apr 3 01:13:33 2009 Packet-Type = Access-Accept WiMAX-Packet-Data-Flow-Id = 1 WiMAX-Service-Data-Flow-Id = 1 WiMAX-Service-Profile-Id = 1 WiMAX-Direction = Bi-Directional WiMAX-QoS-Id = 1 WiMAX-Media-Flow-Type = Robust-Browser WiMAX-Schedule-Type = Best-Effort WiMAX-Traffic-Priority = 0 WiMAX-Maximum-Sustained-Traffic-Rate = 512000 MS-CHAP2-Success = 0xdf533d37443041423038393133393032414333353841304630414336383132453546434243364130323046 MS-MPPE-Recv-Key = 0x1d7c9b57392b589e2849640bad969199 MS-MPPE-Send-Key = 0x4aa107e5fa9573846af44d21c5080749 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006
and the one in the outer tunnel
Fri Apr 3 01:13:34 2009 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395 MS-MPPE-Send-Key = 0x009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b EAP-MSK = 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b EAP-EMSK = 0xc5f48626093f9313c5090254ffc375d4594bf6570025a260801e4b8d0ff852167d0748bd50b27d214b0ee67c1bbe1a4395faf094a8cb56663177fa8f32586f40 EAP-Message = 0x03f00004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00210400E0D7@test.fr"
I would like the reply of the outer tunnel to contain all the Wimax Attribute I got in the inner.
2. For some weird reason again, Alcatel ASN needs to receive two times the same attribute with differente value (Actually this WiMAX-QoS-Descriptor (TLV Attribute)) I guess this is not very compliant with RFC, but is there a way to send 2 times the same attribute in the same reply.
I've tried that but without surprise this send only the first part of the attribute
cpe2-lab@test.fr Cleartext-Password := "xxx" WiMAX-Packet-Data-Flow-Id=1, WiMAX-Service-Data-Flow-Id=1, WiMAX-Service-Profile-Id=1, WiMAX-Direction=Bi-Directional, WiMAX-QoS-Id=01, WiMAX-Media-Flow-Type=Robust-Browser, WiMAX-Schedule-Type=BEST-EFFORT, WiMAX-Traffic-Priority=0, WiMAX-Maximum-Sustained-Traffic-Rate=512000, WiMAX-QoS-Id=02, WiMAX-Media-Flow-Type=Robust-Browser, WiMAX-Schedule-Type=BEST-EFFORT, WiMAX-Traffic-Priority=0, WiMAX-Maximum-Sustained-Traffic-Rate=512000
Maybe using perl module in the post-auth ?
Thanks
Thomas Fagart
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/-Wimax-TTLS-with-Alcatel---Lucent-ASN-GW--tp22859070p2... Sent from the FreeRadius - User mailing list archive at Nabble.com.
I am trying to use freeradius as AAA server with ASNGW to authenticate WiMAX device. Would you be kind enough to provide details on how to configure freeradius for this? I saw that you were successful in getting it working and did not want to reinvent the wheels.
Read instructions in raddb/modules/wimax. His problems (using tunneled and multivalued attributes in the reply) had nothing to do with WiMAX. Solutions for copying attributes from the tunnel and adding multiple attributes with the same name to the reply apply to any attribute, not just those for WiMAX. Ivan Kalik Kalik Informatika ISP
On Sun, 26 Apr 2009 00:18:29 +0100 (BST), "Ivan Kalik" <tnt@kalik.net> wrote:
I am trying to use freeradius as AAA server with ASNGW to authenticate WiMAX device. Would you be kind enough to provide details on how to configure freeradius for this? I saw that you were successful in getting it working and did not want to reinvent the wheels.
Read instructions in raddb/modules/wimax. His problems (using tunneled and multivalued attributes in the reply) had nothing to do with WiMAX. Solutions for copying attributes from the tunnel and adding multiple attributes with the same name to the reply apply to any attribute, not just those for WiMAX.
That's completly right. We haven't used "wimax" authentication for our CPE but only EAP-TTLS. Anyway If I may reask a new question about adding multiple attribute to reply on the radius that proxy. The solution you gave me, (eg use users file and match the Realm Attribute, DEFAULT Realm == whatever) is ok for a "ISP" radius (eg end radius), not for a "Wholesale" radius (eg radius that proxy). According to what I saw in debug, Realm attribute is only use in the request (eg add by the proxy radius), but even if I force it in the reply of the end radius, it won't be consider in the reply by the proxy radius. So that I can not add the wanted attribute as I would like too. For now what I do, is use the attrs file for first attribute, then use unlang in post auth to add the second attribute. Thomas
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Anyway If I may reask a new question about adding multiple attribute to reply on the radius that proxy.
The solution you gave me, (eg use users file and match the Realm Attribute, DEFAULT Realm == whatever) is ok for a "ISP" radius (eg end radius), not for a "Wholesale" radius (eg radius that proxy). According to what I saw in debug, Realm attribute is only use in the request (eg add by the proxy radius), but even if I force it in the reply of the end radius, it won't be consider in the reply by the proxy radius.
So that I can not add the wanted attribute as I would like too.
For now what I do, is use the attrs file for first attribute, then use unlang in post auth to add the second attribute.
Files module supports use of files in post-auth and post-proxy. Add this to raddb/modules/files: postproxy_usersfile = ${confdir}/postproxy_users Then create postproxy_users in raddb directory (where other users files are) and list that DEAFAULT entry there. Ivan Kalik Kalik Informatika ISP
Files module supports use of files in post-auth and post-proxy. Add this to raddb/modules/files:
postproxy_usersfile = ${confdir}/postproxy_users
Then create postproxy_users in raddb directory (where other users files are) and list that DEAFAULT entry there.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Many thanks, this is working great Thomas
participants (3)
-
Ivan Kalik -
Jayanth1 -
Thomas Fagart