Using freeradius as proxy for EAP-SIM/EAP-AKA
Hi I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ? Assuming brand X radius server has support for EAP-SIM/EAP-AKA, but it's located at the final end of the food chain, and in-between the brand X radius server and the Access point, there are 2 (or more) radius servers which are doing proxying ( and some other non-EAP SIM/EAP AKA work ). Will it work ?
------>I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ? yes it is possible , but you have to make sure that all requests of an EAP session are being entertain by the same server, ( as proxy can have multipile freeradius servers), Read proxy.config, it have some methods for proxy, some of these are for chap and one or two or of EAP. similarly you can use some other methods like (Linux Virtual Server LVS) to accomplish this task. On Mon, Jul 1, 2013 at 10:48 AM, Ming-Ching Tiew <mctiew@yahoo.com> wrote:
Hi
I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ?
Assuming brand X radius server has support for EAP-SIM/EAP-AKA, but it's located at the final end of the food chain, and in-between the brand X radius server and the Access point, there are 2 (or more) radius servers which are doing proxying ( and some other non-EAP SIM/EAP AKA work ).
Will it work ?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
If I understand you correctly, it means it is only possible to have ONE radius server which does EAP SIM/EAP AKA authentication in the entire chain of connections ? It's not possible for one proxy radius to send request to different EAP SIM/EAP AKA radius server (based on certain criteria) ? How about Linux LVS ? Will it able to split the EAP-SIM/EAP-AKA request to different (final) server based on certain criteria ? ________________________________ From: Muhammad Nadeem <mnadeem8327@gmail.com> To: Ming-Ching Tiew <mctiew@yahoo.com>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Monday, July 1, 2013 3:10 PM Subject: Re: Using freeradius as proxy for EAP-SIM/EAP-AKA ------>I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ? yes it is possible , but you have to make sure that all requests of an EAP session are being entertain by the same server, ( as proxy can have multipile freeradius servers), Read proxy.config, it have some methods for proxy, some of these are for chap and one or two or of EAP. similarly you can use some other methods like (Linux Virtual Server LVS) to accomplish this task. On Mon, Jul 1, 2013 at 10:48 AM, Ming-Ching Tiew <mctiew@yahoo.com> wrote:
Hi
I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ?
Assuming brand X radius server has support for EAP-SIM/EAP-AKA, but it's located at the final end of the food chain, and in-between the brand X radius server and the Access point, there are 2 (or more) radius servers which are doing proxying ( and some other non-EAP SIM/EAP AKA work ).
Will it work ? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
Ming-Ching Tiew wrote:
If I understand you correctly, it means it is only possible to have ONE radius server which does EAP SIM/EAP AKA authentication in the entire chain of connections ?
No. It means that you don't KNOW it's EAP-SIM until after you decide to proxy it.
It's not possible for one proxy radius to send request to different EAP SIM/EAP AKA radius server (based on certain criteria) ?
When you're proxying an EAP packet, the ONLY criteria you have is the EAP identity. You do NOT have the EAP type available.
How about Linux LVS ? Will it able to split the EAP-SIM/EAP-AKA request to different (final) server based on certain criteria ?
No. Adding a virtual server is no different from adding another machine on the network. It won't make any difference. The issue is with the EAP protocol. Not with the network stack. Alan DeKok.
On 01.07.2013 18:34, Alan DeKok wrote:
It's not possible for one proxy radius to send request to different EAP SIM/EAP AKA radius server (based on certain criteria) ?
When you're proxying an EAP packet, the ONLY criteria you have is the EAP identity. You do NOT have the EAP type available.
You can proxy Access-Requests to another server if User-Name matches [^@]*@wlan.mncX.mccY.3gppnetwork.org. This another server should insist on using EAP-SIM. If user tries to use another EAP method server should reject the user.
From: Iliya Peregoudov <iperegudov@cboss.ru> To: freeradius-users@lists.freeradius.org Sent: Tuesday, July 2, 2013 2:20 PM Subject: Re: Using freeradius as proxy for EAP-SIM/EAP-AKA On 01.07.2013 18:34, Alan DeKok wrote:
It's not possible for one proxy radius to send request to different EAP SIM/EAP AKA radius server (based on certain criteria) ?
When you're proxying an EAP packet, the ONLY criteria you have is the EAP identity. You do NOT have the EAP type available.
You can proxy Access-Requests to another server if User-Name matches [^@]*@wlan.mncX.mccY.3gppnetwork.org. This another server should insist on using EAP-SIM. If user tries to use another EAP method server should reject the user.
So this [^@]*@wlan.mncX.mccY.3gppnetwork.org is unique ? All the SIMs from the same mobile operator will have the same string and it will be different from another mobile operator ?
On 07/02/2013 07:56 AM, Ming-Ching Tiew wrote:
So this [^@]*@wlan.mncX.mccY.3gppnetwork.org is unique ? All the SIMs from the same mobile operator will have the same string and it will be different from another mobile operator ?
Yes, though be aware the pattern given isn't exactly valid; X and Y are N-digit numbers (the MNC and MCC, obviously). Twiddle as appropriate to make a valid regexp.
Can I know what brand of radius server you are going to use for EAP-SIM/AKA ? I am interesting on this On Tue, Jul 2, 2013 at 3:51 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 07/02/2013 07:56 AM, Ming-Ching Tiew wrote:
So this [^@]*@wlan.mncX.mccY.**3gppnetwork.org<http://wlan.mncX.mccY.3gppnetwork.org>is unique ? All the SIMs
from the same mobile operator will have the same string and it will be different from another mobile operator ?
Yes, though be aware the pattern given isn't exactly valid; X and Y are N-digit numbers (the MNC and MCC, obviously). Twiddle as appropriate to make a valid regexp.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
participants (6)
-
Alan DeKok -
Bill Yuan -
Iliya Peregoudov -
Ming-Ching Tiew -
Muhammad Nadeem -
Phil Mayers