I am sorry for contacting list for my problem, but i have searched for more than 15 days trying to find the solution with no success: 1. i have a cisco ISG with DHCP relay that points to freeradius 2. freeradius will send access accept or access reject based on mac address, nas ip etc. this scenario works ok for CPE devices, but not for CM devices because CM devices need TFTP server name and TFTP file name. I am unable to find right reply message format. So, my problem is BOOTP part. Is there any way to send those data to ISG so that ISG can combine those data and send it to CM device? Again, i am sorry for asking this question here but it is partially tied to freeradius functionality. I hope there is someone on this list that has more experience with ISG and freeradius to point me to right direction. Thank you...
Igor Smitran wrote:
this scenario works ok for CPE devices, but not for CM devices because CM devices need TFTP server name and TFTP file name. I am unable to find right reply message format. So, my problem is BOOTP part. Is there any way to send those data to ISG so that ISG can combine those data and send it to CM device?
What does the ISG documentation say?
Again, i am sorry for asking this question here but it is partially tied to freeradius functionality. I hope there is someone on this list that has more experience with ISG and freeradius to point me to right direction.
Ask the vendor how their product works... Alan DeKok
Hi,
I am sking here because i wasn't able to find any answears on cisco site. Maybe someone here has enough experience to point me to right direction.
I'm not sure what lists you are on...but you seem to be confused - this is the FreeRADIUS mialing list, not the Cisco support mailing list. alan
Ok, I really don't understand why noone wants to help. After all, i am using freeradius together with cisco. I just asked if anyone has any experience in ISG+FreeRadius because i am trying to find a solution for my problem for more than 15 days. Does it really matter what kind of NAS i am using? Thank you, Igor Alan Buxey wrote:
Hi,
I am sking here because i wasn't able to find any answears on cisco site. Maybe someone here has enough experience to point me to right direction.
I'm not sure what lists you are on...but you seem to be confused - this is the FreeRADIUS mialing list, not the Cisco support mailing list.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Igor Smitran wrote:
I really don't understand why noone wants to help.
You *think* you're asking how to configure FreeRADIUS to send something back to the NAS. We're telling you we don't know what that "something" is. Only the NAS manufacturer knows. Go ask Cisco what the NAS needs, and then configure FreeRADIUS to send it. i.e. People are *trying* to help you, and you're ignoring the advice of the experts on this list. That should be a hint that your approach is wrong.
After all, i am using freeradius together with cisco.
You are asking how to configure the Cisco NAS, not FreeRADIUS. Try asking Cisco how to configure FreeRADIUS. You won't get far.
I just asked if anyone has any experience in ISG+FreeRadius because i am trying to find a solution for my problem for more than 15 days. Does it really matter what kind of NAS i am using?
Yes. You are asking how to configure the NAS. It matters *very much* which NAS you're using. Your question is based on a fundamental misunderstanding of RADIUS. You think that the server is in control. It's not. The NAS is in control of almost everything. If you want the NAS to do something, consult the NAS documentation for how to configure the NAS, or which attributes it expects in order to behave in a particular way. Once you find out that the NAS needs Attribute X with value Y to do what you want, we can help you configure FreeRADIUS to send it. Until then, we *don't know* what X is. We *don't know* what Y is. We are telling you to ask the *manufacturer of the NAS* what those values are. Alan DeKok.
Hi,
I really don't understand why noone wants to help. After all, i am using freeradius together with cisco. I just asked if anyone has any experience in ISG+FreeRadius because i am trying to find a solution for my problem for more than 15 days. Does it really matter what kind of NAS i am using?
you said you couldnt find any answers about the tech on cisco site. as a big cisoc user myself of many of their product lines...i find that somewhat wierd as they pretty much document everything...maybe its badly linked and doesnt spell out exactly how you do A+B with product C (they'll just tell you how A + B work - you figure the rest out). but its there. perhaps its because your original question was badly worded or incorrectly phrased? you're trying to use the DHCP function of FreeRADIUS...yes? in the world of DHCP (relay or not) TFTP options are just extra attributes returned in the reply.... eg ISC DHCP gives you option tftp-server-name "servername" and filename "filename" and even next-server 123.123.123.123 (where 123.123.123.123 is quaddot notation for TFTP server) you may need to adjust the AAA attribute list to deal with these..... alan
Yes, it is definitley my bad english. I am not using freeradius as DHCP, i am using freeradius as mac address checker. That part is working ok. I am using freeradius for long time and it is a great product. But, cisco ISG is new to me. I have setup cisco ISG as a DHCP server. when cisco receives DHCP request it takes MAC address and asks freeradius if that mac address has access to internet. Based on freeradius Access-Accept/Reject i am using diferent policies applied to user. And it works. At least for CPE devices. But, CM and MTA devices need tftp server name and tftp file name. My problem is, and i have searched for more than 15 days, how or even if possible, to use freeradius to send BOOTP parameters to cisco. Since i wasn't able to find anything about that on cisco site i was just asking if anyone has ever done something similar to help me. I wasn't asking how would i do that in freeradius or am i able to do that in freeradius. I know freeradius is capable of that. I just don't know where to look. I was searching for "cisco isg bootp freeradius avpairs" and lot more different searches on google but nothing usable came up. I am sorry for misunderstanding, i wasn't being rude, just out of options. Since, in my project i will use freeradius i thought that someone else did the same thing before me and because of that i have asked a question here. Thank you and sorry again Alan Buxey wrote:
Hi,
I really don't understand why noone wants to help. After all, i am using freeradius together with cisco. I just asked if anyone has any experience in ISG+FreeRadius because i am trying to find a solution for my problem for more than 15 days. Does it really matter what kind of NAS i am using?
you said you couldnt find any answers about the tech on cisco site.
as a big cisoc user myself of many of their product lines...i find that somewhat wierd as they pretty much document everything...maybe its badly linked and doesnt spell out exactly how you do A+B with product C (they'll just tell you how A + B work - you figure the rest out). but its there.
perhaps its because your original question was badly worded or incorrectly phrased? you're trying to use the DHCP function of FreeRADIUS...yes? in the world of DHCP (relay or not) TFTP options are just extra attributes returned in the reply.... eg ISC DHCP gives you
option tftp-server-name "servername"
and
filename "filename"
and even
next-server 123.123.123.123 (where 123.123.123.123 is quaddot notation for TFTP server)
you may need to adjust the AAA attribute list to deal with these.....
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
And it works. At least for CPE devices. But, CM and MTA devices need tftp server name and tftp file name. My problem is, and i have searched for more than 15 days, how or even if possible, to use freeradius to send BOOTP parameters to cisco. Since i wasn't able to find anything about that on cisco site i was just asking if anyone has ever done something similar to help me. I wasn't asking how would i do that in freeradius or am i able to do that in freeradius. I know freeradius is capable of that. I just don't know where to look. I was searching for "cisco isg bootp freeradius avpairs" and lot more different searches on google but nothing usable came up. I am sorry for misunderstanding, i wasn't being rude, just out of options. Since, in my project i will use freeradius i thought that someone else did the same thing before me and because of that i have asked a question here.
ah right. fundamentally you are after the return attributes or VSAs that are needed for you to communicate TFTP server name etc to the ISG for a particular MAC address. we/you now assume that you can actually DO this with the ISG kit you mentioned and thats it has that function...it might have...it might have with the next release if you have a cisco support contract and lean on the right people...or it might not have... I would assume, this being cisco kit, that it doesnt have that functionality and you have to do this in a round about way - eg define the IP pool defintion or IP address pool and have your DHCP server hand out tftp-server and filename etc in that pool. crude but it'd work :-| actually, you might be able to do it slightly better - using option 82 circuit-id in the RADIUS....then if you have a good DHCP server - eg ISC DHCPD, you could sent the correct attributes if that id matches. (yes yes....you could also use the DHCP code in FreeRADIUS to do that too! ;-) ) alan PS http://www.cisco.com/en/US/docs/ios/12_2sb/isg/coa/guide/isgcaapa.html
Igor Smitran <sigor@blic.net> wrote:
I really don't understand why noone wants to help. After all, i am using freeradius together with cisco.
Hey there, I'm trying to ping 217.23.192.1 from my laptop at work, but it seems I need 802.1X configured to connect to my local network. As I'm trying to send traffic to your network, after all it involves a device on blic.net's network, can you help with my connectivity problems? </sarcasm> -- Alexander Clouter .sigmonster says: Stay on the trail.
Hi, not quite in the same category :-P perhaps more people need to read 'how to ask questions...' ? http://catb.org/~esr/faqs/smart-questions.html very good resource! alan
On May 18, 2010, at 6:34 AM, Alan Buxey wrote:
Hi,
not quite in the same category :-P
perhaps more people need to read 'how to ask questions...' ?
http://catb.org/~esr/faqs/smart-questions.html
very good resource!
Often, the person telling you to do a search has the manual or the web page with the information you need open, and is looking at it as he or she types. These replies mean that he thinks (a) the information you need is easy to find, and (b) you will learn more if you seek out the information than if you have it spoon-fed to you. You shouldn't be offended by this; by hacker standards, your respondent is showing you a rough kind of respect simply by not ignoring you. You should instead be thankful for this grandmotherly kindness." Made me smile :) -Arran
Nice. Alexander Clouter wrote:
Igor Smitran <sigor@blic.net> wrote:
I really don't understand why noone wants to help. After all, i am using freeradius together with cisco.
Hey there, I'm trying to ping 217.23.192.1 from my laptop at work, but it seems I need 802.1X configured to connect to my local network.
As I'm trying to send traffic to your network, after all it involves a device on blic.net's network, can you help with my connectivity problems?
</sarcasm>
participants (5)
-
Alan Buxey -
Alan DeKok -
Alexander Clouter -
Arran Cudbard-Bell -
Igor Smitran