Hi every body, While all the documentation on the web seems to answer *NO*, and because I feel like i need to talk to someone today, I was wondering if there is any way to allocate IP address to wifi user using radius Attributes instead of DHCP? Or maybe I should ask... How can i allocate IP address from differents Pools based on login (final goal would be to have transparent squid treat user differently )? Thanks. -- Follow us on: twitter https://www.twitter.com/manainternet
Alexandre Chapellon wrote:
Hi every body, While all the documentation on the web seems to answer *NO*, and because I feel like i need to talk to someone today, I was wondering if there is any way to allocate IP address to wifi user using radius Attributes instead of DHCP?
Nope. The only way this would work is if the AP cached the Framed-IP-Address from the Access-Accept, and then grabbed the DHCP packet, and put the Framed-IP-Address in it as a DHCP response.
Or maybe I should ask... How can i allocate IP address from differents Pools based on login (final goal would be to have transparent squid treat user differently )?
Run FreeRADIUS as a DHCP server. :) It works, and you can put session information from RADIUS into an SQL DB, and then query that data when it receives a DHCP packet. Alan DeKok.
Le mardi 30 novembre 2010 à 21:01 +0100, Alan DeKok a écrit :
Alexandre Chapellon wrote:
Hi every body, While all the documentation on the web seems to answer *NO*, and because I feel like i need to talk to someone today, I was wondering if there is any way to allocate IP address to wifi user using radius Attributes instead of DHCP?
Nope. The only way this would work is if the AP cached the Framed-IP-Address from the Access-Accept, and then grabbed the DHCP packet, and put the Framed-IP-Address in it as a DHCP response.
Or maybe I should ask... How can i allocate IP address from differents Pools based on login (final goal would be to have transparent squid treat user differently )?
Run FreeRADIUS as a DHCP server. :) It works, and you can put session information from RADIUS into an SQL DB, and then query that data when it receives a DHCP packet.
Am not sure to understand... Once the wifi user entered the network (level2: no IP yet), I have an entry for its sessions in my accouting database, with username, sessionID, maybe mac_address and so on... But when the user sends a DHCP request to obtain IP address (gain level3 access), that request may not contain any reference to the username, but to the mac address... that's it? So the trick would be to get the username from the mac address querying the accouting database? And then? Can I use any ippool module in the freeradius DHCP server? or Do I have to use static mapping mac2ip? Hope I am clear enough, Thks
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Follow us on: twitter https://www.twitter.com/manainternet
Alexandre Chapellon wrote:
Am not sure to understand... Once the wifi user entered the network (level2: no IP yet), I have an entry for its sessions in my accouting database, with username, sessionID, maybe mac_address and so on...
Yes. This often includes NAS IP and port.
But when the user sends a DHCP request to obtain IP address (gain level3 access), that request may not contain any reference to the username, but to the mac address... that's it?
And often the NAS IP and port.
So the trick would be to get the username from the mac address querying the accouting database?
Yes.
And then? Can I use any ippool module in the freeradius DHCP server? or Do I have to use static mapping mac2ip?
The ippool module doesn't do allocation for DHCP. But you could write a short Perl program to do it. Alan DeKok.
Le jeudi 02 décembre 2010 à 07:38 +0100, Alan DeKok a écrit :
Alexandre Chapellon wrote:
Am not sure to understand... Once the wifi user entered the network (level2: no IP yet), I have an entry for its sessions in my accouting database, with username, sessionID, maybe mac_address and so on...
Yes. This often includes NAS IP and port.
But when the user sends a DHCP request to obtain IP address (gain level3 access), that request may not contain any reference to the username, but to the mac address... that's it?
And often the NAS IP and port.
NAS IP and Port in the DHCP request? That's option 82 isn't it? If my NAS doesn't support relaying DHCP requests adding option 82 fields (my NASes may be very common wifi access points) is it still safe using such a setup? Anyway, it's much more clear now thanks.
So the trick would be to get the username from the mac address querying the accouting database?
Yes.
And then? Can I use any ippool module in the freeradius DHCP server? or Do I have to use static mapping mac2ip?
The ippool module doesn't do allocation for DHCP. But you could write a short Perl program to do it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Follow us on: twitter https://www.twitter.com/manainternet
Alexandre Chapellon wrote:
NAS IP and Port in the DHCP request? That's option 82 isn't it? If my NAS doesn't support relaying DHCP requests adding option 82 fields (my NASes may be very common wifi access points) is it still safe using such a setup?
It's option 82, yes. And it may work... it all depends on what the APs do. Alan DeKok.
On Nov 30, 2010, at 11:33 AM, Alexandre Chapellon wrote:
Hi every body, While all the documentation on the web seems to answer *NO*, and because I feel like i need to talk to someone today, I was wondering if there is any way to allocate IP address to wifi user using radius Attributes instead of DHCP? Or maybe I should ask... How can i allocate IP address from differents Pools based on login (final goal would be to have transparent squid treat user differently )?
No. Not unless your Access point has a built in DHCP server which can create temporary leases based on RADIUS attributes provided by the RADIUS Server. -Arran
Hello all, I'm also trying to assign pools of IPs based on LDAP group membership. Since your conversation is very technical and not easy to put in place by someone who just started with RADIUS, I was looking for a descriptive way to get to that end. And I found the following : http://www.anthonymendoza.com/index2.php?option=com_content&do_pdf=1&id=58 http://www.anthonymendoza.com/index2.php?option=com_content&do_pdf=1&id=58 With a brief overview, can you please valid the pdf way can work? Or could you point me to a ressource with which I could do it your way? Thank you! -- View this message in context: http://freeradius.1045715.n5.nabble.com/wifi-ip-allocation-tp3286614p3305394... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Le mardi 14 décembre 2010 à 14:25 -0800, pauvre a écrit :
Hello all,
I'm also trying to assign pools of IPs based on LDAP group membership. Since your conversation is very technical and not easy to put in place by someone who just started with RADIUS, I was looking for a descriptive way to get to that end. And I found the following : http://www.anthonymendoza.com/index2.php?option=com_content&do_pdf=1&id=58 http://www.anthonymendoza.com/index2.php?option=com_content&do_pdf=1&id=58
With a brief overview, can you please valid the pdf way can work?
I can't judge the cisco part but the radius part should work if you do not want to use dhcp Note that the initial talk we had was about assigning addresss to non-ppp interface. If what you want to do has to done on ethernet like network (wifi or wired ethernet) it wont work. regards
Or could you point me to a ressource with which I could do it your way?
Thank you!
-- Follow us on: twitter https://www.twitter.com/manainternet
Thank you Alexandre for your analysis and more precision on your thread! It is very helpul and appreciate!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/wifi-ip-allocation-tp3286614p3306442... Sent from the FreeRadius - User mailing list archive at Nabble.com.
pauvre wrote:
I'm also trying to assign pools of IPs based on LDAP group membership. Since your conversation is very technical and not easy to put in place by someone who just started with RADIUS,
RADIUS is a technical subject. You're not going to get very far if you have a hard time with technical conversatons.
I was looking for a descriptive way to get to that end. And I found the following : http://www.anthonymendoza.com/index2.php?option=com_content&do_pdf=1&id=58 http://www.anthonymendoza.com/index2.php?option=com_content&do_pdf=1&id=58
With a brief overview, can you please valid the pdf way can work?
For me, no. We supply documentation for how to use FreeRADIUS. If it's hard to understand, ask questions about it. If you have questions about someone else's documents, go ask them. Alan DeKok.
participants (4)
-
Alan DeKok -
Alexandre Chapellon -
Arran Cudbard-Bell -
pauvre