Dynamic and static clients + overlapping dynamic client pools
A couple of questions, and apologies if I'm duplicating previous questions - I just haven't been able to find a straight-forward answer to either of these questions: 1. When you have a configuration with both static client entries and dynamic client pools, where the static clients are contained in the dynamic pool, will FR prefer the static client entry and secret? 2. Can you have two or more overlapping dynamic client pools with different secrets. Perhaps even multiple pools with the same subnet but different secrets? For context, we have a large enterprise that uses a handful of shared secrets based on client type. But these different client types are scattered around the same subnets, so it would be impossible or nearly so to specify dynamic blocks of any reasonable size. Most clients will be preconfigured as static clients however, hence question 1. But we need to account for new clients coming online within allowed subnets, but they could be using one of the handful of secrets. With our current solution, we have a script that monitors for new client requests via log and creating static clients on-demand, but the current solution doesn't require a restart to refresh the clients list, so looking for alternatives as we look to FR as a replacement. Thanks, Taylor This communication is the property of Lumen Technologies and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
On Aug 24, 2022, at 12:39 PM, Fraley, Taylor via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
1. When you have a configuration with both static client entries and dynamic client pools, where the static clients are contained in the dynamic pool, will FR prefer the static client entry and secret?
You can't have multiple definitions for one client. And I'm not sure what a "dynamic client pool" is. There's no such thing in the server.
2. Can you have two or more overlapping dynamic client pools with different secrets. Perhaps even multiple pools with the same subnet but different secrets?
I still don't know what a "dynamic client pool" is. Clients are defined by IP (or network/mask). This is how all clients are defined, no matter if they're static or dynamic. Static clients come from clients.conf, or similar definitions. Dynamic clients come from sites-available/dynamic_clients. And those clients can come from files, SQL, LDAP, etc.
For context, we have a large enterprise that uses a handful of shared secrets based on client type. But these different client types are scattered around the same subnets, so it would be impossible or nearly so to specify dynamic blocks of any reasonable size. Most clients will be preconfigured as static clients however, hence question 1. But we need to account for new clients coming online within allowed subnets, but they could be using one of the handful of secrets. With our current solution, we have a script that monitors for new client requests via log and creating static clients on-demand, but the current solution doesn't require a restart to refresh the clients list, so looking for alternatives as we look to FR as a replacement.
Just list all clients by IP, and use sites-available/dynamic_clients. You can add clients dynamically. I'm not sure what else you're looking for here. You haven't explained where subnets and "dynamic client pools" interact with the client definitions. Alan DeKok.
To clarify: I mean, if I have say, have a dynamic client configuration that's something like: client dynamic { Ipaddr = 192.168.1.0 Netmask = 24 dynamic_clients = dynamic_client_server directory = ${confdir/dynamic-clients/ lifetime = 3600 } Is it also possible to have a client configured specifically for 192.168.1.2 (or any other since IP that would be contained by that dynamic client). -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+taylor.fraley=lumen.com@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Wednesday, August 24, 2022 12:48 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Dynamic and static clients + overlapping dynamic client pools CAUTION: This email originated outside of Lumen Technologies. Do not click links or open attachments unless you recognize the sender and know the content is safe. --------------------------------------------------------------------------------------- On Aug 24, 2022, at 12:39 PM, Fraley, Taylor via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
1. When you have a configuration with both static client entries and dynamic client pools, where the static clients are contained in the dynamic pool, will FR prefer the static client entry and secret?
You can't have multiple definitions for one client. And I'm not sure what a "dynamic client pool" is. There's no such thing in the server.
2. Can you have two or more overlapping dynamic client pools with different secrets. Perhaps even multiple pools with the same subnet but different secrets?
I still don't know what a "dynamic client pool" is. Clients are defined by IP (or network/mask). This is how all clients are defined, no matter if they're static or dynamic. Static clients come from clients.conf, or similar definitions. Dynamic clients come from sites-available/dynamic_clients. And those clients can come from files, SQL, LDAP, etc.
For context, we have a large enterprise that uses a handful of shared secrets based on client type. But these different client types are scattered around the same subnets, so it would be impossible or nearly so to specify dynamic blocks of any reasonable size. Most clients will be preconfigured as static clients however, hence question 1. But we need to account for new clients coming online within allowed subnets, but they could be using one of the handful of secrets. With our current solution, we have a script that monitors for new client requests via log and creating static clients on-demand, but the current solution doesn't require a restart to refresh the clients list, so looking for alternatives as we look to FR as a replacement.
Just list all clients by IP, and use sites-available/dynamic_clients. You can add clients dynamically. I'm not sure what else you're looking for here. You haven't explained where subnets and "dynamic client pools" interact with the client definitions. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This communication is the property of Lumen Technologies and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
On Aug 24, 2022, at 4:30 PM, Fraley, Taylor via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
To clarify:
I mean, if I have say, have a dynamic client configuration that's something like:
client dynamic { Ipaddr = 192.168.1.0 Netmask = 24 dynamic_clients = dynamic_client_server directory = ${confdir/dynamic-clients/ lifetime = 3600 }
Is it also possible to have a client configured specifically for 192.168.1.2 (or any other since IP that would be contained by that dynamic client).
It should work. How about trying it? That should take 5 minutes for a test. If the server doesn't complain, it will work. Alan DeKok.
Will do, thanks Alan for the quick response. -----Original Message----- From: Alan DeKok <aland@deployingradius.com> Sent: Wednesday, August 24, 2022 3:11 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Fraley, Taylor <taylor.fraley@lumen.com> Subject: Re: Dynamic and static clients + overlapping dynamic client pools CAUTION: This email originated outside of Lumen Technologies. Do not click links or open attachments unless you recognize the sender and know the content is safe. --------------------------------------------------------------------------------------- On Aug 24, 2022, at 4:30 PM, Fraley, Taylor via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
To clarify:
I mean, if I have say, have a dynamic client configuration that's something like:
client dynamic { Ipaddr = 192.168.1.0 Netmask = 24 dynamic_clients = dynamic_client_server directory = ${confdir/dynamic-clients/ lifetime = 3600 }
Is it also possible to have a client configured specifically for 192.168.1.2 (or any other since IP that would be contained by that dynamic client).
It should work. How about trying it? That should take 5 minutes for a test. If the server doesn't complain, it will work. Alan DeKok. This communication is the property of Lumen Technologies and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
participants (2)
-
Alan DeKok -
Fraley, Taylor