Framed-IP-Address Help
Hello Everyone, I need help. In my default configuration file I did this change in authenticate session: Auth-Type mschap { mschap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "2M/2M" } ok } } This change is for give an IP from another POOL if the user is with invalid credentials. All works fine if the IP comes from DHCP, but if the user have a fixed IP then the IP is not changed. How can I remove the fixed IP to force the user to receive an IP from pool that I choose? Thanks Aurelio
On Mar 10, 2020, at 4:51 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
In my default configuration file I did this change in authenticate session:
Auth-Type mschap { mschap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "2M/2M" } ok } }
This change is for give an IP from another POOL if the user is with invalid credentials.
You can send an Access-Accept, but it won't contain the correct MS-CHAP data. So the end user system will ignore it, and the IP address assignment.
All works fine if the IP comes from DHCP, but if the user have a fixed IP then the IP is not changed.
It works fine for DHCP because DHCP doesn't do user authentication.
How can I remove the fixed IP to force the user to receive an IP from pool that I choose?
You can't. The Access-Accept doesn't contain the correct MS-CHAP data. Alan DeKok.
Alan, Thanks for the reply, but I don't know if I was clear and you understood what I want. If a user, whith Framed-IP-Address attibute uses a wrong password, I want to change the attribute Framed-IP-Address to Pool-Name. It's possible? Thanks Em 10/03/2020 19:45, Alan DeKok escreveu:
On Mar 10, 2020, at 4:51 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
In my default configuration file I did this change in authenticate session:
Auth-Type mschap { mschap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "2M/2M" } ok } }
This change is for give an IP from another POOL if the user is with invalid credentials.
You can send an Access-Accept, but it won't contain the correct MS-CHAP data. So the end user system will ignore it, and the IP address assignment.
All works fine if the IP comes from DHCP, but if the user have a fixed IP then the IP is not changed.
It works fine for DHCP because DHCP doesn't do user authentication.
How can I remove the fixed IP to force the user to receive an IP from pool that I choose?
You can't. The Access-Accept doesn't contain the correct MS-CHAP data.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 11, 2020, at 3:32 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
If a user, whith Framed-IP-Address attibute uses a wrong password, I want to change the attribute Framed-IP-Address to Pool-Name.
It's possible?
You can use the "update" section to delete, add, or change any attribute. So yes, it's possible. Alan DeKok.
Alan, Em 11/03/2020 17:30, Alan DeKok escreveu:
On Mar 11, 2020, at 3:32 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
If a user, whith Framed-IP-Address attibute uses a wrong password, I want to change the attribute Framed-IP-Address to Pool-Name.
It's possible?
You can use the "update" section to delete, add, or change any attribute. So yes, it's possible.
Alan DeKok.
I'm using, and is not working. What I'm doing wrong? :( if(reject) { update control { Pool-Name := "mkt_pool" }
On Mar 11, 2020, at 4:45 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
I'm using, and is not working. What I'm doing wrong? :(
if(reject) { update control { Pool-Name := "mkt_pool" }
WHAT is not working? What is the debug output? What do you EXPECT it to do? The server does NOT normally do IP pool assignment when sending Access-Rejects. Please post USEFUL messages with content. Saying "stuff doesn't work" is unhelpful. I can't read your mind. I don't know what you want it to do. I don't know what's "wrong" according to your opinion. You need to EXPLAIN yourself. Alan DeKok.
Alan, Sorry. I want to override users Framed-IP-Address with mkt_pool IP. How can I do this? I'm using FreeRadius 3.0.20 with MySQL database Thanks again Em 11/03/2020 18:18, Alan DeKok escreveu:
On Mar 11, 2020, at 4:45 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
I'm using, and is not working. What I'm doing wrong? :(
if(reject) { update control { Pool-Name := "mkt_pool" }
WHAT is not working? What is the debug output? What do you EXPECT it to do?
The server does NOT normally do IP pool assignment when sending Access-Rejects.
Please post USEFUL messages with content. Saying "stuff doesn't work" is unhelpful.
I can't read your mind. I don't know what you want it to do. I don't know what's "wrong" according to your opinion. You need to EXPLAIN yourself.
Alan DeKok.
You could override attributes using _unlang_ syntax: “update { &<list>:attr := value }” or “update <list> { &attr := value }” e.g: update { &control:Pool-Name := "mkt_pool" } — Jorge Pereira jpereira@freeradius.org
On 12 Mar 2020, at 15:34, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
Alan,
Sorry.
I want to override users Framed-IP-Address with mkt_pool IP.
How can I do this? I'm using FreeRadius 3.0.20 with MySQL database
Thanks again
Em 11/03/2020 18:18, Alan DeKok escreveu:
On Mar 11, 2020, at 4:45 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
I'm using, and is not working. What I'm doing wrong? :(
if(reject) { update control { Pool-Name := "mkt_pool" }
WHAT is not working? What is the debug output? What do you EXPECT it to do?
The server does NOT normally do IP pool assignment when sending Access-Rejects.
Please post USEFUL messages with content. Saying "stuff doesn't work" is unhelpful.
I can't read your mind. I don't know what you want it to do. I don't know what's "wrong" according to your opinion. You need to EXPLAIN yourself.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jorge,
I'm doing this, but the user have Framed-IP-address attribute, and
I want to override the Framed-IP-address to use mkt_pool IP.
If the user don't have the Framed-IP-address attribute I have no
problem.
I don't know If I was clear.
Thanks
Em 12/03/2020 15:42, Jorge Pereira escreveu:
> You could override attributes using _unlang_ syntax: “update { &<list>:attr := value }” or “update <list> { &attr := value }”
>
> e.g:
>
> update {
> &control:Pool-Name := "mkt_pool"
> }
>
>
> —
> Jorge Pereira
> jpereira@freeradius.org
>
>
>
>
>> On 12 Mar 2020, at 15:34, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
>>
>> Alan,
>>
>> Sorry.
>>
>> I want to override users Framed-IP-Address with mkt_pool IP.
>>
>> How can I do this? I'm using FreeRadius 3.0.20 with MySQL database
>>
>> Thanks again
>>
>>
>> Em 11/03/2020 18:18, Alan DeKok escreveu:
>>> On Mar 11, 2020, at 4:45 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
>>>> I'm using, and is not working. What I'm doing wrong? :(
>>>>
>>>> if(reject) {
>>>> update control {
>>>> Pool-Name := "mkt_pool"
>>>> }
>>> WHAT is not working? What is the debug output? What do you EXPECT it to do?
>>>
>>> The server does NOT normally do IP pool assignment when sending Access-Rejects.
>>>
>>> Please post USEFUL messages with content. Saying "stuff doesn't work" is unhelpful.
>>>
>>> I can't read your mind. I don't know what you want it to do. I don't know what's "wrong" according to your opinion. You need to EXPLAIN yourself.
>>>
>>> Alan DeKok.
>>>
>>
>>
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 12, 2020, at 3:12 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
I'm doing this, but the user have Framed-IP-address attribute, and I want to override the Framed-IP-address to use mkt_pool IP.
*Where* is the Framed-IP-Address? The request? Or the reply? If it's in the reply, where did it come from? You can *always* add / edit / delete attributes. If you had just asked "how do I delete Framed-IP-Address", you would have had an answer days ago: update reply { Framed-IP-Address !* ANY } This is documented in "man unlang". Alan DeKok.
Alan, Thanks for you time and patience. Aurelio Em 12/03/2020 19:04, Alan DeKok escreveu:
On Mar 12, 2020, at 3:12 PM, Aurélio de Souza Ribeiro Neto <netolistas@mpc.com.br> wrote:
I'm doing this, but the user have Framed-IP-address attribute, and I want to override the Framed-IP-address to use mkt_pool IP.
*Where* is the Framed-IP-Address? The request? Or the reply? If it's in the reply, where did it come from?
You can *always* add / edit / delete attributes. If you had just asked "how do I delete Framed-IP-Address", you would have had an answer days ago:
update reply { Framed-IP-Address !* ANY }
This is documented in "man unlang".
Alan DeKok.
participants (3)
-
Alan DeKok -
Aurélio de Souza Ribeiro Neto -
Jorge Pereira