Re: Assigning IP address from RADIUS to Cisco PPTP users
Message: 1 Date: Tue, 26 May 2009 18:56:42 +0100 (BST) From: "Ivan Kalik" <tnt@kalik.net> Subject: Re: Assigning IP address from RADIUS to Cisco PPTP users To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Message-ID: <52973.87.194.16.13.1243360602.squirrel@webmail.kalik.net> Content-Type: text/plain;charset=utf-8
I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems.
Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS.
Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common
vpdn-group 1 accept-dialin protocol pptp virtual-template 1
interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly
interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated!
http://wiki.freeradius.org/index.php/FAQ#It_still_doesn.27t_work.21
Post the debug of the authentication attempt.
Ivan Kalik Kalik Informatika ISP
------------------------------
Message: 2 Date: Tue, 26 May 2009 14:15:44 -0500 From: jon jon <free9360@gmail.com> Subject: Re: next To: tim.sylvester@networkradius.com, FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <c1efadb10905261215n4c0a4cdbw143227509a69c594@mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1"
ok so after reading the admin.sql it looks like it is telling me what to type into my mysql, to create a default admin for radius,and so freeradius can read any table in sql, does it matter what I change localhost to or can it be anyname I want. guess I am seeing what I have to do but not fully understanding it. I am using a mysql book also but think that might be getting me more confused. jon
On Tue, May 26, 2009 at 12:02 PM, Tim Sylvester < tim.sylvester@networkradius.com> wrote:
Read the SQL HOWTO at: http://wiki.freeradius.org/SQL_HOWTO. Also, look at the sql.conf file in the raddb directory and the mysql files in raddb/sql/mysql. You will want to read the information in admin.sql and schema.sql.
Tim
*From:* freeradius-users-bounces+tim.sylvester=networkradius.com@ lists.freeradius.org [mailto:freeradius-users-bounces+tim.sylvester<freeradius-users-bounces%2Btim.sylvester> =networkradius.com@lists.freeradius.org] *On Behalf Of *jon jon *Sent:* Tuesday, May 26, 2009 9:51 AM *To:* FreeRadius users mailing list *Subject:* next
I have my freeradius working, I running slackware 12.1 with freeradius version 2.1.5. I used NTRAping utility to send packets to my freeradius server. I also used radtest and that was successful. So now I want to set freeradius with backend mysql database. I am looking for the script db_mysql.sql and cannot find this file. I installed mysql as a package, when I installed slackware. So, does that file even exist anymore? I have the radius book and the directory it shows doesn't contain any file with that name.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Make Sure Overide is Disabled in the ippool module..
e.g. # override: # If set, the Framed-IP-Address already in the # reply (if any) will be discarded, and replaced # with a Framed-IP-Address assigned here. override = no
That would be so - if the pool was defined on the radius server. But his pool is on the Cisco device. Most likely culprit is: peer match aaa-pools Ivan Kalik Kalik Informatika ISP
On Tue, 26 May 2009, Ivan Kalik wrote:
Make Sure Overide is Disabled in the ippool module..
e.g. # override: # If set, the Framed-IP-Address already in the # reply (if any) will be discarded, and replaced # with a Framed-IP-Address assigned here. override = no
That would be so - if the pool was defined on the radius server. But his pool is on the Cisco device. Most likely culprit is:
Correct, but I changed them to "no" and restarted radiusd anyway. No help.
peer match aaa-pools
I would thnk just the opposite..."aaa-pools" should include radius defined pools? Confusing anyway, since for now, we don't even want a pool for this particular user. I did a "no peer match aaa-pools" anyway, but to no avail. Here is how Cisco describes it: router(config-if)#peer match ? aaa-pools Use only peer pools that match AAA pools In any case, I really appreciate it if you can at least give my radiusd config the thumbs up for this...I can open a ticket with Cisco TAC if so. James Smallacombe PlantageNet, Inc. CEO and Janitor up@3.am http://3.am =========================================================================
participants (3)
-
Ivan Kalik -
Neville -
up＠3.am