Hello, I have some usage questions about FreeRADIUS that I am not finding answers for on the wiki. Can FR: * Place user/device in VLAN based on authentication? AAA 802.1q-in-q? I guess this would be FR telling a router/switch to push or pop the tag based on policy? * Other than VLAN in priority queues, can RF AAA any QoS technologies? can it do the priority queues for VLANs? * AAA VPN - both client and server? * Rate limit? Distinquish committed rate, burst rate, and best effort? * AAA firewall ports? * Implement "walled gardens" on users and devices? Is this only for http(s), what about email, ftp, ect...? * AAA IP address assignment? No sure how this works, but device/user request an IP DHCP server checks auth before issuing one? could it change IP address on existing connection? * Account network usage per user per device per interface? FR architecture: * Does being a WPA user make a difference to any of these questions? What about being a device rather than a user? * Authorization policies are not "in" radius, but in the db or directory correct? So to change policy for a user or device, the change would be done through the data store and not through radius? But the policy logic would need to exists in FR (ie modules?)? OR does the policy logic come form the data store as well? * Is there an OS API or does all the direction come through the data store? * Is there any reason why FR couldnt be used as an all encompassing NAC (for WAN)? * Do my questions clearly demostrat that I do not understand FR? :) FR 2.0: Is 2.0 a move to DIAMETER or is DIA not evolutionary? Is 2.0 recommended for production or should operators stick with 1.x? Thank you for your help, tom
Tom D. Davidson wrote:
Hello, I have some usage questions about FreeRADIUS that I am not finding answers for on the wiki.
Can FR:
FreeRADIUS can put anything into any RADIUS packet. The rest of your questions are best answered by pointing to general RADIUS concepts: http://deployingradius.com/book/concepts/ In short, if your NAS has those features, FreeRADIUS can tell the NAS when and where to use those features.
FR architecture: * Does being a WPA user make a difference to any of these questions? What about being a device rather than a user?
If you are using WPA-PSK, then the NAS does not contact the RADIUS server. So dynamic policies are not possible. If you are using EAP, then FreeRADIUS supports whatever the NAS implements.
* Authorization policies are not "in" radius, but in the db or directory correct? So to change policy for a user or device, the change would be done through the data store and not through radius?
See the "concepts" page for some discussion. A database is... a database, and not a policy engine. FreeRADIUS implements a policy language that can query databases, scripts, flat-text files...
But the policy logic would need to exists in FR (ie modules?)? OR does the policy logic come form the data store as well?
It comes from anywhere you need.
* Is there an OS API or does all the direction come through the data store?
? OS API for... what? The server comes with a policy language that lets you pull information from custom SQL schemas.
* Is there any reason why FR couldnt be used as an all encompassing NAC (for WAN)?
No.
* Do my questions clearly demostrat that I do not understand FR? :)
It's more "how RADIUS works". RADIUS is the glue between dumb NASes and dumb databases.
FR 2.0: Is 2.0 a move to DIAMETER or is DIA not evolutionary?
2.0 does not implement Diameter. Diameter is used mainly in the 3GPP world, but large telco's. Almost no one else uses it.
Is 2.0 recommended for production or should operators stick with 1.x?
2.1.1 is widely used in production environments. It makes 1.x look like something out of the stone age. Alan DeKok.
Alan, thanks.
* Is there an OS API or does all the direction come through the data store?
? OS API for... what? The server comes with a policy language that lets you pull information from custom SQL schemas. I follow. The project we are investigating is web service based. Was thinking of an web service api rather than the sql schemas.
will study what appears to be an excellent source you sent me. -tom
I follow. The project we are investigating is web service based. Was thinking of an web service api rather than the sql schemas.
And web service is getting information from ... You can make a perl/php/whatever client for the web service and get the data that way. But why don't you make it available to freeradius directly? Ivan Kalik Kalik Informatika ISP
I follow. The project we are investigating is web service based. Was thinking of an web service api rather than the sql schemas.
And web service is getting information from ... You can make a perl/php/whatever client for the web service and get the data that way. But why don't you make it available to freeradius directly?
Hello Ivan. For our application, the web service would only be to push policy to the data store. FR would have normal access to the data schema. Now that Im understanding a bit better, I will look in to our web app setting policy to openLDAP for FR to reference with a NAS requests authorization. Only the NAS need to speak FR, the rest of the system can talk directly to the data store, correct? -tom
Only the NAS need to speak FR, the rest of the system can talk directly to the data store, correct?
Yes, user administration is totally separate from radius stuff. Only changes made to freeradius files (users file, etc.) would require server restart to take effect. Ivan Kalik Kalik Informatika ISP
Yes, user administration is totally separate from radius stuff. Only changes made to freeradius files (users file, etc.) would require server restart to take effect.
Hypothetical. If user upgraded there account for higher bandwidth OR If a user was past due on the access fee, the FR server would need a restart to read the config files? Or the NAS would have to pull the new settings? -tom
Tom D. Davidson wrote:
Hypothetical. If user upgraded there account for higher bandwidth OR If a user was past due on the access fee, the FR server would need a restart to read the config files?
You can HUP the server in 2.x. Many modules will re-read their configuration.
Or the NAS would have to pull the new settings?
Er... the NAS doesn't read the server configuration files. Policy changes are applied at the *start* of a user session. So if you change the policy, (in most cases), the user will have to re-login for the changes to take effect. Alan DeKok.
Yes, user administration is totally separate from radius stuff. Only changes made to freeradius files (users file, etc.) would require server restart to take effect.
Hypothetical. If user upgraded there account for higher bandwidth OR If a user was past due on the access fee, the FR server would need a restart to read the config files?
Only if you are using freeradius files to store attributes. If they are in the sql database or ldap - updated values will be returned on the next connection (you can't upgrade currently connected user). BTW there is an Expiration attribute to handle account expiration. They don't pay - they can't connect. Ivan Kalik Kalik Informatika ISP
@Ivan:
Only if you are using freeradius files to store attributes. If they are in the sql database or ldap - updated values will be returned on the next connection (you can't upgrade currently connected user). OK that is more understandable. For a bit there I thought the FR server would have to be reloaded to read the update. Connection has to be restarted. Thank you for clarifying.
@Alan
Or the NAS would have to pull the new settings? Er... the NAS doesn't read the server configuration files. Copy that. I should have been more clear. I meant NAS pull new settings from the FR server as in a connection restart... Thank you for the direction with HUP, will look in to that more.
Does VMPS support 802.1q-in-q? thank you and kind regards, tom
participants (3)
-
Alan DeKok -
tnt＠kalik.net -
Tom D. Davidson