Migrating from Mikrotik NAS to FreeBSD
Hi guys, I've been using Mikrotik as NAS for years, but i think now it's time to make some changes, and im thinking to replace it with FreeBSD+MPD consulting my freeradius. The problem is i still have to keep some mikrotik NAS in my network and i can't change mikrotik database attributes. I'd like to migrate transparently. I have in my freeradius database mikrotik attributes like Mikrotik-Rate-Limit. But MPD uses mpd-limit attribute. So my question is, what is the best way to replace Mikrotik-Rate-Limit with mpd-limit in a radius request? When an user connect via pppoe+mpd it will look for mpd-limit attribute on freeradius database, that doesn't exist, but it have to get the info from Mikrotik-Rate-Limit values, and send it back to pppoe+mpd with the right values got from Mikrotik-Rate-Limit Attribute. Has anyone done something like this before? Thanks.
I have in my freeradius database mikrotik attributes like Mikrotik-Rate-Limit. But MPD uses mpd-limit attribute. So my question is, what is the best way to replace Mikrotik-Rate-Limit with mpd-limit in a radius request? When an user connect via pppoe+mpd it will look for mpd-limit attribute on freeradius database, that doesn't exist, but it have to get the info from Mikrotik-Rate-Limit values, and send it back to pppoe+mpd with the right values got from Mikrotik-Rate-Limit Attribute.
Can you send both sets of attributes in each response? Or, alternatively, do you know which clients on the FR side are Microtik devices and which ones are MPD? If you do, you could use the above and then use unlang to remove the inappropriate attributes from the response before you send it back. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
On Tue, Jul 21, 2015 at 12:23 PM, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
I have in my freeradius database mikrotik attributes like Mikrotik-Rate-Limit. But MPD uses mpd-limit attribute. So my question is, what is the best way to replace Mikrotik-Rate-Limit with mpd-limit in a radius request? When an user connect via pppoe+mpd it will look for mpd-limit attribute on freeradius database, that doesn't exist, but it have to get the info from Mikrotik-Rate-Limit values, and send it back to pppoe+mpd with the right values got from Mikrotik-Rate-Limit Attribute.
Can you send both sets of attributes in each response?
Yes, i think so. I suppose, mpd will just ignore what is not valid.
Or, alternatively, do you know which clients on the FR side are Microtik devices and which ones are MPD? If you do, you could use the above and then use unlang to remove the inappropriate attributes from the response before you send it back.
Yes, i think it would be possible to add a nas type, like mikrotik, mpd, etc. Do you have an example how it could be done using unlang? Thank you very much for your help.
Can you send both sets of attributes in each response?
Yes, i think so. I suppose, mpd will just ignore what is not valid.
That would be the easiest bet, yes. Is that also the case for the Mikrotik NAS?
Yes, i think it would be possible to add a nas type, like mikrotik, mpd, etc.
There are only limited types of nastype you can set. You could use the short name instead.
Do you have an example how it could be done using unlang?
But either way, you can use this kind of unlang: if ("%{client:shortname}" == 'mikrotik-15') { { update reply { # strip the non-Mikrotik attributes } } With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
Hi Stefan, On Tue, Jul 21, 2015 at 8:28 PM, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
Can you send both sets of attributes in each response?
Yes, i think so. I suppose, mpd will just ignore what is not valid.
That would be the easiest bet, yes. Is that also the case for the Mikrotik NAS?
Yes it is. What's your another idea here?
Yes, i think it would be possible to add a nas type, like mikrotik, mpd, etc.
There are only limited types of nastype you can set. You could use the short name instead.
Do you have an example how it could be done using unlang?
But either way, you can use this kind of unlang:
if ("%{client:shortname}" == 'mikrotik-15') { { update reply { # strip the non-Mikrotik attributes } }
I have the following value in Mikrotik-Rate-Limit: 2048k/2048k 384k/384k 768k/768k 100/100 8 0K/0K And this is the two values to mpd-limit reply: in#1=all rate-limit 2048000 384000 768000 pass out#1=all rate-limit 2048000 384000 768000 pass Following your suggestion, i've been thinking to use something like this in authorize section: authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files sql expiration logintime pap if ("%{client:shortname}" == 'mpd-nas') { { update reply { Tmp-String-0 = %{sql:SELECT Value FROM radreply WHERE Username = %{User-Name} and attribute ='Mikrotik-Rate-Limit'} Tmp-String-1 = %{sql:SELECT Value FROM radreply WHERE Username = %{User-Name} and attribute ='Mikrotik-Rate-Limit'} # here i still have to convert to mpd values, but i don't know how. mpd-limit = Tmp-String-0 mpd-limit = Tmp-String-1 } } } What do you think? Am i right? how could i convert Tmp-String-0 and 1 to mpd-limit output in/out? should i use awk? Thanks for your help.
I have the following value in Mikrotik-Rate-Limit:
2048k/2048k 384k/384k 768k/768k 100/100 8 0K/0K
And this is the two values to mpd-limit reply:
in#1=all rate-limit 2048000 384000 768000 pass out#1=all rate-limit 2048000 384000 768000 pass
I'd use a regex of some sort and then add the mpd-limit attributes: if ("%{sql:SELECT Value FROM radreply WHERE Username = %{User-Name} and attribute='Mikrotik-Rate-Limit'}" =~ /regex-to-pull-values-from-Mikrotik-attribute-here/) { update reply { mpd-limit := "in#1=all ..." mpd-limit += "out#1=all ..." } } Or, store them in the radreply table like the Mikrotik-Rate-Limit value: | User-Name | Mikrotik-Rate-Limit | = | 2048k/2048k 384k/384k 768k/768k 100/100 8 0K/0K | | User-Name | mpd-limit | += | in#1=all rate-limit 2048000 384000 768000 pass | | User-Name | mpd-limit | += | out#1=all rate-limit 2048000 384000 768000 pass | ;-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
Thanks Stefan, I just add a conditional before to check if it's a mpd NAS: if ("%{client:shortname}" == 'mpd-nas') { if ("%{sql:SELECT Value FROM radreply WHERE Username = %{User-Name} and attribute='Mikrotik-Rate-Limit'}" =~ /regex/) { update reply { mpd-limit := "in#1=all ..." mpd-limit += "out#1=all ..." } } } Is it ok? Thanks! :) On Wed, Jul 22, 2015 at 10:30 AM, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
I have the following value in Mikrotik-Rate-Limit:
2048k/2048k 384k/384k 768k/768k 100/100 8 0K/0K
And this is the two values to mpd-limit reply:
in#1=all rate-limit 2048000 384000 768000 pass out#1=all rate-limit 2048000 384000 768000 pass
I'd use a regex of some sort and then add the mpd-limit attributes:
if ("%{sql:SELECT Value FROM radreply WHERE Username = %{User-Name} and attribute='Mikrotik-Rate-Limit'}" =~ /regex-to-pull-values-from-Mikrotik-attribute-here/) { update reply { mpd-limit := "in#1=all ..." mpd-limit += "out#1=all ..." } }
Or, store them in the radreply table like the Mikrotik-Rate-Limit value:
| User-Name | Mikrotik-Rate-Limit | = | 2048k/2048k 384k/384k 768k/768k 100/100 8 0K/0K | | User-Name | mpd-limit | += | in#1=all rate-limit 2048000 384000 768000 pass | | User-Name | mpd-limit | += | out#1=all rate-limit 2048000 384000 768000 pass |
;-)
Stefan Paetow Moonshot Industry & Research Liaison Coordinator
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I just add a conditional before to check if it's a mpd NAS: [8<] Is it ok?
Yeah, sure! That said... you might get away without using the %{sql:...} call, since the radreply table will put the Microtik-Rate-Limit attribute into the reply. So you can use: if ("%{reply:Microtik-Rate-Limit}" =~ /.../) { ... } :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
participants (2)
-
Cassiano Peixoto -
Stefan Paetow