Using unlang to customize Tunnel-Medium-Type for 3com switches
Hi, my problem: I use RADA on 2 lines of 3com switches: - those with ComWare 5 expect Radius to return Tunnel-Medium-Type = "IEEE-802" - those with ComWare 3 expect Tunnel-Medium-Type = "802" Of course, in users, I can use only one of those values, as follows: f0-0f-de-ad-f0-01 Cleartext-Password := "f0-0f-de-ad-f0-01" Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id := 3, Tunnel-Type = VLAN Fortunately, after switching Radius mode on Comware3 switches to "extended", they started to introduce themselves: rad_recv: Access-Request packet from host 172.23.30.70 port 41201, id=97, length=130 User-Name = "f0-0f-de-ad-f0-01" User-Password = "f0-0f-de-ad-f0-01" NAS-IP-Address = 172.23.30.210 NAS-Identifier = "deadbeef1e02" NAS-Port = 16867329 NAS-Port-Id = "unit=1;subslot=0;port=22;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "f00f-dead-f001" 3Com-Connect_Id = 9 3Com-Product-ID = "4200G" 3Com-NAS-Startup-Timestamp = 954636905 I can see 3Com-Product-ID = "4200G", and I would like to change Tunnel-Medium-Type to 802 if I see it. After looking at unlang man page - explains the basics, but show no examples; radiusd.conf - still no examples; and googling - some examples, but I counted 4 of them (maybe I searched the wrong way, but see for yourself what does "unlang examples" yield) I decided to write here for help. From what I read, I should add the condition in "post-auth" section. As I understand it, it should look like this: if ( "%{request:3Com-Product-ID}" == "4200G" ) { update reply { Tunnel-Medium-Type = "802" } } is that about right? (and yes, I should find that by myself, only explanation is that test system setup would take ~3-4 hrs and I can't do testing on production - whereas I count on you being able to tell right from wrong in about ~5 sec). Thanks in advance, Stan
Stanisław Kamiński wrote:
After looking at unlang man page - explains the basics, but show no examples; radiusd.conf - still no examples; and googling - some examples, but I counted 4 of them (maybe I searched the wrong way, but see for yourself what does "unlang examples" yield) I decided to write here for help.
raddb/policy.conf has a number of examples.
From what I read, I should add the condition in "post-auth" section. As I understand it, it should look like this:
if ( "%{request:3Com-Product-ID}" == "4200G" ) { update reply { Tunnel-Medium-Type = "802" } }
Or simpler: if (3Com-Product-Id == "4200G") { ... } The "%{request:...}" isn't needed.
is that about right? (and yes, I should find that by myself, only explanation is that test system setup would take ~3-4 hrs and I can't do testing on production - whereas I count on you being able to tell right from wrong in about ~5 sec).
Asking good questions is good. Alan DeKok.
On 20 Sep 2011, at 19:59, Stanisław Kamiński wrote:
Hi, my problem: I use RADA on 2 lines of 3com switches: - those with ComWare 5 expect Radius to return Tunnel-Medium-Type = "IEEE-802" - those with ComWare 3 expect Tunnel-Medium-Type = "802"
Oh wow, that's exceptionally retarded. Can you complain to 3COM tech support? Section 3.31 of RFC3580 lists the tunnel attributes as: Tunnel-Type=VLAN (13) Tunnel-Medium-Type=802 Tunnel-Private-Group-ID=VLANID The RFC author(s) obviously made a mistake, it should have been Tunnel-Type=VLAN (13) Tunnel-Medium-Type=802 (6) Tunnel-Private-Group-ID=VLANID Absolutely no RFC lists 802 (integer) as a valid value for Tunnel-Medium-Type... It's an enumerated integer attribute *sigh*. It seems that this has been discussed before however.... http://psg.com/lists/radiusext/2007/msg00854.html ... so no point in ranting about it again
if ( "%{request:3Com-Product-ID}" == "4200G" ) { update reply { Tunnel-Medium-Type = "802" } }
is that about right? (and yes, I should find that by myself, only explanation is that test system setup would take ~3-4 hrs and I can't do testing on production - whereas I count on you being able to tell right from wrong in about ~5 sec).
Though the if statement should probably be if(3Com-Product-ID == '4200G'){ -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Hi, I just wanted to share what I did in the end. First of all, it turned out that 3com actually interprets "IEEE-802" in proper way - and there was no need for unlang. However I'm glad I learned how it (unlang) works, and had to learn a bit more about RADIUS :-) So nothing's wasted. There were two causes as to why the switch didn't work at first: it turns out that Comware3 switches (such as 4200G) have to have both authentication and authorization servers set up (hardly surprising), and I failed to do this :-) Shame on me. However, I've also found strange behaviour. Comware3 configuration allows for different VLAN indication modes in "domain" section: vlan-assignment-mode ? integer Integer Vlan assignment mode string String Vlan assignment mode vlan-list List Vlan assignment mode I'm not sure why, but if it works in "integer" mode (default), it switches port to "RADIUS-indicated-VLAN"+48 - so when RADIUS sends Tunnel-Private-Group-ID=4, the port goes to VLAN 52. Can't figure out why. But when I switched mode to "string" (which is supposed to work with VLAN names, not numbers - but interprets numbers nevertheless) - it work perfectly. Knowing unlang helped debugging this A LOT! So thank you very much for your support, it would've taken me much longer to figure it all out without it. /br Stan
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Stanisław Kamiński -
stasheck