Freeradius authentication for VSP VOSS Switch
Hello List, I have been trying to authenticate using radius with Extreme VSP switch, the radius seems to accept the authentication, but the switch still fails Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 131.232.33.8 port 44016, id=243, length=68 User-Name = "test" User-Password = "test" NAS-IP-Address = 131.232.33.8 NAS-Port = 1 NAS-Port-Type = Async Service-Type = Administrative-User # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry test at line 2 ++[files] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = updated +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "test" [pap] Using clear text password "test" [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 243 to 131.232.33.8 port 44016 Service-Type = Administrative-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 243 with timestamp +73 Ready to process requests. ------------- ssh test@131.232.33.8 Using security software from Mocana Corporation. Please visit https://www.mocana.com/ for more information Copyright(c) 2010-2022 Extreme Networks. All Rights Reserved. Virtual Services Platform 7200 VSP Operating System Software Build 8.8.0.0 General Availability Released Software, Fully supported This product is protected by one or more US patents listed at http://www.extremenetworks.com/patents along with their foreign counterparts. EXTREME NETWORKS VOSS COMMAND LINE INTERFACE test@131.232.33.8's password: Permission denied, please try again. test@131.232.33.8's password: ------ 1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH session closed by server for user test on host 131.232.90.103, session_id = 2 1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH authentication time expired for user test on host 131.232.90.103, session_id = 2 1 2023-03-02T17:00:23.615-07:00 LAB7K902 CP1 - 0x0004060b - 00000000 GlobalRouter WEB INFO SSL session with client 131.232.90.103 closed. 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH invalid username/password for user test on host 131.232.90.103, session_id = 2 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message: 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45c0 - 00000000 GlobalRouter RADIUS INFO RADIUS authentication failed on server 131.232.33.170 1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message: Thank you, Shamsher
This is a problem with the switch/NAS, not with freeradius. On March 3, 2023 1:07:27 AM GMT+01:00, shamsher singh <mr.shamshersingh@gmail.com> wrote:
Hello List,
I have been trying to authenticate using radius with Extreme VSP switch, the radius seems to accept the authentication, but the switch still fails
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 131.232.33.8 port 44016, id=243, length=68
User-Name = "test"
User-Password = "test"
NAS-IP-Address = 131.232.33.8
NAS-Port = 1
NAS-Port-Type = Async
Service-Type = Administrative-User
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "test", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] = noop
[eap] No EAP-Message, not doing EAP
++[eap] = noop
[files] users: Matched entry test at line 2
++[files] = ok
++[expiration] = noop
++[logintime] = noop
++[pap] = updated
+} # group authorize = updated
Found Auth-Type = PAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group PAP {
[pap] login attempt with password "test"
[pap] Using clear text password "test"
[pap] User authenticated successfully
++[pap] = ok
+} # group PAP = ok
# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+group post-auth {
++[exec] = noop
+} # group post-auth = noop
Sending Access-Accept of id 243 to 131.232.33.8 port 44016
Service-Type = Administrative-User
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 243 with timestamp +73
Ready to process requests.
-------------
ssh test@131.232.33.8
Using security software from Mocana Corporation. Please visit https://www.mocana.com/ for more information
Copyright(c) 2010-2022 Extreme Networks.
All Rights Reserved.
Virtual Services Platform 7200
VSP Operating System Software Build 8.8.0.0
General Availability Released Software, Fully supported
This product is protected by one or more US patents listed at http://www.extremenetworks.com/patents along with their foreign counterparts.
EXTREME NETWORKS VOSS COMMAND LINE INTERFACE
test@131.232.33.8's password:
Permission denied, please try again.
test@131.232.33.8's password:
------
1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH session closed by server for user test on host 131.232.90.103, session_id = 2
1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH authentication time expired for user test on host 131.232.90.103, session_id = 2
1 2023-03-02T17:00:23.615-07:00 LAB7K902 CP1 - 0x0004060b - 00000000 GlobalRouter WEB INFO SSL session with client 131.232.90.103 closed.
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH invalid username/password for user test on host 131.232.90.103, session_id = 2
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message:
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45c0 - 00000000 GlobalRouter RADIUS INFO RADIUS authentication failed on server 131.232.33.170
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message:
Thank you, Shamsher - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
As per the Extreme support https://extremeportal.force.com/ExtrArticleDetail?an=000056602&q=voss%20radi... Resolution The RADIUS process includes: RADIUS authentication, which you can use to identify remote users before you give them access to a central network site. RADIUS accounting, which enables data collection on the server during a remote user’s dial-in session with the client. Radius Server Attributes for ERS Stackables Radius Standard Outbound Attribute Service-Type (6) Outbound Value NAS-Prompt (7) for read only or Administrative (6) for rw Radius Server Attributes for VOSS Platforms, ERS 8800, VSP 9000 Vendor ID 1584 (Nortel/Avaya) Outbound Attribute Access-Priority (192) Outbound Value RWA (6) RW (5) l3 (4) l2 (3) l1 (2) ro (1) none (0) eg : "Free Radius" Script : VENDOR Nortel 1584 BEGIN-VENDOR Nortel ATTRIBUTE Access-Priority 192 integer VALUE Access-Priority none 0 VALUE Access-Priority ro 1 VALUE Access-Priority l1 2 VALUE Access-Priority l2 3 VALUE Access-Priority l3 4 VALUE Access-Priority rw 5 VALUE Access-Priority rwa 6 #CLI Commands ATTRIBUTE Cli-Commands 193 string #CLI profile ATTRIBUTE Command-Access 194 integer VALUE Command-Access False 0 VALUE Command-Access True 1 #CLI Commands ATTRIBUTE Commands 195 string #802 priority (value: 0-7) ATTRIBUTE EAP-Port-Priority 1 integer END-VENDOR Nortel I am not sure what else to configure on the switch or on the Freeradius. On Fri, Mar 3, 2023 at 2:20 AM marki <jm+freeradiususer@roth.lu> wrote:
This is a problem with the switch/NAS, not with freeradius.
Hello List,
I have been trying to authenticate using radius with Extreme VSP switch, the radius seems to accept the authentication, but the switch still fails
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 131.232.33.8 port 44016, id=243, length=68
User-Name = "test"
User-Password = "test"
NAS-IP-Address = 131.232.33.8
NAS-Port = 1
NAS-Port-Type = Async
Service-Type = Administrative-User
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "test", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] = noop
[eap] No EAP-Message, not doing EAP
++[eap] = noop
[files] users: Matched entry test at line 2
++[files] = ok
++[expiration] = noop
++[logintime] = noop
++[pap] = updated
+} # group authorize = updated
Found Auth-Type = PAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group PAP {
[pap] login attempt with password "test"
[pap] Using clear text password "test"
[pap] User authenticated successfully
++[pap] = ok
+} # group PAP = ok
# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+group post-auth {
++[exec] = noop
+} # group post-auth = noop
Sending Access-Accept of id 243 to 131.232.33.8 port 44016
Service-Type = Administrative-User
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 243 with timestamp +73
Ready to process requests.
-------------
ssh test@131.232.33.8
Using security software from Mocana Corporation. Please visit https://www.mocana.com/ for more information
Copyright(c) 2010-2022 Extreme Networks.
All Rights Reserved.
Virtual Services Platform 7200
VSP Operating System Software Build 8.8.0.0
General Availability Released Software, Fully supported
This product is protected by one or more US patents listed at http://www.extremenetworks.com/patents along with their foreign counterparts.
EXTREME NETWORKS VOSS COMMAND LINE INTERFACE
test@131.232.33.8's password:
Permission denied, please try again.
test@131.232.33.8's password:
------
1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH session closed by server for user test on host 131.232.90.103, session_id = 2
1 2023-03-02T17:00:37.225-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH authentication time expired for user test on host 131.232.90.103, session_id = 2
1 2023-03-02T17:00:23.615-07:00 LAB7K902 CP1 - 0x0004060b - 00000000 GlobalRouter WEB INFO SSL session with client 131.232.90.103 closed.
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000d8602 - 00000000 GlobalRouter SSH INFO SSH invalid username/password for user test on host 131.232.90.103, session_id = 2
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message:
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45c0 - 00000000 GlobalRouter RADIUS INFO RADIUS authentication failed on server 131.232.33.170
1 2023-03-02T16:59:40.417-07:00 LAB7K902 CP1 - 0x000a45fc - 00000000 GlobalRouter RADIUS INFO Radius message:
Thank you, Shamsher - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On March 3, 2023 1:07:27 AM GMT+01:00, shamsher singh <mr.shamshersingh@gmail.com> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 3, 2023, at 7:48 PM, shamsher singh <mr.shamshersingh@gmail.com> wrote:
As per the Extreme support
Copying web pages to the mailing list won't help.
eg : "Free Radius" Script :
That's a dictionary. We know what it is. We already have copies.
I am not sure what else to configure on the switch or on the Freeradius.
It's a networking issue, or a shared secret issue. FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine. Something else in the network is broken. We don't know what it is. But we do know that it's not FreeRADIUS. This is not a problem we can help with. Alan DeKok.
It looks like you are sending attribute that your switch doesn't recognize. Maybe you should send something like Access-Priority = 6 instead of Service-Type = Administrative-User Maybe your switch rejects all access requests that contain unrecognized attributes. Also, you should include freeradius dictionary in freeradius in case you didn't. Igor On 4.3.23. 02:18, Alan DeKok wrote:
On Mar 3, 2023, at 7:48 PM, shamsher singh<mr.shamshersingh@gmail.com> wrote:
As per the Extreme support Copying web pages to the mailing list won't help.
eg : "Free Radius" Script : That's a dictionary. We know what it is. We already have copies.
I am not sure what else to configure on the switch or on the Freeradius. It's a networking issue, or a shared secret issue.
FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine.
Something else in the network is broken. We don't know what it is. But we do know that it's not FreeRADIUS.
This is not a problem we can help with.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
How would I configure the following on the Freeradius, the following works on the Windows server 2016 radius client. The following are the default RADIUS Vendor Specific Attribute values supported by VOSS switches. The same attribute values need to be configured on RADIUS server. The RADIUS server needs to be configured to send the Vendor Specific Attribute (VSA), identified as Attribute 26, back to the VSP containing the following values: - The Vendor Code value for the Vendor Specific Attribute is: 1584. - The Vendor Assigned Attribute Number for the Vendor Specific Attribute is 192. - The Attribute Format for the Vendor Specific Attribute is: decimal. - The Attribute Value for the Vendor Specific Attribute is 6. Attribute 26 which is the Vendor-Specific attribute (VSA) within RADIUS which encapsulates vendor specific attributes. Attribute 26 allows vendors to support their own custom attributes. Shamsher On Sat, Mar 4, 2023 at 6:02 AM Igor Smitran <sigor@blic.net> wrote:
It looks like you are sending attribute that your switch doesn't recognize.
Maybe you should send something like
Access-Priority = 6
instead of
Service-Type = Administrative-User
Maybe your switch rejects all access requests that contain unrecognized attributes.
Also, you should include freeradius dictionary in freeradius in case you didn't.
Igor
On Mar 3, 2023, at 7:48 PM, shamsher singh<mr.shamshersingh@gmail.com> wrote:
As per the Extreme support Copying web pages to the mailing list won't help.
eg : "Free Radius" Script : That's a dictionary. We know what it is. We already have copies.
I am not sure what else to configure on the switch or on the Freeradius. It's a networking issue, or a shared secret issue.
FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine.
Something else in the network is broken. We don't know what it is. But we do know that it's not FreeRADIUS.
This is not a problem we can help with.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp:// www.freeradius.org/list/users.html
On 4.3.23. 02:18, Alan DeKok wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Look at the freeradius dictionary files: dictionary.nortel (VENDOR id 562) or dictionary.bay (Vendor ID 1584 - Bay-Networks is now Nortel) I don't know what do you want to accomplish with attribute 26? In case you don't have needed attributes you can add them to files mentioned above. For example: to dictionary.bay (id 1584) add lines: ATTRIBUTE Access-Priority 192 integer ATTRIBUTE Cli-Commands 193 string ATTRIBUTE Command-Access 194 integer ATTRIBUTE Commands 195 string ATTRIBUTE EAP-Port-Priority 196 integer In your freeradius dictionary config file add include line for your bay dictionary: $INCLUDE /usr/share/freeradius/dictionary.bay Igor On 23.3.23. 23:01, shamsher singh wrote:
How would I configure the following on the Freeradius, the following works on the Windows server 2016 radius client.
The following are the default RADIUS Vendor Specific Attribute values supported by VOSS switches. The same attribute values need to be configured on RADIUS server.
The RADIUS server needs to be configured to send the Vendor Specific Attribute (VSA), identified as Attribute 26, back to the VSP containing the following values:
- The Vendor Code value for the Vendor Specific Attribute is: 1584. - The Vendor Assigned Attribute Number for the Vendor Specific Attribute is 192. - The Attribute Format for the Vendor Specific Attribute is: decimal. - The Attribute Value for the Vendor Specific Attribute is 6.
Attribute 26 which is the Vendor-Specific attribute (VSA) within RADIUS which encapsulates vendor specific attributes. Attribute 26 allows vendors to support their own custom attributes.
Shamsher
On Sat, Mar 4, 2023 at 6:02 AM Igor Smitran<sigor@blic.net> wrote:
It looks like you are sending attribute that your switch doesn't recognize.
Maybe you should send something like
Access-Priority = 6
instead of
Service-Type = Administrative-User
Maybe your switch rejects all access requests that contain unrecognized attributes.
Also, you should include freeradius dictionary in freeradius in case you didn't.
Igor
On Mar 3, 2023, at 7:48 PM, shamsher singh<mr.shamshersingh@gmail.com> wrote:
As per the Extreme support Copying web pages to the mailing list won't help.
eg : "Free Radius" Script : That's a dictionary. We know what it is. We already have copies.
I am not sure what else to configure on the switch or on the Freeradius. It's a networking issue, or a shared secret issue.
FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine.
Something else in the network is broken. We don't know what it is. But we do know that it's not FreeRADIUS. This is not a problem we can help with.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp:// www.freeradius.org/list/users.html
On 4.3.23. 02:18, Alan DeKok wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
The Radius Server needs to send the VSP switch Vendor Specific Attribute (VSA) identified as Attribute 26 - The Vendor Code value for the Vendor Specific Attribute is: 1584. - The Vendor Assigned Attribute Number for the Vendor Specific Attribute is 192. - The Attribute Format for the Vendor Specific Attribute is: decimal. - The Attribute Value for the Vendor Specific Attribute is 6. I need to know how to define VSA in Freeradius, the way the windows radius server defines it, please see the link it shows how its defined on the windows radius https://extremeportal.force.com/ExtrArticleDetail?an=000057339 Shamsher On Thu, Mar 23, 2023 at 5:39 PM Igor Smitran <sigor@blic.net> wrote:
Look at the freeradius dictionary files:
dictionary.nortel (VENDOR id 562) or dictionary.bay (Vendor ID 1584 - Bay-Networks is now Nortel)
I don't know what do you want to accomplish with attribute 26?
In case you don't have needed attributes you can add them to files mentioned above.
For example:
to dictionary.bay (id 1584) add lines:
ATTRIBUTE Access-Priority 192 integer
ATTRIBUTE Cli-Commands 193 string
ATTRIBUTE Command-Access 194 integer
ATTRIBUTE Commands 195 string
ATTRIBUTE EAP-Port-Priority 196 integer
In your freeradius dictionary config file add include line for your bay dictionary:
$INCLUDE /usr/share/freeradius/dictionary.bay
Igor
How would I configure the following on the Freeradius, the following works on the Windows server 2016 radius client.
The following are the default RADIUS Vendor Specific Attribute values supported by VOSS switches. The same attribute values need to be configured on RADIUS server.
The RADIUS server needs to be configured to send the Vendor Specific Attribute (VSA), identified as Attribute 26, back to the VSP containing the following values:
- The Vendor Code value for the Vendor Specific Attribute is: 1584. - The Vendor Assigned Attribute Number for the Vendor Specific Attribute is 192. - The Attribute Format for the Vendor Specific Attribute is: decimal. - The Attribute Value for the Vendor Specific Attribute is 6.
Attribute 26 which is the Vendor-Specific attribute (VSA) within RADIUS which encapsulates vendor specific attributes. Attribute 26 allows vendors to support their own custom attributes.
Shamsher
On Sat, Mar 4, 2023 at 6:02 AM Igor Smitran<sigor@blic.net> wrote:
It looks like you are sending attribute that your switch doesn't recognize.
Maybe you should send something like
Access-Priority = 6
instead of
Service-Type = Administrative-User
Maybe your switch rejects all access requests that contain unrecognized attributes.
Also, you should include freeradius dictionary in freeradius in case you didn't.
Igor
On Mar 3, 2023, at 7:48 PM, shamsher singh<mr.shamshersingh@gmail.com> wrote:
As per the Extreme support Copying web pages to the mailing list won't help.
eg : "Free Radius" Script : That's a dictionary. We know what it is. We already have copies.
I am not sure what else to configure on the switch or on the Freeradius. It's a networking issue, or a shared secret issue.
FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine.
Something else in the network is broken. We don't know what it is. But we do know that it's not FreeRADIUS. This is not a problem we can help with.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp:// www.freeradius.org/list/users.html
On 4.3.23. 02:18, Alan DeKok wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? Seehttp:// www.freeradius.org/list/users.html
On 23.3.23. 23:01, shamsher singh wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Where are you getting stuck, or what part are you having trouble with ? > On Mar 24, 2023, at 12:12 AM, shamsher singh <mr.shamshersingh@gmail.com> wrote: > > The Radius Server needs to send the VSP switch Vendor Specific Attribute > (VSA) identified as Attribute 26 > > > - The Vendor Code value for the Vendor Specific Attribute is: 1584. > - The Vendor Assigned Attribute Number for the Vendor Specific Attribute > is 192. > - The Attribute Format for the Vendor Specific Attribute is: decimal. > - The Attribute Value for the Vendor Specific Attribute is 6. > > > I need to know how to define VSA in Freeradius, the way the windows radius > server defines it, please see the link it shows how its defined on the > windows radius > > https://extremeportal.force.com/ExtrArticleDetail?an=000057339 > > Shamsher > >> On Thu, Mar 23, 2023 at 5:39 PM Igor Smitran <sigor@blic.net> wrote: >> >> Look at the freeradius dictionary files: >> >> dictionary.nortel (VENDOR id 562) or dictionary.bay (Vendor ID 1584 - >> Bay-Networks is now Nortel) >> >> I don't know what do you want to accomplish with attribute 26? >> >> In case you don't have needed attributes you can add them to files >> mentioned above. >> >> >> For example: >> >> to dictionary.bay (id 1584) add lines: >> >> ATTRIBUTE Access-Priority 192 integer >> >> ATTRIBUTE Cli-Commands 193 string >> >> ATTRIBUTE Command-Access 194 integer >> >> ATTRIBUTE Commands 195 string >> >> ATTRIBUTE EAP-Port-Priority 196 integer >> >> >> In your freeradius dictionary config file add include line for your bay >> dictionary: >> >> $INCLUDE /usr/share/freeradius/dictionary.bay >> >> >> Igor >> >> >>> On 23.3.23. 23:01, shamsher singh wrote: >>> How would I configure the following on the Freeradius, the following >> works >>> on the Windows server 2016 radius client. >>> >>> The following are the default RADIUS Vendor Specific Attribute values >>> supported by VOSS switches. The same attribute values need to be >> configured >>> on RADIUS server. >>> >>> The RADIUS server needs to be configured to send the Vendor Specific >>> Attribute (VSA), identified as Attribute 26, back to the VSP containing >> the >>> following values: >>> >>> - The Vendor Code value for the Vendor Specific Attribute is: 1584. >>> - The Vendor Assigned Attribute Number for the Vendor Specific >> Attribute >>> is 192. >>> - The Attribute Format for the Vendor Specific Attribute is: decimal. >>> - The Attribute Value for the Vendor Specific Attribute is 6. >>> >>> Attribute 26 which is the Vendor-Specific attribute (VSA) within RADIUS >>> which encapsulates vendor specific attributes. Attribute 26 allows >> vendors >>> to support their own custom attributes. >>> >>> Shamsher >>> >>>> On Sat, Mar 4, 2023 at 6:02 AM Igor Smitran<sigor@blic.net> wrote: >>> >>>> It looks like you are sending attribute that your switch doesn't >> recognize. >>>> >>>> Maybe you should send something like >>>> >>>> Access-Priority = 6 >>>> >>>> instead of >>>> >>>> Service-Type = Administrative-User >>>> >>>> Maybe your switch rejects all access requests that contain unrecognized >>>> attributes. >>>> >>>> Also, you should include freeradius dictionary in freeradius in case you >>>> didn't. >>>> >>>> >>>> Igor >>>> >>>> On 4.3.23. 02:18, Alan DeKok wrote: >>>>> On Mar 3, 2023, at 7:48 PM, shamsher singh<mr.shamshersingh@gmail.com> >>>> wrote: >>>>>> As per the Extreme support >>>>> Copying web pages to the mailing list won't help. >>>>> >>>>>> eg : "Free Radius" Script : >>>>> That's a dictionary. We know what it is. We already have copies. >>>>> >>>>>> I am not sure what else to configure on the switch or on the >> Freeradius. >>>>> It's a networking issue, or a shared secret issue. >>>>> >>>>> FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine. >>>>> >>>>> Something else in the network is broken. We don't know what it is. >>>> But we do know that it's not FreeRADIUS. >>>>> This is not a problem we can help with. >>>>> >>>>> Alan DeKok. >>>>> >>>>> - >>>>> List info/subscribe/unsubscribe? Seehttp:// >>>> www.freeradius.org/list/users.html >>>> - >>>> List info/subscribe/unsubscribe? See >>>> http://www.freeradius.org/list/users.html >>>> >>> - >>> List info/subscribe/unsubscribe? Seehttp:// >> www.freeradius.org/list/users.html >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
After configuring dictionary.bay as suggested by Igor, the Freeradius server is not sending RADIUS: radGenVendorValpairs: vendor_id = 1584 RADIUS: radGenValpairs: len = 6 I am not sure what needs to be configured in the users file to send these attributes. Shamsher On Fri, Mar 24, 2023 at 5:53 AM Jonathan Davis <jonathan@prioritycolo.com> wrote: > Where are you getting stuck, or what part are you having trouble with ? > > > On Mar 24, 2023, at 12:12 AM, shamsher singh <mr.shamshersingh@gmail.com> > wrote: > > > > The Radius Server needs to send the VSP switch Vendor Specific Attribute > > (VSA) identified as Attribute 26 > > > > > > - The Vendor Code value for the Vendor Specific Attribute is: 1584. > > - The Vendor Assigned Attribute Number for the Vendor Specific > Attribute > > is 192. > > - The Attribute Format for the Vendor Specific Attribute is: decimal. > > - The Attribute Value for the Vendor Specific Attribute is 6. > > > > > > I need to know how to define VSA in Freeradius, the way the windows > radius > > server defines it, please see the link it shows how its defined on the > > windows radius > > > > https://extremeportal.force.com/ExtrArticleDetail?an=000057339 > > > > Shamsher > > > >> On Thu, Mar 23, 2023 at 5:39 PM Igor Smitran <sigor@blic.net> wrote: > >> > >> Look at the freeradius dictionary files: > >> > >> dictionary.nortel (VENDOR id 562) or dictionary.bay (Vendor ID 1584 - > >> Bay-Networks is now Nortel) > >> > >> I don't know what do you want to accomplish with attribute 26? > >> > >> In case you don't have needed attributes you can add them to files > >> mentioned above. > >> > >> > >> For example: > >> > >> to dictionary.bay (id 1584) add lines: > >> > >> ATTRIBUTE Access-Priority 192 integer > >> > >> ATTRIBUTE Cli-Commands 193 string > >> > >> ATTRIBUTE Command-Access 194 integer > >> > >> ATTRIBUTE Commands 195 string > >> > >> ATTRIBUTE EAP-Port-Priority 196 integer > >> > >> > >> In your freeradius dictionary config file add include line for your bay > >> dictionary: > >> > >> $INCLUDE /usr/share/freeradius/dictionary.bay > >> > >> > >> Igor > >> > >> > >>> On 23.3.23. 23:01, shamsher singh wrote: > >>> How would I configure the following on the Freeradius, the following > >> works > >>> on the Windows server 2016 radius client. > >>> > >>> The following are the default RADIUS Vendor Specific Attribute values > >>> supported by VOSS switches. The same attribute values need to be > >> configured > >>> on RADIUS server. > >>> > >>> The RADIUS server needs to be configured to send the Vendor Specific > >>> Attribute (VSA), identified as Attribute 26, back to the VSP containing > >> the > >>> following values: > >>> > >>> - The Vendor Code value for the Vendor Specific Attribute is: 1584. > >>> - The Vendor Assigned Attribute Number for the Vendor Specific > >> Attribute > >>> is 192. > >>> - The Attribute Format for the Vendor Specific Attribute is: > decimal. > >>> - The Attribute Value for the Vendor Specific Attribute is 6. > >>> > >>> Attribute 26 which is the Vendor-Specific attribute (VSA) within RADIUS > >>> which encapsulates vendor specific attributes. Attribute 26 allows > >> vendors > >>> to support their own custom attributes. > >>> > >>> Shamsher > >>> > >>>> On Sat, Mar 4, 2023 at 6:02 AM Igor Smitran<sigor@blic.net> wrote: > >>> > >>>> It looks like you are sending attribute that your switch doesn't > >> recognize. > >>>> > >>>> Maybe you should send something like > >>>> > >>>> Access-Priority = 6 > >>>> > >>>> instead of > >>>> > >>>> Service-Type = Administrative-User > >>>> > >>>> Maybe your switch rejects all access requests that contain > unrecognized > >>>> attributes. > >>>> > >>>> Also, you should include freeradius dictionary in freeradius in case > you > >>>> didn't. > >>>> > >>>> > >>>> Igor > >>>> > >>>> On 4.3.23. 02:18, Alan DeKok wrote: > >>>>> On Mar 3, 2023, at 7:48 PM, shamsher singh< > mr.shamshersingh@gmail.com> > >>>> wrote: > >>>>>> As per the Extreme support > >>>>> Copying web pages to the mailing list won't help. > >>>>> > >>>>>> eg : "Free Radius" Script : > >>>>> That's a dictionary. We know what it is. We already have copies. > >>>>> > >>>>>> I am not sure what else to configure on the switch or on the > >> Freeradius. > >>>>> It's a networking issue, or a shared secret issue. > >>>>> > >>>>> FreeRADIUS sends an Access-Accept. FreeRADIUS is working fine. > >>>>> > >>>>> Something else in the network is broken. We don't know what it > is. > >>>> But we do know that it's not FreeRADIUS. > >>>>> This is not a problem we can help with. > >>>>> > >>>>> Alan DeKok. > >>>>> > >>>>> - > >>>>> List info/subscribe/unsubscribe? Seehttp:// > >>>> www.freeradius.org/list/users.html > >>>> - > >>>> List info/subscribe/unsubscribe? See > >>>> http://www.freeradius.org/list/users.html > >>>> > >>> - > >>> List info/subscribe/unsubscribe? Seehttp:// > >> www.freeradius.org/list/users.html > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >
On 24/03/2023 14:17, shamsher singh wrote:
After configuring dictionary.bay as suggested by Igor, the Freeradius server is not sending
RADIUS: radGenVendorValpairs: vendor_id = 1584
RADIUS: radGenValpairs: len = 6
I am not sure what needs to be configured in the users file to send these attributes.
That attribute is already in dictionary.bay. There should be no need to define anything. Search through the dictionary files and you'll find vendor 1584 in dictionary.bay Look in that file and you'll find attribute 192 defined as Passport-Access-Priority Look at the values for that attribute and you'll find value 6 is Read-Write-All-Access So the information is all there already. In the users file do something like username Passport-Access-Priority := Read-Write-All-Access to return that attribute for user 'username', or e.g. see the users file for how to return it for all users using DEFAULT. -- Matthew
On Mar 24, 2023, at 12:11 AM, shamsher singh <mr.shamshersingh@gmail.com> wrote:
The Radius Server needs to send the VSP switch Vendor Specific Attribute (VSA) identified as Attribute 26 ...
Yes, this is how RADIUS works.
I need to know how to define VSA in Freeradius,
The VSAs are already defined in the dictionaries. All you need to do is: 1) read the dictionaries to see what the VSA names are (see dictionary.bay) 2) configure the "users" file, or something similar with the attribute and value. There is extensive documentation on how to get FreeRADIUS to send attributes in replies. Please read it. See the example configuration files, Wiki, "man" pages, etc. Alan DeKok.
参加者 (6)
-
Alan DeKok -
Igor Smitran -
Jonathan Davis -
marki -
Matthew Newton -
shamsher singh