Using "Tunnel-Private-Group-Id" in linelog
Dear freeradius-users, I´m using FreeRADIUS Version 2.1.12 to dynamically set the VLAN-ID on some switches by client-mac-address. Works like a charm. I have to modify the logfiles and would like to use linelog. This is my linelog config: linelog vlanlog { filename = ${logdir}/vlanlog permissions = 0600 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" Access-Request = "%S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. Put to VLAN %{reply:Tunnel-Private-Group-Id}" Access-Reject = "Rejected access: %{User-Name}" Access-Challenge = "Sent challenge: %{User-Name}" } And this is a Request and Reply for a VLAN-Request: rad_recv: Access-Request packet from host 192.168.1.141 port 1812, id=125, length=320 Framed-MTU = 1466 NAS-IP-Address = 192.168.1.141 NAS-Identifier = "Switch31" User-Name = "0cc47a96a6af" Service-Type = Call-Check Framed-Protocol = PPP NAS-Port = 41 NAS-Port-Type = Ethernet NAS-Port-Id = "41" Called-Station-Id = "00-16-b9-d1-01-d7" Calling-Station-Id = "0c-c4-7a-96-a6-af" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" ... MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server vlan { # Executing section authorize from file /etc/freeradius/sites-enabled/VLAN +- entering group authorize {...} ++[preprocess] returns ok ++? if (NAS-Identifier == "switch61" && NAS-Port-Id == "11") ? Evaluating (NAS-Identifier == "switch61" ) -> FALSE ? Skipping (NAS-Port-Id == "11") ++? if (NAS-Identifier == "switch61" && NAS-Port-Id == "11") -> FALSE ++- entering else else {...} [vlan_by_macaddr] users: Matched entry DEFAULT at line 8465 +++[vlan_by_macaddr] returns ok ++- else else returns ok [chap] WARNING: Auth-Type already set. Not setting to CHAP ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "0cc47a96a6af", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [0cc47a96a6af] (from client vlan_switch31 port 41 cli 0c-c4-7a-96-a6-af) # Executing section post-auth from file /etc/freeradius/sites-enabled/VLAN +- entering group post-auth {...} [vlanlog] expand: %{Packet-Type} -> Access-Request [vlanlog] expand: %{%{Packet-Type}:-format} -> Access-Request [vlanlog] expand: /var/log/freeradius/vlanlog -> /var/log/freeradius/vlanlog [vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. -> 2019-10-23 14:27:54: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. ++[vlanlog] returns ok } # server vlan Sending Access-Accept of id 125 to 192.168.1.141 port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\0001" Finished request 8. Going to the next request Waking up in 4.9 seconds. Im calling vlanlog only in post-auth { vlanlog Post-Auth-Type REJECT { vlanlog attr_filter.access_reject } } I would like to include the information in "Tunnel-Private-Group-Id" into the linelog. I´ve tried to add %{reply:Tunnel-Private-Group-Id} to the linelog config. But the result in vlanlog is: 2019-10-23 15:42:53: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. Put to VLAN How can i include the information in "Tunnel-Private-Group-Id" of Access-Accept into the linelog logfile? Thank you very much and best regards, Wolfgang
On Oct 23, 2019, at 9:52 AM, Burger, Wolfgang <wburger@gwdg.de> wrote:
I´m using FreeRADIUS Version 2.1.12 to dynamically set the VLAN-ID on some switches by client-mac-address.
Works like a charm.
That's good. But you should really use 2.2.10.
I have to modify the logfiles and would like to use linelog.
This is my linelog config:
OK, that should work.
And this is a Request and Reply for a VLAN-Request: .. [vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. -> 2019-10-23 14:27:54: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41.
Which is NOT the linelog configuration you posted above.
I would like to include the information in "Tunnel-Private-Group-Id" into the linelog.
I´ve tried to add %{reply:Tunnel-Private-Group-Id} to the linelog config.
The configuration you posted above shows you did tat,
But the result in vlanlog is:
2019-10-23 15:42:53: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. Put to VLAN
<sigh> Post the debug output from when it doesn't work. Why post the other debug out, from when you *didn't* add the VLAN information? If you want us to help you, you have to post the *relevant* debug output.
How can i include the information in "Tunnel-Private-Group-Id" of Access-Accept into the linelog logfile?
Configure it and it should work. If it doesn't, post the debug output from WHERE IT DOESN'T WORK. Alan DeKok.
Dear Alan, thank you for your reply and constructive feedback. You´re right, I´ve made a mistake while pasting the outputs together. Let me try again please. linelog config: linelog vlanlog { filename = ${logdir}/vlanlog permissions = 0600 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" Access-Request = "%S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. Put to VLAN %{reply:Tunnel-Private-Group-Id}" Access-Reject = "Rejected access: %{User-Name}" Access-Challenge = "Sent challenge: %{User-Name}" } Debug output: rad_recv: Access-Request packet from host 192.168.1.141 port 1812, id=101, length=320 Framed-MTU = 1466 NAS-IP-Address = 192.168.1.141 NAS-Identifier = "Switch31" User-Name = "0cc47a96a6af" Service-Type = Call-Check Framed-Protocol = PPP NAS-Port = 41 NAS-Port-Type = Ethernet NAS-Port-Id = "41" Called-Station-Id = "00-16-b9-d1-01-d7" Calling-Station-Id = "0c-c4-7a-96-a6-af" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server vlan { # Executing section authorize from file /etc/freeradius/sites-enabled/VLAN +- entering group authorize {...} ++[preprocess] returns ok ++? if (NAS-Identifier == "switch61" && NAS-Port-Id == "11") ? Evaluating (NAS-Identifier == "switch61" ) -> FALSE ? Skipping (NAS-Port-Id == "11") ++? if (NAS-Identifier == "switch61" && NAS-Port-Id == "11") -> FALSE ++- entering else else {...} [vlan_by_macaddr] users: Matched entry DEFAULT at line 8465 +++[vlan_by_macaddr] returns ok ++- else else returns ok [chap] WARNING: Auth-Type already set. Not setting to CHAP ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "0cc47a96a6af", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [0cc47a96a6af] (from client vlan_switch31 port 41 cli 0c-c4-7a-96-a6-af) # Executing section post-auth from file /etc/freeradius/sites-enabled/VLAN +- entering group post-auth {...} [vlanlog] expand: %{Packet-Type} -> Access-Request [vlanlog] expand: %{%{Packet-Type}:-format} -> Access-Request [vlanlog] expand: /var/log/freeradius/vlanlog -> /var/log/freeradius/vlanlog [vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. Put to VLAN %{reply:Tunnel-Private-Group-Id} -> 2019-10-23 16:17:39: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. Put to VLAN ++[vlanlog] returns ok } # server vlan Sending Access-Accept of id 101 to 192.168.1.141 port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\0001" Finished request 13. Going to the next request logfile entry: 2019-10-23 16:17:39: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. Put to VLAN ________________________________ Von: Freeradius-Users <freeradius-users-bounces+wburger=gwdg.de@lists.freeradius.org> im Auftrag von Alan DeKok <aland@deployingradius.com> Gesendet: Mittwoch, 23. Oktober 2019 16:02:20 An: FreeRadius users mailing list Betreff: Re: Using "Tunnel-Private-Group-Id" in linelog On Oct 23, 2019, at 9:52 AM, Burger, Wolfgang <wburger@gwdg.de> wrote:
I´m using FreeRADIUS Version 2.1.12 to dynamically set the VLAN-ID on some switches by client-mac-address.
Works like a charm.
That's good. But you should really use 2.2.10.
I have to modify the logfiles and would like to use linelog.
This is my linelog config:
OK, that should work.
And this is a Request and Reply for a VLAN-Request: .. [vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. -> 2019-10-23 14:27:54: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41.
Which is NOT the linelog configuration you posted above.
I would like to include the information in "Tunnel-Private-Group-Id" into the linelog.
I´ve tried to add %{reply:Tunnel-Private-Group-Id} to the linelog config.
The configuration you posted above shows you did tat,
But the result in vlanlog is:
2019-10-23 15:42:53: Access-Accept AAA-VLAN-Request for 0cc47a96a6af on Switch31 (192.168.1.141) at Port 41. Put to VLAN
<sigh> Post the debug output from when it doesn't work. Why post the other debug out, from when you *didn't* add the VLAN information? If you want us to help you, you have to post the *relevant* debug output.
How can i include the information in "Tunnel-Private-Group-Id" of Access-Accept into the linelog logfile?
Configure it and it should work. If it doesn't, post the debug output from WHERE IT DOESN'T WORK. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Oct 23, 2019, at 10:21 AM, Burger, Wolfgang <wburger@gwdg.de> wrote:
thank you for your reply and constructive feedback. You´re right, I´ve made a mistake while pasting the outputs together.
Let me try again please.
I'm always happy to have people try.
+- entering group post-auth {...} [vlanlog] expand: %{Packet-Type} -> Access-Request [vlanlog] expand: %{%{Packet-Type}:-format} -> Access-Request [vlanlog] expand: /var/log/freeradius/vlanlog -> /var/log/freeradius/vlanlog
OK, so it's not expanding %{reply:Tunnel-Private-Group-Id}. That's odd
Sending Access-Accept of id 101 to 192.168.1.141 port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\0001"
What's that? There's no need to add a binary 0x00 in front of the attribute. Where is the attribute coming from? Why not just set Tunnel-Private-Group-Id = "1" ? And TBH, it's 2.1.12. I can look at debug output, but that's it. There may be bugs, etc. which cause this problem. You should upgrade to 2.2.10, which is compatible with the configuration in 2.1.12. That way you know you have the most recent version, with all of the bug fixes. Alan DeKok.
Tunnel-Private-Group-Id:0 = "\0001"
What's that? There's no need to add a binary 0x00 in front of the attribute.
Where is the attribute coming from?
It comes from the users file. I have a list of all the devices and their vlan-id in there in the format: 0cc47a96a6af Cleartext-Password := "0cc47a96a6af" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "\\0001"
Why not just set Tunnel-Private-Group-Id = "1"
Honestly, I don´t remember. Been using the format of \\000X since forever and I was under the impression the switches need it to be that way. But I just tested it without the leading binary and it still works for the switch. And your nose works too, because without the zeros, the linelog config is working fine: vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. Put to VLAN %{reply:Tunnel-Private-Group-Id} -> 2019-10-23 16:58:25: Access-Accept AAA-VLAN-Request for 0023dfa2cb9e on switch54 (192.168.2.79) at Port 39. Put to VLAN 1 So thank you very much. My next steps: - Upgrade to 2.2.10 - Test wether all used switches are happy with the easier format of Tunnel-Private-Group-Id
On Oct 23, 2019, at 11:02 AM, Burger, Wolfgang <wburger@gwdg.de> wrote:
It comes from the users file. I have a list of all the devices and their vlan-id in there in the format:
0cc47a96a6af Cleartext-Password := "0cc47a96a6af" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "\\0001"
Yeah, you don't need the "\000"
Why not just set Tunnel-Private-Group-Id = "1"
Honestly, I don´t remember. Been using the format of \\000X since forever and I was under the impression the switches need it to be that way. But I just tested it without the leading binary and it still works for the switch. And your nose works too, because without the zeros, the linelog config is working fine:
Exactly. :)
vlanlog] expand: %S: %{reply:Packet-Type} AAA-VLAN-Request for %{User-Name} on %{NAS-Identifier} (%{NAS-IP-Address}) at Port %{NAS-Port-Id}. Put to VLAN %{reply:Tunnel-Private-Group-Id} -> 2019-10-23 16:58:25: Access-Accept AAA-VLAN-Request for 0023dfa2cb9e on switch54 (192.168.2.79) at Port 39. Put to VLAN 1
So thank you very much.
You're welcome.
My next steps: - Upgrade to 2.2.10 - Test wether all used switches are happy with the easier format of Tunnel-Private-Group-Id
They will be. If they don't like it, complain to the vendor that they're not following RFC 2868 Alan DeKok.
participants (2)
-
Alan DeKok -
Burger, Wolfgang