Could you give a working Packet of Disconnect example cause it will not work if I eliminate "X-Ascend-Session-Svr-Key" or set a NULL value for it.
You don't need X-Ascend-Session-Srv-Key and i've removed it from the example on the wiki...
-Arran
Thanks. I did what you said but it seems that there must be a NAS to get the packet on port 3799 and disconnect the user for me. I have everything on a single machine and there is not any standalone hardware or something to act as a NAS. PPTP and L2TP/IPSec processes serve dialin users and freeRADIUS is used to authenticate them. Is there any lightweight software that I can use as a NAS to solve this? Thanks in advance. Moby
Mobin Yazarlou wrote:
Thanks. I did what you said but it seems that there must be a NAS to get the packet on port 3799 and disconnect the user for me. I have everything on a single machine and there is not any standalone hardware or something to act as a NAS. PPTP and L2TP/IPSec processes serve dialin users and freeRADIUS is used to authenticate them. Is there any lightweight software that I can use as a NAS to solve this?
$ man l2tp It should have the ability to close connections via a command-line tool. Then, run a script on FreeRADIUS to use that command-line tool. Why are you working hard to find a complicated solution? If it's all on one machine, the solutions are simple. Alan DeKok.
Thanks. I did what you said but it seems that there must be a NAS to get the packet on port 3799 and disconnect the user for me. I have everything on a single machine and there is not any standalone hardware or something to act as a NAS. PPTP and L2TP/IPSec processes serve dialin users and freeRADIUS is used to authenticate them. Is there any lightweight software that I can use as a NAS to solve this?
$ man l2tp
It should have the ability to close connections via a command-line tool. Then, run a script on FreeRADIUS to use that command-line tool. Why are you working hard to find a complicated solution? If it's all on one machine, the solutions are simple. Alan DeKok.
Thanks Alan, that looks pretty easy. For a single machine and a single dialin service that must work very well but I have some other services like PPTP and OpenVPN and will have to run RADIUS and VPN services on different machines when the number of users grow.
Not to my knowledge. CoA and DM extensions are relatively recent (in RADIUS terms) so not that many vendors or projects have implemented them. If your VPN daemon doesn't support DM, then your best bet is SNMP, just fire off a script with the exec module. The only reason why you'd absolutely need to use DM is if the packets had to navigate a network of RADIUS proxy
servers, otherwise SNMP works just as well.
If your VPN daemon doesn't support SNMP, see if it has a control socket, then write something in perl/python/ruby to translate SNMP requests, or just requests on another INET socket.
Good luck :) -Arran
Thanks Arran. Honestly, I don't have any idea about CoA and DM but I know that I can use SNMP on the server which runs Debian 6.0. This might be out of the RADIUS scope but I need a little bit more information on this to work it out. How should I send the PoD to SNMP? Will SNMP handle such request by default or I have to set it up for this? Even a useful URL would be a great help cause I couldn't find anything by googling the keywords came to my mind. Thanks, Moby
Mobin Yazarlou wrote:
Thanks Alan, that looks pretty easy. For a single machine and a single dialin service that must work very well but I have some other services like PPTP and OpenVPN and will have to run RADIUS and VPN services on different machines when the number of users grow.
Well... the machines are connected by a network. Use network protocols to do things.
Thanks Arran. Honestly, I don't have any idea about CoA and DM but I know that I can use SNMP on the server which runs Debian 6.0. This might be out of the RADIUS scope but I need a little bit more information on this to work it out. How should I send the PoD to SNMP? Will SNMP handle such request by default or I have to set it up for this?
If you're going to write your own NAS, then you will need to understand how a NAS works. You'll also have to write *all* of the software for a NAS, including user disconnection.
Even a useful URL would be a great help cause I couldn't find anything by googling the keywords came to my mind.
If you're writing your own NAS, then those questions aren't on-topic for the FreeRADIUS list, sorry. We can help you with FreeRADIUS questions. For everything else, there's google. Alan DeKok.
Thanks Arran. Honestly, I don't have any idea about CoA and DM but I know that I can use SNMP on the server which runs Debian 6.0. This might be out of the RADIUS scope but I need a little bit more information on this to work it out. How should I send the PoD to SNMP? Will SNMP handle such request by default or I have to set it up for this?
Forget about using DM if its not supported by the daemon. I'm saying write a simple script on the RADIUS server that does an SNMP set on the required OIDs registered by your VPN daemon on your remote machine. Or just write a simple daemon in perl to call the command line utility on the remote server.
Even a useful URL would be a great help cause I couldn't find anything by googling the keywords came to my mind.
Here's an example of translating SNMP requests into status requests for FreeRADIUS. https://github.com/alandekok/freeradius-server/tree/master/scripts/snmp-prox... -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
On 20 Aug 2011, at 14:43, Mobin Yazarlou wrote:
Could you give a working Packet of Disconnect example cause it will not work if I eliminate "X-Ascend-Session-Svr-Key" or set a NULL value for it.
You don't need X-Ascend-Session-Srv-Key and i've removed it from the example on the wiki...
-Arran
Thanks. I did what you said but it seems that there must be a NAS to get the packet on port 3799 and disconnect the user for me.
Yes.
I have everything on a single machine and there is not any standalone hardware or something to act as a NAS. PPTP and L2TP/IPSec processes serve dialin users and freeRADIUS is used to authenticate them. Is there any lightweight software that I can use as a NAS to solve this?
Not to my knowledge. CoA and DM extensions are relatively recent (in RADIUS terms) so not that many vendors or projects have implemented them. If your VPN daemon doesn't support DM, then your best bet is SNMP, just fire off a script with the exec module. The only reason why you'd absolutely need to use DM is if the packets had to navigate a network of RADIUS proxy servers, otherwise SNMP works just as well. If your VPN daemon doesn't support SNMP, see if it has a control socket, then write something in perl/python/ruby to translate SNMP requests, or just requests on another INET socket. Good luck :) -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Mobin Yazarlou