Duplicate IPs for Radius Clients with different secrets

[Eric Geier]

Opps I didn't see this message at first.

Does this go along with what Alan was thinking?

If I understand what you said, I would only need one IP entry (the Internet
IP) in the config file for each location, right?

Most of these locations will be using dynamic Internet IPs; I'm not sure
how'd I keep the config updated. Plus this would make each location/network
use the same shared secret among all their APs, which I want to prevent.

The best solution I can think of that I want to mimic is SecureMyWiFi from
WiTopia, a hosted radius service (www.witopia.net). Their service works just
like I want.

Thanks, Eric

> -----Original Message-----
> From: freeradius-users-bounces+me=egeier.com at lists.freeradius.org
> [mailto:freeradius-users-bounces+me=egeier.com at lists.freeradius.org] On
> Behalf Of Paul Bartell
> Sent: Tuesday, December 16, 2008 2:13 AM
> To: FreeRadius users mailing list
> Subject: Re: Duplicate IPs for Radius Clients with different secrets
> 
> Okay. What you need to do is set ips in the client configuraiton file
> for each of the APs that is going to be authenticating by using their
> external ip address, which is where the connection will appear to come
> from to freeradius. do a freeradius -X and it should be quite
> explanatory, when you try to connect through an AP to it.
> 
> On Mon, Dec 15, 2008 at 6:56 PM, Eric Geier <me at egeier.com> wrote:
> >> >Hi, I'm wondering if someone can point me in the right direction. I
> >> want to
> >> >list radius clients with the same IPs (and different shared
> secrets).
> >> This
> >> >would let me use freeradius among multiple offices, where each
> could
> >> use the
> >> >same IP addresses for the radius clients.
> >>
> >> And how is routing going to work there? How is radius server suposed
> to
> >> send the response back to the correct client? This can work only if
> >> carry radius server from office to office so it works a little bit
> >> here,
> >> little bit there. If you connect those clients onto a network they
> will
> >> all stop working (or, at best, first one you put on the network will
> >> work but others won't).
> >>
> >> Ivan Kalik
> >> Kalik Informatika ISP
> >
> > I'm not exactly sure. How does a RADIUS server work over the
> Internet? I'm
> > not connecting the radius clients onto the same LAN. If a radius
> request
> > comes in from the internet, would the server send responses to the
> Internet
> > IP that it received it from (which I think would work for my case) or
> would
> > it send to the radius client IP?
> >
> > Here's what I'm trying to do:
> > Host a radius server on the Internet...for PEAP 802.1X (WPA-
> enterprise).
> > Each AP at the different offices would be set with the Internet IP
> address
> > of where the radius server is running, along with a shared secret.
> There
> > would likely be APs set to the same IP address, that's why I'm asking
> about
> > all this.
> >
> >> > Hi, I'm wondering if someone can point me in the right direction.
> I
> >> want to
> >> > list radius clients with the same IPs (and different shared
> secrets).
> >> This
> >> > would let me use freeradius among multiple offices, where each
> could
> >> use the
> >> > same IP addresses for the radius clients. I need something very
> >> dynamic;
> >> > manually creating virtual servers in the config file won't work
> well.
> >>
> >>   RADIUS doesn't work that way.
> >>
> >>   Shared secrets are per client IP.  Each client IP is used to look
> up
> >> the shared secret.  You can't have multiple shared secrets for one
> IP.
> >>
> >> > Right now I'm using v1.188.2.4.2.14
> >>
> >>   That's not the server version number.
> >>
> >>   Use "radiusd -v" to get the version information.
> >>
> >>   Alan DeKOk.
> >
> > I know it traditionally doesn't, just checking to see what people
> think and
> > if I might find a way to do what I want to do.
> >
> > What got me thinking something like this could work is when using a
> > different server, I thought I could modify the SQL select statement
> that's
> > used to find the shared secret. For example, the default is "select
> > SharedSecret from NASES where ClientIPAddress='$c'" I thought I could
> just
> > add the following to the end "and where Domain=(function that takes
> the
> > domain from the username...after the @)  I found that server can't
> register
> > the username attribute during the select statement...so it all didn't
> work.
> >
> > Opps. I'm using v1.1.7 because at the moment I'm using FreeRadius.net
> on
> > Windows
> >
> > Thanks for your help guys - Eric
> >
> >
> >
> > -
> > List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
> >
> 
> 
> 
> --
> Random quote of the week/month/whenever i get to updating it:
> "Opportunity knocked. My doorman threw him out." - Adrienne Gusoff
> 
> "At school you don't get parole, good behavior only brings a longer
> sentence." - The History Boys
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
> 
> 
> No virus found in this incoming message.
> Checked by AVG - http://www.avg.com
> Version: 8.0.176 / Virus Database: 270.9.18/1850 - Release Date:
> 12/15/2008 5:04 PM