[Wimax TTLS with Alcatel - Lucent ASN GW]

[tnt at kalik.net]

>Using basic setup, Freeradius successfully authenticate request coming
>from CPE Wimax through ASN Alcatel GW (called WAC) using EAP/TTLS
>
>Fri Apr  3 01:05:10 2009 : Auth: Login OK: [00210400E0D7 at test.fr/<via
>Auth-Type = EAP>] (from client wimax port 0 cli 00-21-04-00-E0-D7)
>Fri Apr  3 01:05:19 2009 : Auth: Login OK: [cpe2-lab at test.fr/<via
>Auth-Type = mschap>] (from client wimax port 0 via TLS tunnel)
>
>I now have 2 issues to fill properly the access accept with correct
>attribute. (This needs might be weird, but it is the way this ASN GW works)
>
>1. I would like that the outer access accept contains  attributes coming
>from  the inner access accept
>
>So I tried to use the update outer.reply on post-auth section of the
>inner-tunnel virtual server
>
>        update outer.reply {
>                #User-Name = "%{request:User-Name}"
>                WiMAX-Packet-Data-Flow-Id =
>"%{request:WiMAX-Packet-Data-Flow-Id}"
>        }
>
>But as I understand, you can only use "request" from the inner tunnel,
>but not the attribute contained in the reply of the inner tunnel. Is
>that true ? Is there a way to do that.
>
>To be more precise this is the reply in the inner tunnel
>
>Fri Apr  3 01:13:33 2009
>        Packet-Type = Access-Accept
>        WiMAX-Packet-Data-Flow-Id = 1
>        WiMAX-Service-Data-Flow-Id = 1
>        WiMAX-Service-Profile-Id = 1
>        WiMAX-Direction = Bi-Directional
>        WiMAX-QoS-Id = 1
>        WiMAX-Media-Flow-Type = Robust-Browser
>        WiMAX-Schedule-Type = Best-Effort
>        WiMAX-Traffic-Priority = 0
>        WiMAX-Maximum-Sustained-Traffic-Rate = 512000
>        MS-CHAP2-Success =
>0xdf533d37443041423038393133393032414333353841304630414336383132453546434243364130323046
>        MS-MPPE-Recv-Key = 0x1d7c9b57392b589e2849640bad969199
>        MS-MPPE-Send-Key = 0x4aa107e5fa9573846af44d21c5080749
>        MS-MPPE-Encryption-Policy = 0x00000001
>        MS-MPPE-Encryption-Types = 0x00000006
>
>and the one in the outer tunnel
>
>Fri Apr  3 01:13:34 2009
>        Packet-Type = Access-Accept
>        MS-MPPE-Recv-Key =
>0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395
>        MS-MPPE-Send-Key =
>0x009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b
>        EAP-MSK =
>0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b
>        EAP-EMSK =
>0xc5f48626093f9313c5090254ffc375d4594bf6570025a260801e4b8d0ff852167d0748bd50b27d214b0ee67c1bbe1a4395faf094a8cb56663177fa8f32586f40
>        EAP-Message = 0x03f00004
>        Message-Authenticator = 0x00000000000000000000000000000000
>        User-Name = "00210400E0D7 at test.fr"
>
>
>I would like the reply of the outer tunnel to contain all the Wimax
>Attribute I got in the inner.
>

Set use_tunneled_reply in ttls section of eap.conf.

>2. For some weird reason again, Alcatel ASN needs to receive two times
>the same attribute with differente value (Actually this
>WiMAX-QoS-Descriptor (TLV Attribute))
>I guess this is not very compliant with RFC, but is there a way to send
>2 times the same attribute in the same reply.
>
>I've tried that but without surprise this send only the first part of
>the attribute
>
>cpe2-lab at test.fr Cleartext-Password := "xxx"
>        WiMAX-Packet-Data-Flow-Id=1,
>        WiMAX-Service-Data-Flow-Id=1,
>        WiMAX-Service-Profile-Id=1,
>        WiMAX-Direction=Bi-Directional,
>        WiMAX-QoS-Id=01,
>        WiMAX-Media-Flow-Type=Robust-Browser,
>        WiMAX-Schedule-Type=BEST-EFFORT,
>        WiMAX-Traffic-Priority=0,
>        WiMAX-Maximum-Sustained-Traffic-Rate=512000,
>        WiMAX-QoS-Id=02,
>        WiMAX-Media-Flow-Type=Robust-Browser,
>        WiMAX-Schedule-Type=BEST-EFFORT,
>        WiMAX-Traffic-Priority=0,
>        WiMAX-Maximum-Sustained-Traffic-Rate=512000
>
>
>Maybe using perl module in the post-auth ?
>

Use += operator and add them twice. In whatever module you added them
first time.

Ivan Kalik
Kalik Informatika ISP