Filtering VLAN assignmen in eduroam

[Angel L. Mateo]

Hello,

	I'm using freeradius 3.0.10 to authenticate eduroam connections.

	In my inner server I return attributes to assign VLAN to our internal 
users and I want these attributes to be filtered when the connection is 
from an external organization.

	So in the outer server I have:

   post-proxy {
     eduroam_log
     files_eduroam_outer.authorize
     attr_filter.post-proxy
   }

	and in the attr_filter.post-proxy file I have:

DEFAULT
         Service-Type == Framed-User,
         Service-Type == Login-User,
         Login-Service == Telnet,
         Login-Service == Rlogin,
         Login-Service == TCP-Clear,
         Login-TCP-Port <= 65536,
         Framed-IP-Address == 255.255.255.254,
         Framed-IP-Netmask == 255.255.255.255,
         Framed-Protocol == PPP,
         Framed-Protocol == SLIP,
         Framed-Compression == Van-Jacobson-TCP-IP,
         Framed-MTU >= 576,
         Framed-Filter-ID =* ANY,
         Reply-Message =* ANY,
         Proxy-State =* ANY,
         EAP-Message =* ANY,
         Message-Authenticator =* ANY,
         MS-MPPE-Recv-Key =* ANY,
         MS-MPPE-Send-Key =* ANY,
         MS-CHAP-MPPE-Keys =* ANY,
         State =* ANY,
         Session-Timeout <= 28800,
         Idle-Timeout <= 600,
         Calling-Station-Id =* ANY,
         Operator-Name =* ANY,
         Port-Limit <= 2,
         GSS-Acceptor-Service-Name =* ANY,
         GSS-Acceptor-Host-Name =* ANY,
         GSS-Acceptor-Service-Specifics =* ANY,
         GSS-Acceptor-Realm-Name =* ANY,
         SAML-AAA-Assertion =* ANY,
         EAP-Channel-Binding-Message =* ANY


	According to attr_filter documentation, if I don't have the 
Tunnel-Private-Group-Id in this file, then the attribute should be 
filtered, isn't it?

	But, the attribute is not being filtered. It is returned to my upper 
radius server.

	Any help?

-- 
Angel L. Mateo Martínez
Sección de Telemática
Área de Tecnologías de la Información
y las Comunicaciones Aplicadas (ATICA)
http://www.um.es/atica
Tfo: 868887590
Fax: 868888337