conditional attribute rewrite.

[Michael Schwartzkopff]

On 09.12.20 12:53, Benedikt Sveinsson wrote:
> I have a particular problem with our service structure
>
> We are getting rid of old freeradius servers that have been operational for years and centralizing everything into two radius servers
>
>
> Due to different access networks , Some users are connected to BNG services that can only terminate or forward to a LNS
>
> The users (realm) that are forwarded to the LNS first get a response from our prod radius with modified attributes through the legacy attr file were we add the VPDN config, and then proxied to the old legacy Radius. Our Old LNS then receives the session and authenticates with the legacy radius.
>
> Client -> BNG  - radius to prod Radius – gets VPDN info towards LNS and proxies auth to legacy radius.
> Client -> LNS  - authenticates to the legacy radius
>
> This is all and well, but we have new LNS routers that are going to be terminating these sessions.
>
> Now the issue is that I need to be able (if possible to only rewrite the attr (insert LNS / VPN info) if the requests comes from the BNG gateways as they can‘t terminate some of the special realms. (only do normal pppoe users)
> But when the auth requests comes from the LNS – it shoud not get the VPDN config – else it will just loop.
>
> Is it possible to conditionally add the attributes I need based on the NAS / NAS-IP or some other identifier ?
> (basically I‘m using the routers both for LNS and terminate locally)
>
> I have searched and I‘m bit lost both between the legacy config and „new“.
>
> - Benni
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


Yes. You can add conditions to your servers configs. See:

https://networkradius.com/doc/3.0.10/unlang/home.html


Perhaps you also could group your radius clients (Access Servers) into
huntgroups and base your conditions on these huntgroups.

https://wiki.freeradius.org/config/Huntgroups


I solved a similar problem defining different virtual servers and
defining which client uses which server. See virtual_server statement in
the clients.conf



Mit freundlichen Grüßen,

-- 

[*] sys4 AG
 
https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München
 
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief
Aufsichtsratsvorsitzender: Florian Kirstein


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20201209/6c05a35c/attachment.sig>