Re: RADIUS configuration based on source IP

2011-08-31 Thread Arran Cudbard-Bell
Proxies are not an issue today. They may be an issue in the future, though. It's likely that my proxy will itself by running freeradius. Does Client-IP-Address have the same problem with proxies? Yes. If yes, is there a workaround I can use on the proxy itself to populate

RADIUS configuration based on source IP

2011-08-31 Thread Jan . Weiss
I have a variety of Cisco devices that require mutually incompatible values in a certain RADIUS attribute, Cisco-AVPair. The way I have dealt with this in the past is with huntgroups -- I assign our engineer group on huntgroup1 to have Cisco-AVPair set to shell:roles=network-admin, while by

RADIUS configuration based on source IP

2011-08-30 Thread Morty
I have a variety of Cisco devices that require mutually incompatible values in a certain RADIUS attribute, Cisco-AVPair. The way I have dealt with this in the past is with huntgroups -- I assign our engineer group on huntgroup1 to have Cisco-AVPair set to shell:roles=network-admin, while by

Re: RADIUS configuration based on source IP

2011-08-30 Thread Arran Cudbard-Bell
On 30 Aug 2011, at 18:21, Morty wrote: I have a variety of Cisco devices that require mutually incompatible values in a certain RADIUS attribute, Cisco-AVPair. The way I have dealt with this in the past is with huntgroups -- I assign our engineer group on huntgroup1 to have Cisco-AVPair set

Re: RADIUS configuration based on source IP

2011-08-30 Thread Morty
On Tue, Aug 30, 2011 at 06:43:40PM +0200, Arran Cudbard-Bell wrote: On 30 Aug 2011, at 18:21, Morty wrote: but this device apparently also doesn't set NAS-IP-Address or NAS-Identifier, so the usual huntgroup mechanism doesn't work. Then its not in compliance with RFC 2865 and you should