I currently run two virtual servers, one for our local secure wireless and one for eduroam customers.
The local one receives RADIUS packets from Bradford Campus Manager,
which is responsible for Network Access Control and stamps Auth-OK
replies with the VLAN for the user.
What I want to do is combine these wireless services, so that we just
have eduroam.
The functionality we will need, will be:
The requests will come to the eduroam server address.
if (no domain specified) then
who are ya?
fi
if (domain is non-local) then
proxy to user's home site.
fi
if (domain is local AND authenticating from a local NAS) then
authenticate locally by proxy to Bradford Campus Manager
(Campus Manager will receive the stripped u...@realm as user and
proxy to the local server address)
else
authenticate and return ACK/NACK to remote server in usual way for
one of our users visiting remote site
fi
The part I am not sure how to do is the last part, a conditional proxy
based on source NAS. I assume I need to dip into unlang, but can I put
that into the proxy.conf file?
realm local.site.ac.uk {
if( NAS-IP-Address ~= /192.168.*/ ) then # match my likely clients...
set-up A
else
set-up B
fi
}
Or whatever (I don't speak unlang, yet!), or have I got to determine
the source of the request somewhere else and use unlang to re-write
the realm to some special sentinel value that would be caught in
proxy.conf like:
realm local.site.ac.uk {
do the normal thing
}
realm special.local.site.ac.uk {
do the clever NAC proxy stuff
}
As usual, thanks for your time and hope someone can steer me in the
right direction before my head explodes.
(Yes I did read the docs, didn't help in this case!)
----------------------
Barry Dean
Principal Programmer/Analyst
Networks Group
Computing Services Department
<<attachment: h1_a.png>>
---
Nice boy, but about as sharp as a sack of wet mice.
-- Foghorn Leghorn
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
