On 10/18/2010 05:05 PM, Zietz, Marco wrote:
I am curious if somebody could share information how to get FR as DHCP
with option 82 authentication up and running. Couldn't find much
information in provided sample files and on the net. My own experiments
with auth configs were not particularly successful. The key I am missing
What have you tried? Why didn't it work?
is the link between having DHCP-Relay-Circuit-Id in DHCP-Request and
DHCP-Discover messages and kicking in some kind of auth in order to
return a DHCP-Offer/Ack message including a client IP out of the
configured IP pools. Backend is mysql.
As with most things in FreeRadius, the key (pardon the pun) is
determining what data is in the input packet, what data you want in the
reply and what key/value lookup you need to do to achieve that.
The difficulty with DHCP is that you really need to do the following:
start transaction
select ip from pool where key=... and not used
update ip set used=true where ip=...
commit
add ip to reply packet
The "rlm_sqlippool" module does this for example, but the queries it
executes are perhaps not suited to DHCP allocation; I haven't tried it.
If your DHCP pools are simple - one IP per switch/port and no pools -
then you could just do:
update reply {
DHCP-Your-IP-Address = "%{sql:select ip from opt82 where
switch='%{DHCP-Agent-Remote-Id}' and port='%{DHCP-Agent-Circuit-Id}'}"
}
...but this may cause problems without proper lease management.
I have the feeling that most users straight heading for rlm_perl and not
using the ppp/chap/pap alike chain. This I would understand since the
handshakes differ. Confirmation of this thesis would help me as well, so
I can stop searching and start coding ;o)
I don't recognise the terminology you use here: "handshakes"?
In pretty much all modes, FreeRadius is a system for processing
attribute/value pairs and generating replies. DHCP is "just another"
encoding for AVPs with the slightly complex aspect that lease management
needs to be (a bit) transactional, so anything other than fixed mac->IP
mappings needs a bit of work. That is why people may use perl or things
more complex than unlang/rlm_passwd - the need for transactional lease
allocation.
I suspect few people are using FreeRadius for DHCP in anger yet, which
explains why you have found little info, but I'm sure it can do it. If
you can provide more info about what you've tried that doesn't work...
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
