[c-nsp] passing ACL via radius - AAA Unsupported Attr
Christopher Hunt
dharmachris at gmail.com
Thu Sep 2 19:50:30 EDT 2010
Gurus,
I'm looking for a way to pass ACLs via radius. I'm running a 7206
with 12.4(9)T2 and Radiator 4.4 using a MySQL database. Authentication,
static IPs, framed-routes, and even policy route-maps are all working,
but not this! The docs seem to imply that is supported but I cannot
figure out which permutation of radius attributes to send.
...
126057: Sep 2 16:32:09 PDT: RADIUS/ENCODE(0920651A):Orig. component
type = PPoA
126058: Sep 2 16:32:09 PDT: RADIUS: AAA Unsupported Attr:
interface [158] 11
126059: Sep 2 16:32:09 PDT: RADIUS: 31 2F 30 2F 30 2F 31 2E
33 [1/0/0/1.3]
126060: Sep 2 16:32:09 PDT: RADIUS(0920651A): Config NAS IP: 10.10.55.241
126061: Sep 2 16:32:09 PDT: RADIUS/ENCODE(0920651A): acct_session_id:
153184998
126062: Sep 2 16:32:09 PDT: RADIUS(0920651A): sending
126063: Sep 2 16:32:09 PDT: RADIUS(0920651A): Send Access-Request to
10.10.24.3:1645 id 1645/142, len 92
126064: Sep 2 16:32:09 PDT: RADIUS: authenticator 3D 07 60 4D D7 4D 1C
35 - 31 D2 C5 B0 94 F7 C9 BB
126065: Sep 2 16:32:09 PDT: RADIUS: Framed-Protocol [7] 6
PPP [1]
126066: Sep 2 16:32:09 PDT: RADIUS: User-Name [1] 10
"dsl-test"
126067: Sep 2 16:32:09 PDT: RADIUS: CHAP-Password [3] 19 *
126068: Sep 2 16:32:09 PDT: RADIUS: NAS-Port-Type [61] 6
Virtual [5]
126069: Sep 2 16:32:09 PDT: RADIUS: NAS-Port [5] 6
0
126070: Sep 2 16:32:09 PDT: RADIUS: NAS-Port-Id [87] 13
"1/0/0/1.396"
126071: Sep 2 16:32:09 PDT: RADIUS: Service-Type [6] 6
Framed [2]
126072: Sep 2 16:32:09 PDT: RADIUS: NAS-IP-Address [4] 6
10.10.55.241
126073: Sep 2 16:32:10 PDT: RADIUS: Received from id 1645/142
10.10.24.3:1645, Access-Accept, len 225
126074: Sep 2 16:32:10 PDT: RADIUS: authenticator 61 4E 38 50 FF 7E 6E
DC - CC D6 4C A0 7E AE 4F 24
126075: Sep 2 16:32:10 PDT: RADIUS: Framed-IP-Address [8] 6
255.255.255.254
126076: Sep 2 16:32:10 PDT: RADIUS: Port-Limit [62] 6
1
126077: Sep 2 16:32:10 PDT: RADIUS: Framed-Compression [13] 6
None [0]
126078: Sep 2 16:32:10 PDT: RADIUS: Service-Type [6] 6
Framed [2]
126079: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 56
126080: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 50
"lcp:interface-config#2=ip unnumbered Loopback105"
126081: Sep 2 16:32:10 PDT: RADIUS: Session-Timeout [27] 6
604800
126082: Sep 2 16:32:10 PDT: RADIUS: Framed-Protocol [7] 6
PPP [1]
126083: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 55
126084: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 49
"lcp:interface-config#1=ip vrf forwarding TestCo"
126085: Sep 2 16:32:10 PDT: RADIUS: Filter-Id [11] 10
126086: Sep 2 16:32:10 PDT: RADIUS: 6D 79 66 69 6C 74 65
72 [myfilter]
126087: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 24
126088: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 18
"ip:vrf-id=TestCo"
126089: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 24
126090: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 18
"ip:vrf-id=TestCo"
126091: Sep 2 16:32:10 PDT: RADIUS(0920651A): Received from id 1645/142
126092: Sep 2 16:32:10 PDT: ppp1110 PPP: Received LOGIN Response PASS
My DB entry looks like this:
mysql> select * from RADSTCONFIG where name='vrf-test';
+----------+---------+-----------+--------+--------------------------------------------------+-----------+-----+
| NAME | ATTR_ID | VENDOR_ID | IVALUE |
SVALUE | ITEM_TYPE | UID |
+----------+---------+-----------+--------+--------------------------------------------------+-----------+-----+
| vrf-test | 8 | 0 | NULL |
255.255.255.254 | 10001 | 281 |
| vrf-test | 13 | 0 | 0 |
NULL | 10001 | 283 |
| vrf-test | 6 | 0 | 2 |
NULL | 10001 | 285 |
| vrf-test | 1 | 9 | 0 | lcp:interface-config#2=ip
unnumbered Loopback105 | 10001 | 329 |
| vrf-test | 27 | 0 | 604800 |
NULL | 10001 | 289 |
| vrf-test | 7 | 0 | 1 |
NULL | 10001 | 291 |
| vrf-test | 1 | 9 | 0 | lcp:interface-config#1=ip
vrf forwarding TestCo | 10001 | 327 |
| vrf-test | 11 | | 0 |
myfilter | 10001 | 321 |
+----------+---------+-----------+--------+--------------------------------------------------+-----------+-----+
the ACL exists:
rtr-1#show access-list myfilter
Extended IP access list myfilter
10 permit ip any any log
rtr-1#show users | inc qwest
Vi483 qwestdsl PPPoATM 00:00:00 205.134.214.19
but it's not applied to the Virtual-Interface
rtr-1#sh run int Vi483
Building configuration...
Current configuration : 249 bytes
!
interface Virtual-Access483
ip vrf forwarding TestCo
ip unnumbered Loopback105
ip verify unicast source reachable-via rx
no ip redirects
no ip unreachables
no logging event link-status
no snmp trap link-status
no snmp ifindex persist
end
The logs show "AAA Unsupported Attr: interface [158] 11 ". Is
that related?
anyone else doing this?
Thanks,
Chris
More information about the cisco-nsp
mailing list