[j-nsp] Ascend-??? radius attributes on Juniper ERX
Blaz Zupan
blaz at amis.net
Thu Mar 30 01:48:58 EST 2006
> Ok, as you can see in my lab setup it works fine.
> Therefor further troubleshooting is needed.
> A "log sev 7 radiusattributes" from the ERX would be helpful.
Getting the log will be the hardest part as the BRAS is owned by the incumbent
and they are rather hard to communicate with. If we had control of the BRAS
the problem would have probably been solved by now...
> If you tell me, what exact filter you try to setup I can verfiy it im my lab.
Here is an example filter that is being used in production on the Cisco BRAS,
but is completely ignored on the ERX. Also the Ascend-Client-Primary-DNS is
being ignored, we have to explicitely add the Unisphere-Primary-Dns attribute
for those users who connect through the ERX. Again please remember that the
Ascend attributes below are automatically being converted into abinary type by
our radius server.
DEFAULT Auth-Type = Accept
Framed-Routing = None,
Framed-Protocol = PPP,
Framed-IP-Address = 255.255.255.254,
Framed-IP-Netmask = 255.255.255.255,
Service-Type = Framed-User,
Idle-Timeout = 1800,
Ascend-Client-Primary-DNS = 212.18.32.10,
Ascend-Client-Secondary-DNS = 212.18.32.12
Ascend-Client-Assign-DNS = DNS-Assign-Yes,
Ascend-Data-Filter = "ip in forward tcp est",
Ascend-Data-Filter = "ip in drop tcp dstport = 135",
Ascend-Data-Filter = "ip in drop tcp dstport = 137",
Ascend-Data-Filter = "ip in drop tcp dstport = 138",
Ascend-Data-Filter = "ip in drop tcp dstport = 139",
Ascend-Data-Filter = "ip in drop tcp dstport = 445",
Ascend-Data-Filter = "ip in drop tcp dstport = 593",
Ascend-Data-Filter = "ip in drop udp dstport = 135",
Ascend-Data-Filter = "ip in drop udp dstport = 137",
Ascend-Data-Filter = "ip in drop udp dstport = 138",
Ascend-Data-Filter = "ip in drop udp dstport = 139",
Ascend-Data-Filter = "ip in forward",
Ascend-Data-Filter = "ip out forward tcp est",
Ascend-Data-Filter = "ip out drop tcp dstport = 135",
Ascend-Data-Filter = "ip out drop tcp dstport = 137",
Ascend-Data-Filter = "ip out drop tcp dstport = 138",
Ascend-Data-Filter = "ip out drop tcp dstport = 139",
Ascend-Data-Filter = "ip out drop tcp dstport = 445",
Ascend-Data-Filter = "ip out drop tcp dstport = 593",
Ascend-Data-Filter = "ip out drop udp dstport = 135",
Ascend-Data-Filter = "ip out drop udp dstport = 137",
Ascend-Data-Filter = "ip out drop udp dstport = 138",
Ascend-Data-Filter = "ip out drop udp dstport = 139",
Ascend-Data-Filter = "ip out forward"
More information about the juniper-nsp
mailing list