<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2018-04-16 11:36, Johan Mulder
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:d13065f4-209d-6e03-e0f3-4a1f09cf2353@cambrium.nl">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
Hi,<br>
<br>
I'm currently looking into a setup on a Redback SE1200 in which
subscribers should be moved into separate contexts, depending on
the value of the Context radius attribute.<br>
The situation is like this:<br>
* Customer A and B should both have dedicated contexts in which
subscribers should be terminated.<br>
* There's a bunch of vlans in which PPP subscriber traffic is
delivered.<br>
* There's another bunch of vlans in which DHCP subscriber traffic
is delivered.<br>
<br>
The PPP configuration doesn't exist yet, but the DHCP
configuration does. DHCP subscribers are already<br>
bound to a dedicated context (through service clips dhcp context
ctx in dot1q pvc on-demand vlan X to Y), and that should not
change. Also, every<br>
non-global context should have it's own radius server
configuration to authenticate users against.<br>
<br>
So as I said there are vlans in which PPP subscriber traffic is
delivered. I radius it is known which context a user should be
routed to<br>
based on the information in the PADI tag (which I assume is
included in the authentication request). <br>
I know it is possible to configure global radius aaa through 'aaa
global authentication subscriber radius context local'. My
questions are:<br>
1. When enabling global aaa authentication, will this authenticate
the DHCP subscribers as well (as in all subscribers in all vlans),
even though they are explicitely bound to a context?<br>
</blockquote>
As far as I remember - yes<br>
<blockquote type="cite"
cite="mid:d13065f4-209d-6e03-e0f3-4a1f09cf2353@cambrium.nl"> 2. Is
it possible to globally authenticate PPP users, and delegate
additional authentication to an aaa configuration in the context
where the user will be bound to?<br>
(so basically that means the router should authenticate a user
twice, first one in the local context, second one in the bound
context)<br>
</blockquote>
In my opinion - no, but you might try in lab if this will work
(signe aaa operation)<br>
Maybe global will be used for all context without explicit radius
configuration, and context aaa for all contexts with explicit
radius.<br>
<br>
Marcin<br>
<br>
<blockquote type="cite"
cite="mid:d13065f4-209d-6e03-e0f3-4a1f09cf2353@cambrium.nl"> <br>
Thanks.<br>
<br>
<pre class="moz-signature" cols="72">--
Johan Mulder
Cambrium BV</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
redback-nsp mailing list
<a class="moz-txt-link-abbreviated" href="mailto:redback-nsp@puck.nether.net">redback-nsp@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/redback-nsp">https://puck.nether.net/mailman/listinfo/redback-nsp</a>
</pre>
</blockquote>
<p><br>
</p>
<div class="moz-signature">-- <br>
<p style="font-family: Helvetica, Arial, sans-serif; font-size:
12px; line-height: 14px; color: #999999;"><span id="name-input"
class="txt" style="font-weight: bold;">Marcin Kuczera</span> <span
id="title-sep">/</span> <span id="title-input" class="txt"
style="color: #999;">Wiceprezes Zarządu / CTO<span><br>
<span id="mobile-input" class="txt" style="color: #999;">+48
32 440 80 71<span id="email-sep" class="txt">/</span> <a
id="email-input" class="link email" style="color:
#51930b;" href="mailto:marcin.kuczera@leon.pl">marcin.kuczera@leon.pl</a></span></span></span></p>
<p style="font-family: Helvetica, Arial, sans-serif; font-size:
12px; line-height: 14px;"><span id="company-input" class="txt"
style="font-weight: bold; color: #999;">Leon Sp. z o.o.</span>
<span id="office-sep" class="txt" style="color: #999;"> </span>
<span id="address-sep"><br>
</span> <span id="address-input" class="txt" style="color:
#999;">ul. Kilińskiego 33d, 44-200 Rybnik </span><br>
<a id="website-input" class="link" style="color: #51930b;"
href="http://www.leon.pl/">http://www.leon.pl/</a></p>
<p id="disclaimer-input" class="txt" style="font-family:
Helvetica, Arial, sans-serif; color: #999999; font-size: 12px;
line-height: 14px;">INTERNET | TELEWIZJA | TELEFON</p>
<p style="font-family: Helvetica, Arial, sans-serif; font-size:
12px; line-height: 14px;"><span id="office-sep" class="txt"
style="color: #999;">KRS 0000223101 Sąd Rejonowy w Gliwicach<br>
<span id="mobile-input" class="txt" style="color: #999;"></span><span
id="mobile-input" class="txt" style="color: #999;"> Kapitał
zakładowy 576.700 zł<br>
<span id="mobile-input" class="txt" style="color: #999;"></span><span
id="mobile-input" class="txt" style="color: #999;"> NIP:
6332068698</span></span></span></p>
</div>
</body>
</html>