Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| en:dpi:bras_bng:use_cases:example_freradius3:start [2023/10/13 14:18] – ↷ Page moved from en:dpi:bras_bng:example_freradius3:start to en:dpi:bras_bng:use_cases:example_freradius3:start elena.krasnobryzh | en:dpi:bras_bng:use_cases:example_freradius3:start [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Example of how to configure FreeRadius3 ====== | ||
| - | {{indexmenu_n> | ||
| - | This section contains the minimal modifications to the FreeRadius3 configuration. | ||
| - | :!: These modifications should be considered only as an example of the FreeRadius configuration. Here we do not address the FreeRadius integration with a billing system or a database. | ||
| - | |||
| - | Suppose, the Radius server has been assigned IP address 192.168.1.200 and port 1812. | ||
| - | |||
| - | === VAS Experts dictionary === | ||
| - | First you should add a dictionary '' | ||
| - | * copy the dictionary ''/ | ||
| - | * add the following line to the main '' | ||
| - | < | ||
| - | |||
| - | === FastPCRF instantiating === | ||
| - | |||
| - | The parameters to establish connection with the Radius server should be specified in the fastpcrf.configuration file containing the fastPCRF instance (i.e. the Radius client) settings: | ||
| - | < | ||
| - | |||
| - | Here '' | ||
| - | |||
| - | Note that the Radius server settings and the client ones should match! | ||
| - | |||
| - | For each fastPCRF instance, the first step is to create a FreeRadius client. Let's name it the '' | ||
| - | |||
| - | Add to the Radius server raddb/ | ||
| - | < | ||
| - | client fastdpi1 { | ||
| - | ipaddr = 192.168.1.32 | ||
| - | secret = secret123 | ||
| - | require_message_authenticator = yes | ||
| - | # add_cui = yes | ||
| - | virtual_server = fastdpi-vs | ||
| - | } | ||
| - | </ | ||
| - | Here: | ||
| - | * ipaddr – specifies the fastPCRF instance IP address, it corresponds to 192.168.1.32 in our example | ||
| - | * secret – a unique secret, which is known to the Radius server and client (that is, the fastPCRF instance). The secret string value is user-defined. Note that the same secret is specified in the fastpcrf.conf settings: radius_server=secret123@192.168.1.200%eth0: | ||
| - | * require_message_authenticator – a flag specifying that the Radius request should containg the'' | ||
| - | * add_cui – do not set this option to '' | ||
| - | * virtual_server – specifies the name of the virtual server. Its configuration will be considered further. | ||
| - | | ||
| - | === Creating of the virtual server === | ||
| - | |||
| - | In order to configure a virtual server please copy the '' | ||
| - | * set the virtual server name - replace the line '' | ||
| - | * in the listen section for the auth requests (type = auth) specify IP address and port to be listened to (note that it corresponds to the local Radius server address): | ||
| - | < | ||
| - | port = 1812 | ||
| - | interface = eth0 | ||
| - | </ | ||
| - | * the rest sections of the '' | ||
| - | * all the main steps to form a response to Access-Request are specified within the post-auth section. It is impossible to provide any guidance because it relates the provider and the Radius server environment dependent information. A list of required attributes is described within the " | ||
| - | < | ||
| - | post-auth { | ||
| - | … | ||
| - | # | ||
| - | # Add VasExperts attributes | ||
| - | # | ||
| - | if ( Chargeable-User-Identity == 0x00 ) { | ||
| - | update reply { | ||
| - | Chargeable-User-Identity := " | ||
| - | } | ||
| - | } | ||
| - | else { | ||
| - | | ||
| - | | ||
| - | } | ||
| - | } | ||
| - | update reply { | ||
| - | Framed-IP-Address := " | ||
| - | VasExperts-Policing-Profile := " | ||
| - | VasExperts-Service-Profile | ||
| - | Session-Timeout := 300 | ||
| - | } | ||
| - | … | ||
| - | } | ||
| - | </ | ||
| - | * The cui option of the post-auth section is to be left commented out! FreeRadius passes a login hash value instead of the plain user login to the CUI. We should avoid that, so we'll create the CUI attribute withing the response according to the example above. | ||
| - | * Then add to the Post-Auth-Type REJECT section (Access-Reject forming) add following items | ||
| - | * CUI attribute in case the fastPCRF request it and the user is known; | ||
| - | * VasExperts-Policing-Profile attribute specifying the policing profile used by unauthorized users (in the example below the profile name is '' | ||
| - | * VasExperts-Service-Profile attribute specifying the service 5 profile (“Whitelist”). Typically this profile allows unauthorized users access just the Captive Portal. In the example below the profile name is '' | ||
| - | |||
| - | Example: | ||
| - | < | ||
| - | if (Chargeable-User-Identity == " | ||
| - | | ||
| - | Chargeable-User-Identity := " | ||
| - | } | ||
| - | } | ||
| - | update reply { | ||
| - | VasExperts-Policing-Profile := " | ||
| - | VasExperts-Service-Profile | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | === Users editing === | ||
| - | |||
| - | You should add two fastPCRF entries to the raddb/users file: | ||
| - | < | ||
| - | DEFAULT Cleartext-Password := " | ||
| - | |||
| - | The first entry specifies user name being sent by the fastPCRF in case of unknown login, more details see the '' | ||
| - | The second entry specifies the password used by the fastPCRF to send requests for known logins. | ||
| - | This password is specified in the fastPCRF, more details see the '' | ||