I am trying to see if it is possible to use FreeRADIUS to filter certain request types before forwarding the request on to its final destination.
I have the following topology for RADIUS accounting packets.
WAP -> Aruba Clearpass (RADIUS Server) -> Fortigate (Firewall)
This is setup so that I can use RADIUS accounting packets to authenticate users to the firewall.
I have an issue where when a user is roaming between AP's the Accounting-Start packet arrives at the firewall from the New AP before the Accounting-Stop packet arrives from the Old AP. This causes the firewall authentication session to drop.
I would like to insert FreeRADIUS between Clearpass and Fortigate to only forward/proxy Accounting-Start packets.
FreeRADIUS is a big and confusing beast if you haven't used it before. I am hoping someone can point me in the right direction in terms of config type that is needed. I am happy to do the research, just need to know where to look.
I have tried the using the attr_filter
attr_filter attr_filter.accounting_request {
key = "%{User-Name}"
filename = ${modconfdir}/${.:name}/accounting_request
}
With the following config
DEFAULT
Acct-Status-Type == Start,
Filter-Id =* ANY,
User-Name =* ANY,
Framed-IP-Address =* ANY
All this appears to do at the moment is remove the Acct-Status-Type attribute if it isn't of type Start. But lets the other details through.