0

I am trying to see if it is possible to use FreeRADIUS to filter certain request types before forwarding the request on to its final destination.

I have the following topology for RADIUS accounting packets.

WAP -> Aruba Clearpass (RADIUS Server) -> Fortigate (Firewall)

This is setup so that I can use RADIUS accounting packets to authenticate users to the firewall.

I have an issue where when a user is roaming between AP's the Accounting-Start packet arrives at the firewall from the New AP before the Accounting-Stop packet arrives from the Old AP. This causes the firewall authentication session to drop.

I would like to insert FreeRADIUS between Clearpass and Fortigate to only forward/proxy Accounting-Start packets.

FreeRADIUS is a big and confusing beast if you haven't used it before. I am hoping someone can point me in the right direction in terms of config type that is needed. I am happy to do the research, just need to know where to look.

I have tried the using the attr_filter

attr_filter attr_filter.accounting_request {
        key = "%{User-Name}"
        filename = ${modconfdir}/${.:name}/accounting_request
}

With the following config

DEFAULT
        Acct-Status-Type == Start,
        Filter-Id =* ANY,
        User-Name =* ANY,
        Framed-IP-Address =* ANY

All this appears to do at the moment is remove the Acct-Status-Type attribute if it isn't of type Start. But lets the other details through.

4
  • 1
    So, when will the users' old sessions be dropped from the firewall, if Accounting-Stop packets aren't forwarded? This could open up a security issue. Feb 1, 2017 at 6:23
  • Hi Michael, I understand this is a loaded gun. But I am holding it with full knowledge of the repercussions. But since you ask, all sessions get dropped winthin a couple of hours of no activity. This is no security issue, only an increase in end user satisfaction in not having to authenticate all the time because wireless roaming is causing their session to be dropped.
    – Littlejon
    Feb 1, 2017 at 9:38
  • Which version of FreeRADIUS are you using? Feb 1, 2017 at 16:47
  • Centos 7 package "freeradius-3.0.4-7.el7_3.x86_64", I think I have it figured out now. Will do a little write up once I have cleaned up the config.
    – Littlejon
    Feb 1, 2017 at 21:38

0

You must log in to answer this question.

Browse other questions tagged .