I am trying to see if it is possible to use FreeRADIUS to filter certain request types before forwarding the request on to its final destination.

I have the following topology for RADIUS accounting packets.

WAP -> Aruba Clearpass (RADIUS Server) -> Fortigate (Firewall)

This is setup so that I can use RADIUS accounting packets to authenticate users to the firewall.

I have an issue where when a user is roaming between AP's the Accounting-Start packet arrives at the firewall from the New AP before the Accounting-Stop packet arrives from the Old AP. This causes the firewall authentication session to drop.

I would like to insert FreeRADIUS between Clearpass and Fortigate to only forward/proxy Accounting-Start packets.

FreeRADIUS is a big and confusing beast if you haven't used it before. I am hoping someone can point me in the right direction in terms of config type that is needed. I am happy to do the research, just need to know where to look.

I have tried the using the attr_filter

attr_filter attr_filter.accounting_request {
        key = "%{User-Name}"
        filename = ${modconfdir}/${.:name}/accounting_request

With the following config

        Acct-Status-Type == Start,
        Filter-Id =* ANY,
        User-Name =* ANY,
        Framed-IP-Address =* ANY

All this appears to do at the moment is remove the Acct-Status-Type attribute if it isn't of type Start. But lets the other details through.

  • 1
    So, when will the users' old sessions be dropped from the firewall, if Accounting-Stop packets aren't forwarded? This could open up a security issue. – Michael Hampton Feb 1 '17 at 6:23
  • Hi Michael, I understand this is a loaded gun. But I am holding it with full knowledge of the repercussions. But since you ask, all sessions get dropped winthin a couple of hours of no activity. This is no security issue, only an increase in end user satisfaction in not having to authenticate all the time because wireless roaming is causing their session to be dropped. – Littlejon Feb 1 '17 at 9:38
  • Which version of FreeRADIUS are you using? – Arran Cudbard-Bell Feb 1 '17 at 16:47
  • Centos 7 package "freeradius-3.0.4-7.el7_3.x86_64", I think I have it figured out now. Will do a little write up once I have cleaned up the config. – Littlejon Feb 1 '17 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.