.
Support for Groups
RADIUS authentication supports the specification of groups for a user. This means that a user can
also be specified as being in the
administrators
or
auditors
group.
Note: Set the RADIUS Vendor ID for group membership
If the RADIUS server is required to send the group membership, it is necessary to use the
user group vendor specific attribute vendor when configuring the server. The
NetDefendOS
Vendor ID
is 5089 and the user group is defined as vendor-type 1 with a
string value type.
Automatic IP Address Allocation
With IPsec, L2TP and PPTP tunnels for roaming clients, it is possible for NetDefendOS to
automatically allocate IP addresses as part of the RADIUS authentication process.
Depending on how it is configured, a RADIUS server can optionally return IP address information
to NetDefendOS in its
Access-Accept
message when it authenticates a client. NetDefendOS will
automatically recognize and use the following parameters in a RADIUS
Accept-Access
message:
•
Framed-IP-Address
This parameter is an IP address allocated for the client which NetDefendOS automatically will
send to the connecting client as a part of the tunnel negotiation.
•
Framed-IP-Netmask
In some cases, the client might be a network device, such as another firewall with a network
behind it. The
Framed-IP-Netmask
parameter requires that the
Framed-IP-Address
is also
present in the
Access-Accept
message. The netmask together with the IP address is combined
to form a route which will be sent to the client as a part of the tunnel negotiation as a
definition of the network behind the client.
•
Framed-Route
This can be sent by the RADIUS server instead of
Framed-IP-Address
and
Framed-IP-Netmask
.
The route will be sent to the client as a part of the tunnel negotiation as a definition of the
network behind the client.
This IP address information will be automatically sent to the client in either of the following ways:
•
During the IKE negotiation phase of IPsec tunnel setup.
•
Over PPP when setting up an L2TP or PPTP tunnel.
In addition, NetDefendOS will automatically add a route to its configuration if either the
Framed-IP-Address
,
Framed-Route
or the
Framed-IP-Address
along with
Framed-IP-Netmask
parameter is received. The automatic addition of this route can be controlled in the normal way
by setting the relevant property in the tunnel object for the automatic addition of routes.
Example 8.3. Configuring a RADIUS Server
Chapter 8: User Authentication
615
Содержание NetDefendOS
Страница 30: ...Figure 1 3 Packet Flow Schematic Part III Chapter 1 NetDefendOS Overview 30 ...
Страница 32: ...Chapter 1 NetDefendOS Overview 32 ...
Страница 144: ...Chapter 2 Management and Maintenance 144 ...
Страница 220: ... Enable DHCP passthrough Enable L2 passthrough for non IP protocols 4 Click OK Chapter 3 Fundamentals 220 ...
Страница 267: ... SourceNetwork lannet DestinationInterface any DestinationNetwork all nets 4 Click OK Chapter 3 Fundamentals 267 ...
Страница 284: ...Chapter 3 Fundamentals 284 ...
Страница 360: ...The ospf command options are fully described in the separate NetDefendOS CLI Reference Guide Chapter 4 Routing 360 ...
Страница 392: ...Chapter 4 Routing 392 ...
Страница 396: ...Web Interface 1 Go to Network Ethernet If1 2 Select Enable DHCP 3 Click OK Chapter 5 DHCP Services 396 ...
Страница 419: ... Host 2001 DB8 1 MAC 00 90 12 13 14 15 5 Click OK Chapter 5 DHCP Services 419 ...
Страница 420: ...Chapter 5 DHCP Services 420 ...
Страница 424: ...2 Now enter Name lan_Access Action Expect Interface lan Network lannet 3 Click OK Chapter 6 Security Mechanisms 424 ...
Страница 573: ...Chapter 6 Security Mechanisms 573 ...
Страница 575: ...This section describes and provides examples of configuring NAT and SAT rules Chapter 7 Address Translation 575 ...
Страница 607: ...Chapter 7 Address Translation 607 ...
Страница 666: ...Chapter 8 User Authentication 666 ...
Страница 775: ...Chapter 9 VPN 775 ...
Страница 819: ...Chapter 10 Traffic Management 819 ...
Страница 842: ...Chapter 11 High Availability 842 ...
Страница 866: ...Default Enabled Chapter 13 Advanced Settings 866 ...
Страница 879: ...Chapter 13 Advanced Settings 879 ...