(RADIATOR) Client Identifier and TACACS

[Hugh Irvine]

Hello Markus -

There is some confusion here due to the way TACACS+ is processed by  
Radiator.

In simple terms, the <ServerTACACSPLUS> clause for TACACS+ acts as  
the <Client ...> clause for RADIUS.

In other words, the <Client ...> clause(s) is used for RADIUS  
requests, and the <ServerTACACSPLUS> clause is used for TACACS+  
requests.

There is an extension to the <Client ...> clause only to allow  
different TACACSPLUSKey's to be defined for different devices.

However, all TACACS+ requests are received by the <ServerTACACSPLUS>  
clause.

hope that helps

regards

Hugh


On 4 Feb 2008, at 01:26, Markus Moeller wrote:

> I have the following configuration :
>
> .
> <ServerTACACSPLUS>
> .
> .
> </ServerTACACSPLUS>
> .
> <Client 192.168.1.1>
>     TACACSPLUSkey test
>     Identifier Location1
> </Client>
> <Client 192.168.10.1>
>     TACACSPLUSkey test2
>     Identifier Location1
> </Client>
> ...
>
> <Handler Client-Identifier=Location1>
> .
>   AuthBy Server1
> .
> </Handler>
>
> <Handler>
> .
>  AuthBy GlobalServer
> .
> </Handler>
>
>
> but I see on the debug that always the Handler with GlobalServer is  
> selected not the one with Client-identifier. Can I use the  
> Identifier only with Radius not with TACACS+  ?
>
> Sun Feb  3 14:16:28 2008: DEBUG: TACACSPLUS derived Radius request  
> packet dump:
> Code:       Access-Request
> Identifier: UNDEF
> Authentic:  <229><11>kl<238><235><230>^<217>?<228>3l<253><243><128>
> Attributes:
>         NAS-IP-Address = 192.168.1.1
>         NAS-Port-Id = "tty18"
>         Calling-Station-Id = "192.168.20.1"
>         Service-Type = Login-User
>         Request-Protocol = TACACS+
>         User-Name = "fred"
>         User-Password = test
>
> Sun Feb  3 14:16:28 2008: DEBUG: Handling request with Handler ''
>
> Is there a way to debug more ?
>
> Thank you
> Markus



NB:

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/ 
radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
Have you checked the RadiusExpert wiki:
http://www.open.com.au/wiki/index.php/Main_Page

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.


--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.