Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation  Back up to About Overview 
  
[+] Expand All
[-] Collapse All

Proxy Realm Configuration Files

This section describes how to set up the proxy realm configuration files.

Sample proxy.ini Settings

The following proxy.ini file registers a proxy realm called sample.com and adds that realm to the list of target realms for static proxy accounting.

[Realms]
sample.com

[StaticAcct]
7=CustAOnOff
8=CustAOnOff

[CustAOnOff]
realm=sample.com

Note: For syntax details, see proxy.ini File.

The following proxy.ini file entry specifies that otto@rtt.other.com and carol@3g.other.com are both mapped to the other.com proxy realm.

[Realms]
other.com = *.other.com

The following proxy.ini file specifies that otto@rtt.other.com and carol@3g.other.com are mapped to the other.com proxy realm and that caitlin@groton.other.com is mapped to the groton.other.com proxy realm.

[Realms]
other.com = *.other.com
groton.other.com

Sample Proxy Realm (.pro) File

The following complete file must be called sample.com.pro for it to work with the sample proxy.ini file shown on Sample proxy.ini Settings.

[Auth]
Enable = 1
TargetsSection = AuthTargets
RoundRobin = 2
StripRealm = 0
RequestTimeout = 5
NumAttempts = 3
FilterOut = CustAOut
FilterIn = CustAIn
MessageAuthenticator = 0
UseMasterDictionary = yes

[Acct]
Enable = 1
TargetsSection = AcctTargets
RoundRobin = 1
StripRealm = 0
RequestTimeout = 5
NumAttempts = 3
FilterOut = CustAOut
; FilterIn =
RecordLocally = 1
; Block = 1
UseMasterDictionary = yes

[AuthTargets]
bunion=1
desktop=1

[AcctTargets]
desktop

[Called-Station-ID]
8885551212
5551234

[FastFail]
MinFailures = 3
MinSeconds = 3
ResetSeconds = 600

Note: For syntax details, see Proxy RADIUS Configuration (.pro) File.

This example expects the Steel-Belted Radius Carrier database to contain Proxy entries with target names Desktop and Bunion. These entries are required to provide the network routing information (IP address, RADIUS shared secret, and UDP ports) that allows forwarded packets to reach the target servers at the customer site.

Sample filter.ini File

The following complete sample filter.ini file defines the two attribute filters referenced in the sample.com.pro file shown on Sample Proxy Realm (.pro) File:

[CustAOut]
ALLOW
EXCLUDE NAS-IP-Address
ADD NAS-IP-Address 1.2.3.4

[CustAIn]
EXCLUDE
ALLOW Session-Timeout
ALLOW Idle-Timeout
ALLOW Service-Type Framed
ADD Service-Type Framed
ADD Framed-IP-Address CustAPool

The CustAOut filter in this example is designed to be applied to request packets coming into the Steel-Belted Radius Carrier server that are directed out to the realm. It allows all of the attributes in the packet to go out to the realm, with the exception of the RADIUS client’s IP address. It replaces this IP address with the specific dummy address 1.2.3.4. This filter enhances overall security by not publishing routing information to the network when it is not necessary to do so.

The CustAIn filter in this example is designed to be applied to response packets returning to the Steel-Belted Radius Carrier server, which are relayed, in turn, to the RADIUS client. Most attributes are excluded; however, if any timeout values are returned, they are allowed through. If the Service-Type attribute is present in the response and it has the value Framed (a string alias for the Service-Type integer value 2), it is allowed in the packet. Steel-Belted Radius Carrier adds the Service-Type attribute to the packet if it is not already there, and assigns it the value Framed (2).

The CustAIn filter in this example expects the Steel-Belted Radius Carrier database to contain an IP address pool entry called CustAPool, which specifies the customer’s valid address ranges. If this entry is not present, the CustAIn filter fails. CustAPool is referenced in the filter’s final entry, which assigns a value to the Framed-IP-Address attribute. As shown in the example, this entry causes Steel-Belted Radius Carrier to (1) add the Framed-IP-Address attribute to the packet; (2) select an available address from CustAPool, and (3) assign this value to the Framed-IP-Address attribute.

Modified: 2017-03-07