Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Cisco: NAS

Callback with Microsoft IAS (RADIUS)

 

 

Cisco nas RSS feed   Index | Next | Previous | View Threaded


astrand at unicc

Apr 23, 2003, 6:20 AM

Post #1 of 5 (579 views)
Permalink
Callback with Microsoft IAS (RADIUS)

Hi,

I am trying to get callback working on an AS5200 (12.0.7(T)) using RADIUS.
The AAA server used is a Windows 2000 Server running IAS.

On the AS5200 I have the following AAA configuration:

aaa new-model
aaa group server radius RASGROUP
server 10.168.10.13 auth-port 1645 acct-port 1646
server 10.168.10.14 auth-port 1645 acct-port 1646
!
aaa authentication login RAS group RASGROUP
aaa authentication ppp RAS group RASGROUP
aaa authorization exec RAS group RASGROUP
aaa authorization network RAS group RASGROUP
aaa accounting exec RAS start-stop group RASGROUP
aaa accounting network RAS start-stop group RASGROUP

interface Group-Async 1
ppp authentication pap RAS
ppp authorization RAS
ppp accounting RAS

I have set us the policy in IAS to return the following parameters:

Framed-Protocol=PPP
Service-Type=Framed (there does not seem to be any service-type called
Framed-User)
Cisco-AV-Pair="lcp:callback-dialstring=12345678"

Unfortunately, I am not able to get this to work. Are there any more
parameters that I have to return to the NAS?
Also, if possible I would like to specify the callback number in the user
profile (and not in a AV-pair)

Any help would be greatly appreciated!

Regards,

Harald


mitaylor at cisco

Apr 23, 2003, 3:14 PM

Post #2 of 5 (582 views)
Permalink
Re: Callback with Microsoft IAS (RADIUS) [In reply to]

Hi,

I've done some work a while back on Callback, here's the RADIUS profile I
was using:

callback Auth-Type := Local, User-Password == "testing"
Service-Type = Framed-User,
Framed-IP-Address = 192.168.1.1,
Cisco-AVPair = "lcp:callback-dialstring=1234567",
Cisco-AVPair = "lcp:nocallback-verify=1",
Cisco-AVPair = "ip:addr=192.168.1.1",
Fall-Through = Yes

I was working on authentication issues with 12.2T, and haven't actually
tried it on 12.0(7)T, but I can load it up for a test when I get into the
office if you like...

Cheers,
Mike

At 03:20 PM Wednesday 23/04/2003 +0200, Harald Astrand wrote:




>Hi,
>
>I am trying to get callback working on an AS5200 (12.0.7(T)) using RADIUS.
>The AAA server used is a Windows 2000 Server running IAS.
>
>On the AS5200 I have the following AAA configuration:
>
>aaa new-model
>aaa group server radius RASGROUP
> server 10.168.10.13 auth-port 1645 acct-port 1646
> server 10.168.10.14 auth-port 1645 acct-port 1646
>!
>aaa authentication login RAS group RASGROUP
>aaa authentication ppp RAS group RASGROUP
>aaa authorization exec RAS group RASGROUP
>aaa authorization network RAS group RASGROUP
>aaa accounting exec RAS start-stop group RASGROUP
>aaa accounting network RAS start-stop group RASGROUP
>
>interface Group-Async 1
> ppp authentication pap RAS
> ppp authorization RAS
> ppp accounting RAS
>
>I have set us the policy in IAS to return the following parameters:
>
>Framed-Protocol=PPP
>Service-Type=Framed (there does not seem to be any service-type called
>Framed-User)
>Cisco-AV-Pair="lcp:callback-dialstring=12345678"
>
>Unfortunately, I am not able to get this to work. Are there any more
>parameters that I have to return to the NAS?
>Also, if possible I would like to specify the callback number in the user
>profile (and not in a AV-pair)
>
>Any help would be greatly appreciated!
>
>Regards,
>
>Harald
>
>_______________________________________________
>cisco-nas mailing list
>cisco-nas [at] puck
>http://puck.nether.net/mailman/listinfo/cisco-nas

Cisco Systems
VGDBU - Voice Gateway and Dial Business Unit
Customer Engineering
Sydney, Australia
Ph: (+61 2) 8446 6044
Mobile: (+61) 401 890 474


mitaylor at cisco

Apr 23, 2003, 8:11 PM

Post #3 of 5 (578 views)
Permalink
Re: Callback with Microsoft IAS (RADIUS) [In reply to]

OK, I've just set this up in my lab using a 5300 and 12.0(7)T, with Merit
RADIUS running on a SUN box.

I did have a couple of issues getting it to work, and I think you are
probably running into:

CSCdv58818: MS Callback fails without dialer in-band if async-mode ...
This DDTS is fixed in 12.2(7), 12.2(7)T etc. BUT, I wouldn't recommend the
pain of upgrading, the workaround is to add 'dialer in-band' to your
'interface Group-Async'

**** WARNING adding 'dialer in-band' will set the idle timeout for all
async users to the default of 120 seconds, so you will probably want to add
'dialer idle-timeout 2147483' or something similar.

*** ALSO, you will need to add a chat script for dialing out. (see config)

I used the same RADIUS profile as below, and here is the bare bones config
of my 5300 to get callback working;

Please let me know if you need any more help with this

Cheers,
Mike Taylor
************************************************************

Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname vgdbu-5300
!
aaa new-model
aaa group server radius default
server 2.2.2.2 auth-port 1812 acct-port 1813
!
aaa authentication login default none
aaa authentication ppp default group radius
aaa authorization network default group radius
enable password BLAH
!
!
!
resource-pool disable
!
!
!
!
!
ip subnet-zero
!
isdn switch-type primary-net5
isdn voice-call-failure 0
chat-script callback ABORT ERROR "" "ATDT\T" TIMEOUT 90 CONNECT \c
mta receive maximum-recipients 0
!
!
controller E1 0
clock source line primary
pri-group timeslots 1-31
!
controller E1 1
clock source line secondary 1
!
controller E1 2
!
controller E1 3
!
!
!
!
interface Ethernet0
no ip address
no ip directed-broadcast
shutdown
!
interface Serial0:15
no ip address
no ip directed-broadcast
isdn switch-type primary-net5
isdn incoming-voice modem
fair-queue 64 256 0
no cdp enable
!
interface FastEthernet0
ip address 1.1.1.1 255.255.255.0
no ip directed-broadcast
duplex full
speed 100
!
interface Group-Async0
ip unnumbered FastEthernet0
no ip directed-broadcast
encapsulation ppp
dialer in-band
dialer idle-timeout 2147483
async mode dedicated
ppp callback accept
ppp authentication chap pap
group-range 1 72
!
ip classless
no ip http server
!
!
radius-server host 2.2.2.2 auth-port 1812 acct-port 1813 key cisco
!
line con 0
transport input none
line 1 72
script callback callback
modem InOut
transport preferred lat pad telnet rlogin udptn v120 lapb-ta
transport output lat pad telnet rlogin udptn v120 lapb-ta
line aux 0
line vty 0 4
exec-timeout 0 0
!
end






At 08:14 AM Thursday 24/04/2003 +1000, Michael Taylor (mitaylor) wrote:
>Hi,
>
>I've done some work a while back on Callback, here's the RADIUS profile I
>was using:
>
>callback Auth-Type := Local, User-Password == "testing"
> Service-Type = Framed-User,
> Framed-IP-Address = 192.168.1.1,
> Cisco-AVPair = "lcp:callback-dialstring=1234567",
> Cisco-AVPair = "lcp:nocallback-verify=1",
> Cisco-AVPair = "ip:addr=192.168.1.1",
> Fall-Through = Yes
>
>I was working on authentication issues with 12.2T, and haven't actually
>tried it on 12.0(7)T, but I can load it up for a test when I get into the
>office if you like...
>
>Cheers,
>Mike
>
>At 03:20 PM Wednesday 23/04/2003 +0200, Harald Astrand wrote:
>
>
>
>
>>Hi,
>>
>>I am trying to get callback working on an AS5200 (12.0.7(T)) using RADIUS.
>>The AAA server used is a Windows 2000 Server running IAS.
>>
>>On the AS5200 I have the following AAA configuration:
>>
>>aaa new-model
>>aaa group server radius RASGROUP
>> server 10.168.10.13 auth-port 1645 acct-port 1646
>> server 10.168.10.14 auth-port 1645 acct-port 1646
>>!
>>aaa authentication login RAS group RASGROUP
>>aaa authentication ppp RAS group RASGROUP
>>aaa authorization exec RAS group RASGROUP
>>aaa authorization network RAS group RASGROUP
>>aaa accounting exec RAS start-stop group RASGROUP
>>aaa accounting network RAS start-stop group RASGROUP
>>
>>interface Group-Async 1
>> ppp authentication pap RAS
>> ppp authorization RAS
>> ppp accounting RAS
>>
>>I have set us the policy in IAS to return the following parameters:
>>
>>Framed-Protocol=PPP
>>Service-Type=Framed (there does not seem to be any service-type called
>>Framed-User)
>>Cisco-AV-Pair="lcp:callback-dialstring=12345678"
>>
>>Unfortunately, I am not able to get this to work. Are there any more
>>parameters that I have to return to the NAS?
>>Also, if possible I would like to specify the callback number in the user
>>profile (and not in a AV-pair)
>>
>>Any help would be greatly appreciated!
>>
>>Regards,
>>
>>Harald
>>
>>_______________________________________________
>>cisco-nas mailing list
>>cisco-nas [at] puck
>>http://puck.nether.net/mailman/listinfo/cisco-nas
>
>Cisco Systems
>VGDBU - Voice Gateway and Dial Business Unit
>Customer Engineering
>Sydney, Australia
>Ph: (+61 2) 8446 6044
>Mobile: (+61) 401 890 474
>
>_______________________________________________
>cisco-nas mailing list
>cisco-nas [at] puck
>http://puck.nether.net/mailman/listinfo/cisco-nas

Cisco Systems
VGDBU - Voice Gateway and Dial Business Unit
Customer Engineering
Sydney, Australia
Ph: (+61 2) 8446 6044
Mobile: (+61) 401 890 474


astrand at unicc

Apr 24, 2003, 8:47 AM

Post #4 of 5 (581 views)
Permalink
Re: Callback with Microsoft IAS (RADIUS) [In reply to]

Thank you very much for the information!

I actually already had the "dialer in-band" (and dialer idle-timeout)
defined for the group-async interface.

I found on CCO that only in version 12.1(7) the RADIUS attribute 19 for
Microsoft callback is supported.
I guess this means that I can not specify the phone number in the user
properties in Active Directory.
However, I assume that callback should work if I define the AV-pair
"lcp:callback-dialstring=1234567".
Unfortunately, I will not have time to troubleshoot any more until next
week.

Thanks again for your help!

Regards,

Harald




"Michael
Taylor To: "Michael Taylor (mitaylor)" <mitaylor [at] cisco>
(mitaylor)" cc: "Harald Astrand" <astrand [at] unicc>, cisco-nas [at] puck
<mitaylor [at] cis Subject: Re: [cisco-nas] Callback with Microsoft IAS (RADIUS)
o.com>

04/24/2003
05:11 AM






OK, I've just set this up in my lab using a 5300 and 12.0(7)T, with Merit
RADIUS running on a SUN box.

I did have a couple of issues getting it to work, and I think you are
probably running into:

CSCdv58818: MS Callback fails without dialer in-band if async-mode ...
This DDTS is fixed in 12.2(7), 12.2(7)T etc. BUT, I wouldn't recommend the
pain of upgrading, the workaround is to add 'dialer in-band' to your
'interface Group-Async'

**** WARNING adding 'dialer in-band' will set the idle timeout for all
async users to the default of 120 seconds, so you will probably want to add

'dialer idle-timeout 2147483' or something similar.

*** ALSO, you will need to add a chat script for dialing out. (see config)

I used the same RADIUS profile as below, and here is the bare bones config
of my 5300 to get callback working;

Please let me know if you need any more help with this

Cheers,
Mike Taylor
************************************************************

Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname vgdbu-5300
!
aaa new-model
aaa group server radius default
server 2.2.2.2 auth-port 1812 acct-port 1813
!
aaa authentication login default none
aaa authentication ppp default group radius
aaa authorization network default group radius
enable password BLAH
!
!
!
resource-pool disable
!
!
!
!
!
ip subnet-zero
!
isdn switch-type primary-net5
isdn voice-call-failure 0
chat-script callback ABORT ERROR "" "ATDT\T" TIMEOUT 90 CONNECT \c
mta receive maximum-recipients 0
!
!
controller E1 0
clock source line primary
pri-group timeslots 1-31
!
controller E1 1
clock source line secondary 1
!
controller E1 2
!
controller E1 3
!
!
!
!
interface Ethernet0
no ip address
no ip directed-broadcast
shutdown
!
interface Serial0:15
no ip address
no ip directed-broadcast
isdn switch-type primary-net5
isdn incoming-voice modem
fair-queue 64 256 0
no cdp enable
!
interface FastEthernet0
ip address 1.1.1.1 255.255.255.0
no ip directed-broadcast
duplex full
speed 100
!
interface Group-Async0
ip unnumbered FastEthernet0
no ip directed-broadcast
encapsulation ppp
dialer in-band
dialer idle-timeout 2147483
async mode dedicated
ppp callback accept
ppp authentication chap pap
group-range 1 72
!
ip classless
no ip http server
!
!
radius-server host 2.2.2.2 auth-port 1812 acct-port 1813 key cisco
!
line con 0
transport input none
line 1 72
script callback callback
modem InOut
transport preferred lat pad telnet rlogin udptn v120 lapb-ta
transport output lat pad telnet rlogin udptn v120 lapb-ta
line aux 0
line vty 0 4
exec-timeout 0 0
!
end






At 08:14 AM Thursday 24/04/2003 +1000, Michael Taylor (mitaylor) wrote:
>Hi,
>
>I've done some work a while back on Callback, here's the RADIUS profile I
>was using:
>
>callback Auth-Type := Local, User-Password == "testing"
> Service-Type = Framed-User,
> Framed-IP-Address = 192.168.1.1,
> Cisco-AVPair = "lcp:callback-dialstring=1234567",
> Cisco-AVPair = "lcp:nocallback-verify=1",
> Cisco-AVPair = "ip:addr=192.168.1.1",
> Fall-Through = Yes
>
>I was working on authentication issues with 12.2T, and haven't actually
>tried it on 12.0(7)T, but I can load it up for a test when I get into the
>office if you like...
>
>Cheers,
>Mike
>
>At 03:20 PM Wednesday 23/04/2003 +0200, Harald Astrand wrote:
>
>
>
>
>>Hi,
>>
>>I am trying to get callback working on an AS5200 (12.0.7(T)) using
RADIUS.
>>The AAA server used is a Windows 2000 Server running IAS.
>>
>>On the AS5200 I have the following AAA configuration:
>>
>>aaa new-model
>>aaa group server radius RASGROUP
>> server 10.168.10.13 auth-port 1645 acct-port 1646
>> server 10.168.10.14 auth-port 1645 acct-port 1646
>>!
>>aaa authentication login RAS group RASGROUP
>>aaa authentication ppp RAS group RASGROUP
>>aaa authorization exec RAS group RASGROUP
>>aaa authorization network RAS group RASGROUP
>>aaa accounting exec RAS start-stop group RASGROUP
>>aaa accounting network RAS start-stop group RASGROUP
>>
>>interface Group-Async 1
>> ppp authentication pap RAS
>> ppp authorization RAS
>> ppp accounting RAS
>>
>>I have set us the policy in IAS to return the following parameters:
>>
>>Framed-Protocol=PPP
>>Service-Type=Framed (there does not seem to be any service-type called
>>Framed-User)
>>Cisco-AV-Pair="lcp:callback-dialstring=12345678"
>>
>>Unfortunately, I am not able to get this to work. Are there any more
>>parameters that I have to return to the NAS?
>>Also, if possible I would like to specify the callback number in the user
>>profile (and not in a AV-pair)
>>
>>Any help would be greatly appreciated!
>>
>>Regards,
>>
>>Harald
>>
>>_______________________________________________
>>cisco-nas mailing list
>>cisco-nas [at] puck
>>http://puck.nether.net/mailman/listinfo/cisco-nas
>
>Cisco Systems
>VGDBU - Voice Gateway and Dial Business Unit
>Customer Engineering
>Sydney, Australia
>Ph: (+61 2) 8446 6044
>Mobile: (+61) 401 890 474
>
>_______________________________________________
>cisco-nas mailing list
>cisco-nas [at] puck
>http://puck.nether.net/mailman/listinfo/cisco-nas

Cisco Systems
VGDBU - Voice Gateway and Dial Business Unit
Customer Engineering
Sydney, Australia
Ph: (+61 2) 8446 6044
Mobile: (+61) 401 890 474


mitaylor at cisco

Jul 10, 2003, 8:13 PM

Post #5 of 5 (579 views)
Permalink
Re: Callback with Microsoft IAS (RADIUS) [In reply to]

Hi Ricky,

I'm not 100% sure what you're saying here, so a few questions;

You're an ISP, or and end user? (Because the ISP will have to set up your
account for 'MS Callback')

If callback is applied to your user profile (via RADIUS) at the ISP end,
then one of two things will happen;
1: ISP hard codes your phone number in their database, and when you dial
and authenticate, Windows will disconnect automatically, and then a box
will sit in the middle of the screen saying something like 'Waiting for
Callback'.

2: ISP allows 'MS Callback' but doesn't allocate a phone number. Again,
your PC will dial, authenticate etc and then a pop-up box will appear on
your screen asking for your the callback phone number.

If you are hitting cancel at any time during the dialup you will make
Windows abort the dialling completely, and you will end up with no
connection...

Let me know if this helps, and if you have any more questions

Cheers,
Mike

At 09:35 AM Thursday 10/07/2003 +0200, Ricky Magalhaes wrote:

>Hi Mike,
>
>
>
>I was searching on the internet and saw that you have a level of good
>understanding when it comes to IAS RADIUS and Cisco compatibility. When I
>dial in to the Cisco box it tries to call me back when I press cancel,
>hoping that I will just connect onto the network and it will not
>disconnect me it disconnects me.
>
>
>
>I hope you can help me with this
>
>
>
>RM

Cisco Systems,
Customer Support Engineer,
Asia Pacific Technical Assistance Centre,
Sydney, Australia
Ph: (+61 2) 8446 6044

Cisco nas RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.