Mailing List Archive: AAA: Filtering assigned IP adresses

Hello,

we have some NAS (and some LNS) where users receive static IP adresses via RADIUS, like

Framed-IP-Address = 62.210.1.1
Framed-IP-Netmask = 255.255.255.240

but sometimes the RADIUS provisioning fails and we have

Framed-IP-Address = 62.210.1.1
Framed-IP-Netmask = 0.0.0.0 (!!!)

which leads to a virtual-access interface which acts as a default route and receives all trafic.

Is there a way to configure the NAS to refuse adresses assignments of this kind ? I would like to find some fool proof config in the NAS to prevent that kind of problems.

Being able to refuse assignments of adresses outside a range (like having a prefix list filtering BGP announcements) would be very nice.

Thanks in advance,

Benoît

> we have some NAS (and some LNS) where users receive static IP
> adresses via RADIUS, like
>
> Framed-IP-Address = 62.210.1.1
> Framed-IP-Netmask = 255.255.255.240
>
> but sometimes the RADIUS provisioning fails and we have
>
> Framed-IP-Address = 62.210.1.1
> Framed-IP-Netmask = 0.0.0.0 (!!!)
>
> which leads to a virtual-access interface which acts as a default
> route and receives all trafic.
>
> Is there a way to configure the NAS to refuse adresses assignments of
> this kind ? I would like to find some fool proof config in the NAS to
> prevent that kind of problems.

I don't know of any way to filter the *contents* of an attribute in IOS. So far we can only filter complete attributes.

There might even be customers using framed-netmask 0.0.0.0 on purpose, so just filtering out this assignment would possibly break existing configs. not sure...

oli