ACS5 - Returning multiple Framed-Route RADIUS attributes
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-25-2013 09:42 AM - edited 03-10-2019 08:00 PM
Hello All,
I've got a load of internal users in my ACS boxes. I've added Framed-Route as a variable in the Internal User dictionary and use it as a dynamic variable in my Authorzation Profiles as a RADIUS attribute. Now, a couple of users need two Framed-Routes, what's the right way to accomodate this?
I know I can return multiple Framed-Route attributes in the profile, but only one or two users need multiple Framed-Routes. I could add an optional "Framed-Route2" to the dictionary and give the Authorzation Profile a second Framed-Route attribute, but then for all the other users ACS will be returning two Framed-Route attributes, one of which will be empty (and uneccasry) and I'm not sure how upstream devices will interpret this?
Is there a better way to do this? Or will ACS not send the attribute if the value is empty? Any ideas?
Cheers all!
- Labels:
-
AAA

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-26-2013 01:50 PM
Will answer in brief assuming you have the basic configuration in place
Defined a second user attribute called Framed-Route-2. Give a default value that won't in fact be a real IP address that is used; say 0.0.0.0
Prepare two authorization profiles; one with one framed route from the first user attribute; the second with 2 framed route attributes: using both the first and second user attribute
In authoirzation policy have a rule like
if "user attribute 2" is not equal to defaultl value (0.0.0.0) then use authorization profile with two frame attributes
else use the one with a single framed attribute
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-27-2013 05:00 AM
That's a great answer, much more elegant than where my mind was going!
Two quick questions...
- Does that mean ACS returns both attributes if defined in the profile, even if one has an empty value?
- Any reason to use "0.0.0.0" as a default over just blank ("") as Framed-Route is a string value? (It just seems cleaner to leave it empty than put a fake value in if not used... I think)
Thanks again!
