topic Re: IP pool assignment using radius in SASE and Remote Access

IP pool assignment using radius

Gary_Napier — Sun, 03 Mar 2019 22:14:39 GMT

Hi folks,

Looking for a technology go/no go for this scenario: Can you please let me know if this will work.

R80.10 - RA VPN for 2 user groups:
Group 1 will use the Endpoint client, be Windows based and will receive office mode IP's - already works.

Group 2 will use L2TP (shared secret string) and be Linux based. I would like them to receive custom IP's from a pool.

Both sets of users authenticate via a Radius server (with accounting). For Group 2, the radius server can send the IP pool name that they should be allocated from.

The Key here is that CheckPoint will hand out DHCP addresses instead of the Radius server - as with traditional RADIUS accounting..

Re: IP pool assignment using radius

PhoneBoy — Mon, 04 Mar 2019 10:08:50 GMT

Believe what you are looking for is: How to configure RADIUS to assign Office Mode IP addresses

Re: IP pool assignment using radius

Gary_Napier — Mon, 04 Mar 2019 13:39:08 GMT

Hi Dameon,

Close - but not quite there. I have used the referenced SK to set up in the lab and the clients are getting the SAME ip address. This is so because the RADIUS server is dumb and is not controlling IP allocation.

My RADIUS server is sending the following

Framed-IP-Address - 192.168.48.0
Framed-IP-Netmask - 255.255.255.0

Framed-Protocol - PPP

Each client to connect gets a PPP connection: their IP 192.168.48.0 and the gateway is correct at 192.168.100.2. Always the same...

I need the gateway itself to handle IP allocation as my Radius server cannot do IP pools. I can send the above attributes or even a string with the name of an IP pool, but the gateway must take this info and make its own decisions about IP's.

Is there a way for this to happen or will the Checkpoint Gateway always expect an IP from the radius server?

Thanks

Gary

Re: IP pool assignment using radius

PhoneBoy — Mon, 04 Mar 2019 15:06:00 GMT

You can do IP assignment based on groups as described here: Office Mode IP and ipassignment.conf file

However the actual subnet to assign IPs from must be specified in ipassignment.conf.

We do not support taking the subnet to assign IPs from via RADIUS.