Subject: (usr-tc) anti-spoofing, per user

From: Jesse Sipprell <[email-masked]>
Date: Mon, 06 Dec 1999 19:03:38 +0000

Until recently I had been using:

enable ip SOURCE_ADDRESS_FILTER
set network user default PPP_SOURCE_IP_FILTER enabled

to prevent network users from spoofing source addresses.  I now have one
customer who has the need to have multiple subnets routed to them, which
requires me to turn this option off globally.

Is there any method of leaving this ON, but turning off PPP_SOURCE_IP_FILTER
for a specific user via RADIUS?

Thanks!

-- 
Jesse Sipprell
Technical Operations Director
Evolution Communications, Inc.
800.496.4736

* Finger [email-masked] for my PGP Public Key *

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

---

From: Brian <[email-masked]>
Date: Mon, 06 Dec 1999 19:29:11 +0000

> for a specific user via RADIUS?

I don't think so.................

You can use "hint assigned" and build dynamic filters for each of your
users...........I did this for a time.  I *really* wish they would make
PPP_SOURCE_IP_FILTER use the netmask information and build the filter off
that...................anyone know if this is in the pipeline?

> Thanks!

-----------------------------------------------------
Brian Feeny (BF304)     [email-masked]   
318-222-2638 x 109	http://www.shreve.net/~signal      
Network Administrator   ShreveNet Inc. (ASN 11881) 	      

-

---

From: Mike Andrews <[email-masked]>
Date: Mon, 06 Dec 1999 20:08:59 +0000

> for a specific user via RADIUS?

You can do it the other way around...  leave the filter off, but turn it
ON for a user in Radius.  If you turn it on for the DEFAULT user, that's
got the same effect as turning it on globally.  Then you can leave it off
for the users that have subnets routed to them, since they have their own
entries anyway.

I've got the attribute name as USR-IP-SAA-Filter, vendor-specific
attribute number 0x9870.

Mike Andrews (MA12) * [email-masked] * http://www.bit0.com/
VP, sysadmin, & network guy, Digital Crescent Inc, Frankfort KY
Internet services for Frankfort, Lawrenceburg, Owenton, & Shelbyville
"Don't sweat the petty things, and don't pet the sweaty things."

-

---

From: Aaron Nabil <[email-masked]>
Date: Tue, 07 Dec 1999 01:33:09 +0000

Mike Andrews writes...
>I've got the attribute name as USR-IP-SAA-Filter, vendor-specific

Last time I tried this attribute it didn't work.

-- 
Aaron Nabil

-

---

From: Mike Andrews <[email-masked]>
Date: Tue, 07 Dec 1999 09:09:19 +0000

It appears to work here -- we get a lot of packets logged by the ARC from
people using RFC1918 addresses and the like on our dialups.  And they are
getting dropped or else our Ciscos would log/drop them too...

-

---

From: Aaron Nabil <[email-masked]>
Date: Thu, 09 Dec 1999 00:05:06 +0000

Mike Andrews writes...
>getting dropped or else our Ciscos would log/drop them too...

Are you using the attribute or the global switch?  It was the
attribute that didn't work.

-- 
Aaron Nabil

-

---

From: Mike Andrews <[email-masked]>
Date: Thu, 09 Dec 1999 00:10:36 +0000

Attribute.  It's off globally.

-