vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

VPN: adjust RADIUS server syntax for L2TP

Browse Source
This commit is contained in:
Christian Poessinger 2019-01-23 17:58:15 +01:00
parent bc5ad9350e
commit 39be522874
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
docs/vpn.rst
View File

@ -321,12 +321,13 @@ VyOS supports either `local` or `radius` user authentication:
set vpn l2tp remote-access authentication mode <local|radius>
In addition one or more RADIUS_ servers can be configured to server for user
authentication. This is done using the `radius-server` and `key` nodes:
authentication. This is done using the `radius server` and `radius server key`
nodes:
.. code-block:: sh
set vpn l2tp remote-access authentication radius-server 1.1.1.1 key 'foo'
set vpn l2tp remote-access authentication radius-server 2.2.2.2 key 'foo'
set vpn l2tp remote-access authentication radius server 1.1.1.1 key 'foo'
set vpn l2tp remote-access authentication radius server 2.2.2.2 key 'foo'
.. note:: Some RADIUS_ severs make use of an access control list who is allowed
to query the server. Please configure your VyOS router in the allowed client
@ -335,11 +336,16 @@ authentication. This is done using the `radius-server` and `key` nodes:
RADIUS source address
*********************
Yet there is no way to configure the used RADIUS_ client source IP address on
the VyOS router, this is work in progres, see https://phabricator.vyos.net/T828.
If you are using e.g. OSPF as IGP always the nearest interface facing the RADIUS
server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a
single source IP e.g. the loopback interface.
The IP address nearest to the radius server is currently used. If in doubt,
configure all IP addresses from the VyOS router in question.
.. code-block:: sh
set vpn l2tp remote-access authentication radius source-address 3.3.3.3
Above command will use `3.3.3.3` as source IPv4 address for all RADIUS queries
on this NAS.
Site-to-Site IPsec
------------------