3. Scenario 1:Enterprise RADIUS Integration
3.1 Network Topology Plan
3.2 Target Configuration Plan
Device
/ Interface | IP Address / Subnet | Role |
AsterNOS (Eth1) | 192.168.200.166/24 | WAN Uplink (Route to RADIUS & Core Network) |
AsterNOS (Eth2) | N/A (Layer 2 PPPoE) | LAN Interface (PPPoE Dial-in Port) |
RADIUS Server | 192.168.200.253/24 | Centralized AAA Server (FreeRADIUS) |
Dial-in Client PC | 192.168.100.x/24 | PPPoE Client |
3.3 Phase 1: Baseline Setup (Local Pool IP Allocation)
In this phase, we establish an enterprise-grade vBNG architecture. To ensure a smooth deployment, we will build this in two stages:
- Baseline Setup: Centralized RADIUS authentication combined with AsterNOS local IP allocation.
- Advanced Setup: Fully centralized architecture where RADIUS handles both authentication and dynamic IP allocation.
Base Network & RADIUS Global Configuration
sonic# configure terminal
# 1. Configure the WAN Interface (Required to reach the RADIUS server)
sonic(config)# interface ethernet 1
sonic(config-if-1)# ip address 192.168.200.166/24
sonic(config-if-1)# exit
#2. Define Default Route to Core Network
sonic(config)# ip route 0.0.0.0/0 192.168.200.1
#3. Define the Global RADIUS server.
CRITICAL: The ‘mode pppoe’ attribute must be configured FIRST.
sonic(config)# radius server 192.168.200.253 mode pppoe
sonic(config)# radius server 192.168.200.253 auth-type chap
sonic(config)# radius server 192.168.200.253 passkey aster123
Configure the PPPoE Server
In our baseline setup, AsterNOS relies on RADIUS for user authentication but handles IP address distribution locally.
# 1. Enable PPPoE Server globally
sonic(config)# pppoe-server enable
#2. Create the local IP pool for dial-in clients
sonic(config)# ip-pool pppoe-pool
sonic(config-ip-pool)# ip-range 192.168.100.10 192.168.100.254
sonic(config-ip-pool)# exit
#3. Enter PPPoE Server instance 1
sonic(config)# interface pppoe-server 1
sonic(config-if-pppoeserver-1)# service-name pppoe-enterprise
sonic(config-if-pppoeserver-1)# ac-name pppoe-server-1
# 4. Bind RADIUS for Authentication and Accounting
sonic(config-if-pppoeserver-1)# ppp chap radius-server 192.168.200.253
sonic(config-if-pppoeserver-1)# nas-ip 192.168.200.166
# 5. Set Virtual Gateway IP and bind the local pool
sonic(config-if-pppoeserver-1)# local-ip 192.168.100.1 255.255.255.0
sonic(config-if-pppoeserver-1)# remote-ip-pool pppoe-pool
# 6. Network Parameters
sonic(config-if-pppoeserver-1)# dns-server 8.8.8.8
sonic(config-if-pppoeserver-1)# accept-blank-service enable
sonic(config-if-pppoeserver-1)# exit
# 7. Bind to physical LAN port
sonic(config)# interface ethernet 2
sonic(config-if-2)# pppoe-server 1
sonic(config-if-2)# exit
Note:
- If using accept-any-service enable: The service-name does not need to be configured on either the server or the client.
- If using accept-blank-service enable: The service-name must be configured on the server, and the client must not
FreeRADIUS Server Setup
Deploy a lightweight FreeRADIUS configuration focused strictly on AAA, without the complexity of IP pool management.
- Install FreeRADIUS
sudo apt-get update
sudo apt-get install freeradius -y
- Configure the NAS Client (AsterNOS Gateway)
sudo nano /etc/freeradius/3.0/clients.conf
client AsterNOS-Gateway {
ipaddr = 192.168.200.166
secret = aster123
}
- Create the User Profile
sudo nano /etc/freeradius/3.0/users
“radiususer” Cleartext-Password := “radius123”
Service-Type = Framed-User,
Framed-Protocol = PPP
- Restart Service
Note:
On Ubuntu/Debian systems, FreeRADIUS starts automatically upon installation. A restart is required to load the newly configured clients and users.
sudo systemctl restart freeradius
3.4 Phase2: Advanced Integration (Centralized RADIUS IP Allocation)
Once the baseline authentication is verified, enterprise architectures typically migrate IP allocation to the RADIUS server. This consolidates user management and billing into a single pane of glass.
To upgrade from the Baseline to the Centralized architecture, follow these Delta steps:
Unbind the Local Pool on AsterNOS
Shift the allocation responsibility away from the gateway.
sonic# configure terminal
sonic(config)# interface pppoe-server 1
sonic(config-if-pppoeserver-1)# no remote-ip-pool pppoe-pool
sonic(config-if-pppoeserver-1)# exit
Configure the RADIUS IP Pool
sudo nano /etc/freeradius/3.0/mods-available/ippool
ippool main_pool {
range_start = 192.168.100.10
range_stop = 192.168.100.254
netmask = 255.255.255.0
# Keep the following default parameters unchanged
filename = ${db_dir}/db.ippool
ip_index = ${db_dir}/db.ipindex
override = no
maximum_timeout = 0
}
Enable the module
sudo ln -s /etc/freeradius/3.0/mods-available/ippool /etc/freeradius/3.0/mods-enabled/
Activate IP Pool in Accounting & Post-Auth
sudo nano /etc/freeradius/3.0/sites-enabled/default
In the accounting { … } block, add:
accounting {
detail
unix
main_pool # <— Add this line
exec
# …
}
In the post-auth { … } block, add:
post-auth {
exec
main_pool # <— Add this line
# …
}
Update User Profile & Apply Changes
sudo nano /etc/freeradius/3.0/users
“radiususer” Cleartext-Password := “radius123”, Pool-Name := “main_pool”
Service-Type = Framed-User,
Framed-Protocol = PPP
sudo systemctl restart freeradius
3.5 Phase 1 & 2 Verification
After completing the configuration and restarting the RADIUS service, follow these steps to verify that the PPPoE session is successfully established:
- Client Dial-in: Create a PPPoE connection on the client PC and dial in using your username and password.
- Check Session Status: Once successfully connected, execute the following command to view real-time session information.
sonic# show pppoe-session
Expected Output:
Id Iface SessionId RemoteMac RemoteIp LocalIp LocalIf PppoeServer Uptime
—- ——— ———– —————– ————- ————- ——— ————– ——–
0 Ethernet3 384 00:e0:4c:68:06:0d 192.168.100.10 192.168.100.1 ppp0 pppoe-server-1 0:00:37
Tips:
Under the Scenario 1 configuration, the client can successfully dial in and establish a network connection. To enable internet access, please ensure that the core network has the appropriate NAT policies configured, or refer to Scenario 2 to enable local SNAT on AsterNOS.