Retries 3
RetryTimeout 5
MaxFailedRequests 1
MaxFailedGraceTime 0
FailureBackoffTime 0

# This better agree with the server at
# eric.open.com.au or they wont understand us
<AuthBy RADIUS>
      Host eric.open.com.au
      Secret 666obaFGkmRNs666
</AuthBy>

# Send authentication to port 1812 on the remote server
AuthPort 1812

# Send accounting to port 1813 on the remote server
AcctPort 1813

OutPort 1001

# It is a poor link, so lots of retries
Retries 10

# It is a poor link, wait 15 seconds before retransmission
RetryTimeout 15

• <AuthBy RADCSEC>: NoreplyTimeout value is used instead.
• <AuthBy RADIUS>: RetryTimeout value is used instead.

<AuthBy RADSEC>
      NoreplyTimeout 10
      KeepaliveNoreplyTimeout 3
</AuthBy>

• Reference to the request that was sent to the Host but received no reply and triggered the change state. Request type is Status-Server when this request type is used for reachability detection.
• Reference to this Radius::AuthRADSEC structure
• Reference to the Radius::Host structure for the remote host
• New host state. One of integer constant values:
  • $Radius::AuthRADIUS::HOST_STATE::REACHABLE
  • $Radius::AuthRADIUS::HOST_STATE::UNREACHABLE
• IP address of the Host that is now reachable or unreachable
• Port on the Host that is now reachable or unreachable

HostStateChangeHook sub { \
    my ($p, $self, $host, $new_state, $ip, $port) = @_; \

    my $old_state = $host->{state_change_hook_current_state}; \
    $old_state = $Radius::AuthRADIUS::HOST_STATE::REACHABLE
        unless defined $old_state; \

    return if $old_state == $new_state; \
    $host->{state_change_hook_current_state} = $new_state; \

    my $st = ($new_state == $Radius::AuthRADIUS::HOST_STATE::UNREACHABLE) ?
             'Unreachable' : 'Reachable'; \
    my $msg = "HostStateChangeHook: IP '$ip', Port '$port', New State: '$st'"; \
    $self->log($main::LOG_INFO, "$self->{log_class_identifier} $msg", $p); \
    return; }

# Remove any NAS-IP-Address,NAS-Port attributes
StripFromRequest NAS-IP-Address,NAS-Port

# Append a Filter-ID and host name
AddToRequest Calling-Station-Id=1,Login-IP-Host=%h

# Possibly add our default Operator-Name
AddToRequestIfNotExist Operator-Name=1example.com

# Just ACCEPT Authentication-Requests, do not forward them
NoForwardAuthentication

# Just ACCEPT Accounting-Requests, do not forward them
NoForwardAccounting

# Only process Start and Stop requests, ACCEPT and acknowledge everything else
HandleAcctStatusTypes Start,Stop

• Reference to the reply received from the remote RADIUS server
• Reference to the reply packet being constructed for return to the NAS
• Reference to the original request from the NAS
• Reference to the request that was sent to the remote RADIUS server
• Reference to the Radius::Host structure for the remote host
• Reference to the redirected flag. If redirected is set by the hook, the ReplyHook has redirected the request to another AuthBy.

# Change RadiusResult in the 3rd argument, the original request
ReplyHook sub { ${$_[2]}->{RadiusResult} = $main::ACCEPT; }

# Fake a new attribute into the reply going back to the client
ReplyHook sub { ${$_[1]}->add_attr('test-attr', \
      'test-value');}

# Call an AuthBy SQL to handle accounting that
# failed to get to the remote server
NoReplyHook sub { Radius::AuthGeneric::find('SQL')\
      ->handle_request(${$_[0]}, ${$_[2]});}

• Current request
• Forwarded request

ForwardHook sub { my $p = $_[0]; my $fp = $_[1]; \
                  $fp->add_attr('OSC-AVPAIR', 'Added by ForwardHook'); }

# If we get a reject from the remote, do not send it to the NAS
IgnoreReject

# Trigger an Access-Reject back to the NAS
NoReplyReject

# Auth to server1 and continue to AuthBy FILE if server 1 accepts.
# Process other requests while the reply from server 1 is pending.
<Handler>
      AuthByPolicy ContinueWhileAccept
      <AuthBy RADIUS>
            # Evaluate the policy when we get a reply or a timeout
            Asynchronous
            Host server1
            Secret xxxxxx
      </AuthBy>
      <AuthBy FILE>
            Filename %D/users
      </AuthBy>
</Handler>

# Auth to server2 only if server 1 rejects. Caution: 
# accounting will normally go to server1, unless it rejects
<Realm xxxxxx>
      AuthByPolicy ContinueWhileReject
      <AuthBy RADIUS>
            # Wait here until we get a reply or a timeout
            Synchronous
            Host server1
            Secret xxxxxx
      </AuthBy>
      <AuthBy RADIUS>
            Host server2
            Secret yyy
      </AuthBy>
</Realm>

AcctLogFileFormat %{Timestamp} %{Acct-Session-Id}\
%{User-Name}

# We only want to forward Stops
AccountingStopsOnly

# Strip everything except username and password
AllowInRequest User-Name,User-Password

# Use the configured Gossip implementation for notifications
Gossip