Radius Client IP passthrough to PI (from FreeRadius)

[Kris_Lou]

I’m using PI with the FreeRadius plugin, and would like to do client filtering on some policies.

When running my tests, it looks like PI reads all of the Client IP’s as the FreeRadius server IP, but not the Radius Client IP. Is this expected behavior?

Use case: using PI as Radius OTP (so only need the OTP portion) for one application. Other credentials (domain login) are handled in a separate process. However, I’d like to have policies apply to auth requests from this one client, not necessarily that FreeRadius is passing to PI.

[cornelinux]

First questions (Audit Log, Radius passthrough to RSA and so on .. )

Ok, I will have a look at that again, but it is not that important because we want to get away from the RSA solution. I have connected freeradius via the rest API, is it possible to see in the audit log from which radius client the request came? Currently I only see the successful authentication from 127.0.0.1.

[Kris_Lou]

Thanks for the tip. Turns out my FreeRadius virtual server was mostly using the supplied PI-only site configs. Needed to add the “preprocess” module to the authorization phase before all of the settings took effect.