RADIUS process looping...

[Stefan Adams]

I am sure that this is not related to FreeRADIUS but I have seen the
topic posted here so I wanted to post my research for those that
search these archives.

It appears to be a common problem of having a Windows Client
(specifically with the wZc utility) which gets stuck in a loop of
constantly verifying authorization and obtaining an IP.  I,
personally, can see from my radiusd -A -X output that the entire
auth/autz process succeeds -- on EVERY pass of the loop.

AFTER applying the MS Hotfix KB885453, I still have my clients
periodically stuck in a loop (as according to the RADIUS server
showing the same debug info over and over).  I have found that it
appears to be due to my access point (D-Link DWL-3200AP) REBOOTING!

Here is what I told my D-Link rep:
"These steps help to illustrate the problem:
logged into the windows domain.
configured the wireless interface for WPA using automatically provided
windows credentials
successfully and immediately logged on to the wireless WPA network
logged out
logged back into the windows domain and it successfuly and immediately
connected to the WPA network
rebooted
logged into domain, it took 3 (THREE) minutes to login (using cached
credentials)
--  This entire time NO connections were made to the RADIUS server
after finally logging in I notice that about 40 pings to the AP were
dropped before it came back to life and suddenly 260 buffered RADIUS
requests were sent to the RADIUS server After the 260th, the windows
computer successfully connected to the wpa wireless network

It is important to note that DURING a windows domain logon (and
simultaneously a connection to the WPA wireless network) the AP
REBOOTED."

Is my hypothesis correct -- that it is the AP?  Do I have enough
information to make that determination?  To anyone that would like to
help me troubleshoot the issue, let me know if I can provide more
information or logs or debug output or whatever...

BTW, I also have syslog logs (DWL-3200AP can log to a syslogger...)
proving that the AP REBOOTED and not just some of my pings were
dropped.

Stefan

Here is my configuration:

D-Link DWL-3200AP FW2.10, WPA-Enterprise w/AES, multi-SSID support, VLAN support
FreeRADIUS 1.1.0-pre0 (snapshot-20051220)
Windows XP SP2, 802.1x, EAP-PEAP, MS-CHAPv2

radiusd.conf:
proxy_requests  = no
$INCLUDE  ${confdir}/proxy.conf
modules {
        unix {
               radwtmp = ${logdir}/radwtmp
        }
        mschap {
               authtype = MS-CHAP
               use_mppe = yes
               require_encryption = yes
               require_strong = yes
               with_ntdomain_hack = yes
       }
       ldap {
               server = "<snip>"
               identity = "<snip>"
               password = <snip>
               basedn = "<snip>"
               filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
               base_filter = "(objectclass=radiusprofile)"
               tls { ... }
               access_attr = "dialupAccess"
               dictionary_mapping = ${raddbdir}/ldap.attrmap
               ldap_connections_number = 5
               timeout = 4
               timelimit = 3
               net_timeout = 1
               auto_header = no
               access_attr_used_for_allow = yes
      }
      eap {
               default_eap_type = peap
               timer_expire = 60
               ignore_unknown_eap_types = no
               cisco_accounting_username_bug = no
               tls {
                       private_key_password = <snip>
                       private_key_file = /etc/1x/server.pem
                       certificate_file = /etc/1x/server.pem
                       CA_file = /etc/1x/root.pem
                       dh_file = /etc/1x/DH
                       random_file = /etc/1x/random
                       include_length = yes
               }
               peap {
                       default_eap_type = mschapv2
                       copy_request_to_tunnel = yes
               }
               mschapv2 {
               }
       }
       realm ntdomain {
               format = prefix
               delimiter = "\\"
       }
       preprocess {
               :
               with_ntdomain_hack = no
               :
       }
}
authorize {
       preprocess
       ntdomain
       eap
       ldap
}
authenticate {
       Auth-Type MS-CHAP {
               mschap
       }
       eap
}

clients.conf:
client 172.16.16.0/24 {
       secret          = testing123
       shortname       = ap
}
client 172.16.254.0/24 {
       secret          = testing123
       shortname       = server
}

proxy.conf:
realm LOCAL {
       type            = radius
       authhost        = LOCAL
       accthost        = LOCAL
}
realm DEFAULT {
       type            = radius
       authhost        = LOCAL
       accthost        = LOCAL
}

[
If SSID Authorization is desired:
modules {
       ldap {
            filter =
"(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusCalledStationId=%{Called-Station-ID}))"
       }
       attr_rewrite getssid {
               attribute = Called-Station-Id
               # may be "packet", "reply", "proxy", "proxy_reply" or "config"
               searchin = packet
               # Strip the MAC Address out of the Called-Station-ID
               # Resulting in just the SSID
               searchfor = ".................:"
               replacewith = ""
               ignore_case = yes
               new_attribute = no
       #       max_matches = 10
       #       ## If set to yes then the replace string will be appended to th
       #       append = no
       }
}
authorize {
       :
       eap
       getssid
       ldap
       :
}
]

Windows XP:

Apply this Pre-SP3 Hotfix:
http://support.microsoft.com/?kbid=885453

Windows Network Connection Properties:
 Preferred networks, [SSID] Properties:
   Association:
     Network Auth: WPA
     Data Enc: AES
   Authentication:
     EAP Type: PEAP
     Properties:
       X Validate Server certificate
       [You must install the Root CA certificate into the trsuted
root ca list and choose it here.]
       EAP-MS-CHAP v2
         Configure:
           X Automatically use my Windows logon name and Password (IF
PC IS JOINED TO DOMAIN)
           [ ] Automatically use my Windows logon name and Password
(IF NOT JOINED)
       X Enable Fast Reconnect