<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hallo,<br>
I tried with EAP-TLS and PEAP/MS-CHAPv2.<br>
<br>
With the last, I have this user:<br>
<br>
vlan3 Cisco-AVPair == "ssid=VLAN3",
User-Password == "test"<br>
Tunnel-Medium-Type = IEEE-802,
<br>
Tunnel-Private-Group-Id = 3,
<br>
Tunnel-Type = VLAN
<br>
<br>
<br>
If I insert the check == in the Cisco-AVPair attribute, I have this
log:<br>
<br>
rad_recv: Access-Request packet from host 192.168.9.104:1645, id=21,
length=240<br>
User-Name = "vlan3"<br>
Framed-MTU = 1400<br>
Called-Station-Id = "0012.dacb.8420"<br>
Calling-Station-Id = "000c.f135.f1ba"<br>
Cisco-AVPair = "ssid=VLAN3"<br>
Service-Type = Login-User<br>
Message-Authenticator = 0x57cbe83313e35c36a3878a5151361c44<br>
EAP-Message =
0x020900501900170301002029a86e41268c925e584b0924c058e045487523e0b2181541f520fe517e5fa67c1703010020ebe4e512af90e916f41fc666e138157bd279a6ed7f1ab44243f67e72d18ce012<br>
NAS-Port-Type = Wireless-802.11<br>
Cisco-NAS-Port = "260"<br>
NAS-Port = 260<br>
State = 0xbb09e1038e24af4dc9f4002adb7d6b0a<br>
NAS-IP-Address = 192.168.9.104<br>
NAS-Identifier = "ap"<br>
Processing the authorize section of radiusd.conf<br>
modcall: entering group authorize for request 8<br>
modcall[authorize]: module "preprocess" returns ok for request 8<br>
modcall[authorize]: module "mschap" returns noop for request 8<br>
rlm_realm: No '@' in User-Name = "vlan3", looking up realm NULL<br>
rlm_realm: No such realm "NULL"<br>
modcall[authorize]: module "suffix" returns noop for request 8<br>
rlm_eap: EAP packet type response id 9 length 80<br>
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>
modcall[authorize]: module "eap" returns updated for request 8<br>
users: Matched entry vlan3 at line 24<br>
modcall[authorize]: module "files" returns ok for request 8<br>
modcall: leaving group authorize (returns updated) for request 8<br>
rad_check_password: Found Auth-Type EAP<br>
auth: type "EAP"<br>
Processing the authenticate section of radiusd.conf<br>
modcall: entering group authenticate for request 8<br>
rlm_eap: Request found, released from the list<br>
rlm_eap: EAP/peap<br>
rlm_eap: processing type peap<br>
rlm_eap_peap: Authenticate<br>
rlm_eap_tls: processing TLS<br>
eaptls_verify returned 7<br>
rlm_eap_tls: Done initial handshake<br>
eaptls_process returned 7<br>
rlm_eap_peap: EAPTLS_OK<br>
rlm_eap_peap: Session established. Decoding tunneled attributes.<br>
rlm_eap_peap: Received EAP-TLV response.<br>
rlm_eap_peap: Tunneled data is valid.<br>
rlm_eap_peap: Had sent TLV failure. User was rejcted rejected
earlier in this session.<br>
rlm_eap: Handler failed in EAP/peap<br>
rlm_eap: Failed in EAP select<br>
modcall[authenticate]: module "eap" returns invalid for request 8<br>
modcall: leaving group authenticate (returns invalid) for request 8<br>
auth: Failed to validate the user.<br>
Login incorrect: [vlan3/<no User-Password attribute>] (from
client ap-test port 260 cli 000c.f135.f1ba)<br>
Delaying request 8 for 1 seconds<br>
Finished request 8<br>
<br>
<br>
The radius don't authenticate my user, but the SSID is correct!<br>
<br>
I don't understand what is wrong.....<br>
<br>
<br>
Thanks a lot for your support...<br>
Antonio<br>
<br>
on 06/04/2006 14.59 Guy Davies said the following:
<blockquote
cite="mid38f596590604060559i3acf6ad8r2a0d0ba371765a7c@mail.gmail.com"
type="cite">
<pre wrap="">I don't think you should be setting the Auth-Type. Just let
FreeRADIUS work that out. What are you doing with your Cisco AP? Are
you doing PEAP/MS-CHAPv2? If so, then you must have a User-Password
== "foo" in your user database and you *must not* set Auth-Type :=
EAP.
You should do as Sergio says and use == in your Cisco-AVPair check
item. This is a comparison.
Rgds,
Guy
On 06/04/06, Antonio Matera <a class="moz-txt-link-rfc2396E" href="mailto:antonio.matera@create-net.it"><antonio.matera@create-net.it></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap=""> Hallo,
If I set Cisco-AVPair == "ssid=SSID1" in my user authentication, the
authentication Fail with any ssid and user.
If I set Cisco-AVPair := "ssid=SSID1" my users are always authenticated.
Is there any other configuration to set in the radius or in the access
point?
In my access request there is the AVPair attribute:
rad_recv: Access-Request packet from host 192.168.9.104:1645, id=19,
length=166
User-Name = "TEST4"
Framed-MTU = 1400
Called-Station-Id = "0012.dacb.8420"
Calling-Station-Id = "000c.f135.f1ba"
Cisco-AVPair = "ssid=VLAN3"
Service-Type = Login-User
Message-Authenticator =
0xb2a3f1fd52d9d6ff9702cc8f1f480f46
EAP-Message = 0x020600060d00
NAS-Port-Type = Wireless-802.11
Cisco-NAS-Port = "260"
NAS-Port = 260
State = 0x0491685cf8ece3184d685dedfedbb3d4
NAS-IP-Address = 192.168.9.104
NAS-Identifier = "ap"
but I don't understand if it works...
Any idea?
Thanks
on 06/04/2006 11.39 Sergio Sagliocco said the following:
Hi
I think you have to try in this way (for example):
TEST4 Cisco-AVPair == "ssid=SSID1" , Auth-Type := EAP
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-Id = 2,
Tunnel-Type = VLAN
DEFAULT Auth-Type := Reject
if uou want a password:
TEST4 Cisco-AVPair == "ssid=SSID1" ,User-Password="XXXX", Auth-Type := EAP
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-Id = 2,
Tunnel-Type = VLAN
DEFAULT Auth-Type := Reject
Regards
sergio
Antonio Matera wrote:
My goal is to have authenticate user only if the SSID is right!
You know how can I do it?
Thanks
Antonio
on 05/04/2006 17.33 Sergio Sagliocco said the following:
Hello
your goal is authenticate users only if the SSID is rght or to have
different EAP Authentication method based on SSID?
regards
sergio
Antonio Matera wrote:
Hallo,
thanks for the answer.
With your solution my radius don't authenticate my users....
Is my configuration correct or I need other change in my radius files?
Thanks bye
on 05/04/2006 15.27 Sergio Sagliocco said the following:
Hi
I think you have to use == instead of :=
For example:
DEFAULT Cisco-AVPair == "ssid=testLEAP" , EAP-Type := Cisco-LEAP
Regards
- List info/subscribe/unsubscribe? See
<a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
------------------------------------------------------------------------
-
List info/subscribe/unsubscribe? See
<a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
-
List info/subscribe/unsubscribe? See
<a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
<pre wrap=""><!---->
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
<br>
</body>
</html>