<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.59">
<TITLE>cisco device says "% Backup authentication" and won't log me in</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>I configured freeradius on a Fedora Core 6 machine to use PAP against a cisco switch<BR>
radtest on localhost is successfully. I think radiusd.conf users and clients.conf files are ok<BR>
<BR>
>From the cisco device after I insert user and password telnetting to it I got:<BR>
<BR>
% Backup authentication<BR>
000206: Apr 5 12:42:29: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.25.110.8:1645,<BR>
1646 is not responding.<BR>
000207: Apr 5 12:42:29: %RADIUS-4-RADIUS_ALIVE: RADIUS server 172.25.110.8:1645<BR>
,1646 has returned.<BR>
<BR>
the cisco device won't let me log in... 172.25.110.8 is the right IP of the freeradius<BR>
<BR>
And this is the freeradius server log:<BR>
<BR>
rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77<BR>
NAS-IP-Address = 172.25.110.109<BR>
NAS-Port = 2<BR>
NAS-Port-Type = Virtual<BR>
User-Name = "test"<BR>
Calling-Station-Id = "172.25.120.40"<BR>
User-Password = "test"<BR>
Processing the authorize section of radiusd.conf<BR>
modcall: entering group authorize for request 0<BR>
modcall[authorize]: module "preprocess" returns ok for request 0<BR>
modcall[authorize]: module "chap" returns noop for request 0<BR>
modcall[authorize]: module "mschap" returns noop for request 0<BR>
rlm_realm: No '@' in User-Name = "test", looking up realm NULL<BR>
rlm_realm: No such realm "NULL"<BR>
modcall[authorize]: module "suffix" returns noop for request 0<BR>
rlm_eap: No EAP-Message, not doing EAP<BR>
modcall[authorize]: module "eap" returns noop for request 0<BR>
users: Matched entry DEFAULT at line 152<BR>
users: Matched entry test at line 218<BR>
modcall[authorize]: module "files" returns ok for request 0<BR>
modcall: leaving group authorize (returns ok) for request 0<BR>
rad_check_password: Found Auth-Type Local<BR>
auth: type Local<BR>
auth: user supplied User-Password matches local User-Password<BR>
Sending Access-Accept of id 37 to 172.25.110.109 port 21645<BR>
Finished request 0<BR>
Going to the next request<BR>
--- Walking the entire request list ---<BR>
Waking up in 6 seconds...<BR>
rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77<BR>
Sending duplicate reply to client SW-DATA-1:21645 - ID: 37<BR>
Re-sending Access-Accept of id 37 to 172.25.110.109 port 21645<BR>
--- Walking the entire request list ---<BR>
Cleaning up request 0 ID 37 with timestamp 4614ef14<BR>
Nothing to do. Sleeping until we see a request.<BR>
rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77<BR>
NAS-IP-Address = 172.25.110.109<BR>
NAS-Port = 2<BR>
NAS-Port-Type = Virtual<BR>
User-Name = "test"<BR>
Calling-Station-Id = "172.25.120.40"<BR>
User-Password = "test"<BR>
Processing the authorize section of radiusd.conf<BR>
modcall: entering group authorize for request 1<BR>
modcall[authorize]: module "preprocess" returns ok for request 1<BR>
modcall[authorize]: module "chap" returns noop for request 1<BR>
modcall[authorize]: module "mschap" returns noop for request 1<BR>
rlm_realm: No '@' in User-Name = "test", looking up realm NULL<BR>
rlm_realm: No such realm "NULL"<BR>
modcall[authorize]: module "suffix" returns noop for request 1<BR>
rlm_eap: No EAP-Message, not doing EAP<BR>
modcall[authorize]: module "eap" returns noop for request 1<BR>
users: Matched entry DEFAULT at line 152<BR>
users: Matched entry test at line 218<BR>
modcall[authorize]: module "files" returns ok for request 1<BR>
modcall: leaving group authorize (returns ok) for request 1<BR>
rad_check_password: Found Auth-Type Local<BR>
auth: type Local<BR>
auth: user supplied User-Password matches local User-Password<BR>
Sending Access-Accept of id 37 to 172.25.110.109 port 21645<BR>
Finished request 1<BR>
Going to the next request<BR>
--- Walking the entire request list ---<BR>
Waking up in 6 seconds...<BR>
rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77<BR>
Sending duplicate reply to client SW-DATA-1:21645 - ID: 37<BR>
Re-sending Access-Accept of id 37 to 172.25.110.109 port 21645<BR>
--- Walking the entire request list ---<BR>
Cleaning up request 1 ID 37 with timestamp 4614ef1f<BR>
Nothing to do. Sleeping until we see a request.<BR>
<BR>
<BR>
I can't figure out what's wrong... It's seems that something missing on the cisco side<BR>
Is right that radius send back Access-Accept on port 21645?<BR>
<BR>
Thanks in advance<BR>
</FONT>
</P>
</BODY>
</HTML>