Hi,<br><br>is it possible that because of the configuration of the proxy.conf (proxying to an external radius), I don't use configuration on eap.conf (wich would be use only for local authentication) ? It would be the explanation i send EAP messages.<br>
<br><div class="gmail_quote">2009/9/26 Jacques FOUCHER <span dir="ltr"><<a href="mailto:jacques.foucher@gmail.com">jacques.foucher@gmail.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi,<br><br>I want to use eap to authenticate Wireless users on an radius server wich don't know EAP protocol. It seems that is possible to do that using a proxy freeradius. The architecture should be :<br><br>Access Point as a NAS Freeradius as a proxy Radius server without EAP<br>
192.168.0.250 192.168.0.64 192.168.0.252<br><br><-------------------------------EAP-----------------------------------------><br><-----------------------------------MS-CHAP v2 or other--------------------------------------------------------------------><br>
<br>The idea is to convert an EAP Response/Identity to a radius Access-Request without EAP inside<br><br><br>As the first radius i use freeradius Version 2.0.4<br>As the second one, i use IAS (just to test, but in the final configuration, it will not)<br>
<br>When i configure IAS with EAP method in Remote access Policy, it works. When I remove EAP method from IAS, it's not.<br>The problem is that freeradius is acting as a proxy without removing EAP and it is not what i want.<br>
<br>This is the modifications i did on configuration files, ask me if you need more<br><br><span style="color: rgb(51, 51, 153);">proxy.conf :</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">realm DEFAULT {</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> authhost = <a href="http://192.168.0.252:1812" target="_blank">192.168.0.252:1812</a></span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> accthost = <a href="http://192.168.0.252:1813" target="_blank">192.168.0.252:1813</a></span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> secret = secret</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">}</span><br style="color: rgb(51, 51, 153);"><br style="color: rgb(51, 51, 153);" clear="all">
<span style="color: rgb(51, 51, 153);">eap.conf :</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> ttls {</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> default_eap_type = md5</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> copy_request_to_tunnel = no</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> use_tunneled_reply = no</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> virtual_server = "inner-tunnel"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> }</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">peap { </span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> default_eap_type = mschapv2</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> copy_request_to_tunnel = no</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> use_tunneled_reply = no</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> proxy_tunneled_request_as_eap = no</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> virtual_server = "inner-tunnel"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> }</span><br style="color: rgb(51, 51, 153);"><br>On wireless, i tried TTLS and PEAP with same unsuccessfull result.<br>That is freeradius log :<br><span style="color: rgb(51, 51, 153);">Ready to process requests.</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">rad_recv: Access-Request packet from host 192.168.0.250 port 32769, id=30, length=229</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Acct-Session-Id = "8b0b0795-0000009c"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> NAS-Port = 157</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> NAS-Port-Type = Wireless-802.11</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> NAS-Identifier = "AP1"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> NAS-IP-Address = 192.168.0.250</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Framed-MTU = 1496</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> User-Name = "test"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Calling-Station-Id = "00-13-02-C4-80-4C"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Called-Station-Id = "00-0F-61-FE-EF-D2"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Service-Type = Framed-User</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> EAP-Message = 0x021a00090174657374</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "ssid=test2"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "vsc-unique-id=3"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "phytype=IEEE802dot11g"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-Attr-250 = 0x00000000</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-Attr-249 = 0x00000000</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Message-Authenticator = 0x0ed85e6e5c0765e5390b037233c60d73</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">+- entering group authorize</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[preprocess] returns ok</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[chap] returns noop</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">++[mschap] returns noop</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> rlm_realm: No '@' in User-Name = "test", looking up realm NULL</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> rlm_realm: Found realm "DEFAULT"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> rlm_realm: Adding Stripped-User-Name = "test"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> rlm_realm: Adding Realm = "DEFAULT"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> rlm_realm: Proxying request from user test to realm DEFAULT</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> rlm_realm: Preparing to proxy authentication request to realm "DEFAULT"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[suffix] returns updated</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> rlm_eap: Request is supposed to be proxied to Realm DEFAULT. Not doing EAP.</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[eap] returns noop</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">++[unix] returns notfound</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[files] returns noop</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[expiration] returns noop</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">++[logintime] returns noop</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[pap] returns noop</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">Sending Access-Request of id 224 to 192.168.0.252 port 1812</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Acct-Session-Id = "8b0b0795-0000009c"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> NAS-Port = 157</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> NAS-Port-Type = Wireless-802.11</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> NAS-Identifier = "AP1"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> NAS-IP-Address = 192.168.0.250</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Framed-MTU = 1496</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> User-Name = "test"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Calling-Station-Id = "00-13-02-C4-80-4C"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Called-Station-Id = "00-0F-61-FE-EF-D2"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Service-Type = Framed-User</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> EAP-Message = 0x021a00090174657374</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "ssid=test2"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "vsc-unique-id=3"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "phytype=IEEE802dot11g"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-Attr-250 = 0x00000000</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-Attr-249 = 0x00000000</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Message-Authenticator = 0x00000000000000000000000000000000</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Proxy-State = 0x3330</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">Proxying request 1 to home server 192.168.0.252 port 1812</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">Sending Access-Request of id 224 to 192.168.0.252 port 1812</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Acct-Session-Id = "8b0b0795-0000009c"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> NAS-Port = 157</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> NAS-Port-Type = Wireless-802.11</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> NAS-Identifier = "AP1"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> NAS-IP-Address = 192.168.0.250</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Framed-MTU = 1496</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> User-Name = "test"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Calling-Station-Id = "00-13-02-C4-80-4C"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Called-Station-Id = "00-0F-61-FE-EF-D2"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Service-Type = Framed-User</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> EAP-Message = 0x021a00090174657374</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "ssid=test2"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "vsc-unique-id=3"</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-AVPair = "phytype=IEEE802dot11g"</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Colubris-Attr-250 = 0x00000000</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Colubris-Attr-249 = 0x00000000</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Message-Authenticator = 0x00000000000000000000000000000000</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Proxy-State = 0x3330</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">Going to the next request</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">Waking up in 0.9 seconds.</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">rad_recv: Access-Reject packet from host 192.168.0.252 port 1812, id=224, length=24</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> Proxy-State = 0x3330</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">+- entering group post-proxy</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> rlm_eap: No pre-existing handler found</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[eap] returns noop</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">Login incorrect (Home Server says so): [test/<no User-Password attribute>] (from client AP1 port 157 cli 00-13-02-C4-80-4C)</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> Found Post-Auth-Type Reject</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">+- entering group REJECT</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);"> expand: %{User-Name} -> test</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);"> attr_filter: Matched entry DEFAULT at line 11</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">++[attr_filter.access_reject] returns updated</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">Delaying reject of request 1 for 1 seconds</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">Going to the next request</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">Waking up in 0.9 seconds.</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">Sending delayed reject for request 1</span><br style="color: rgb(51, 51, 153);">
<span style="color: rgb(51, 51, 153);">Sending Access-Reject of id 30 to 192.168.0.250 port 32769</span><br style="color: rgb(51, 51, 153);"><span style="color: rgb(51, 51, 153);">Waking up in 4.9 seconds.</span><br><br>
On IAS Server, this is the error message (Sorry it is a french version, but the idea is IAS receive EAP message)<br>
<br><span style="color: rgb(0, 0, 153);">L'accès a été refusé à l'utilisateur test.</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Nom-Complet-Utilisateur = <a href="http://jacques.net/Users/test" target="_blank">jacques.net/Users/test</a></span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> Adresse-IP-NAS = 192.168.0.250</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Identificateur-NAS = AP1</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Identificateur-Station-Appelée = 00-0F-61-FE-EF-D2</span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> Identificateur-Station-Appelante = 00-13-02-C4-80-4C</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Nom-Convivial-Client = freeradius</span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> Adresse-IP-Client = 192.168.0.64</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Type-Port-NAS = Wireless - IEEE 802.11</span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> Port-NAS = 107</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Proxy-Policy-Name = test</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Authentication-Provider = Windows </span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> Authentication-Server = <non déterminé> </span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Policy-Name = test</span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> <span style="color: rgb(255, 0, 0);">Authentication-Type = EAP</span></span><br style="color: rgb(255, 0, 0);"><span style="color: rgb(0, 0, 153);"><span style="color: rgb(255, 0, 0);"> EAP-Type = <non déterminé></span> </span><br style="color: rgb(0, 0, 153);">
<span style="color: rgb(0, 0, 153);"> Reason-Code = 66</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);"> Reason = L'utilisateur a essayé d'utiliser une méthode d'authentification qui n'est pas activée sur la stratégie d'accès à distance correspondante. Le nom de la stratégie d'accès à distance correspondante. </span><br style="color: rgb(0, 0, 153);">
<br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);">Pour plus d'informations, consultez le centre Aide et support à l'adresse <a href="http://go.microsoft.com/fwlink/events.asp" target="_blank">http://go.microsoft.com/fwlink/events.asp</a>.</span><br>
<br>I hope you could help me.<br>-- <br><font color="#888888">Jacques <br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Jacques FOUCHER<br>