Hi All, <br><br>Supplicant tries authentication with EAP-TTLS, TLS tunnel is established properly but Radius sends Access-Reject. <br><br>Following are the xsupplicant.conf, eap.conf and radius output. radiusd.conf is not changed.<br>
<br>It would be great if anyone could help in solving this issue or identify it.<br><br>Thanks,<br>Nagendra.<br><br>freeradius version: FreeRADIUS Version 1.0.1<br>xsupplicant version: 1.2.8<br><br>Following is my xsupplicant configuration:<br>
<br> eap-ttls {<br> root_cert = /etc/raddb/certs/ca.pem<br> phase2_type = pap<br> pap {<br> username = <a href="mailto:test123@mynet.net">test123@mynet.net</a><br> password = "test123"<br>
}<br>}<br><br>Following is my eap.conf configuration with freeradius:<br><br> eap {<br> default_eap_type = ttls<br><br> timer_expire = 60<br><br> ignore_unknown_eap_types = no<br>
<br> cisco_accounting_username_bug = no<br><br> max_sessions = 2048<br><br> md5 {<br> }<br><br> leap {<br> }<br> gtc {<br>
auth_type = PAP<br> }<br><br> tls {<br> certdir = ${confdir}/certs<br> cadir = ${confdir}/certs<br><br> private_key_password = nagendra<br>
private_key_file = ${certdir}/server.pem<br><br> certificate_file = ${certdir}/server.pem<br> CA_file = ${cadir}/ca.pem<br> dh_file = ${certdir}/dh<br>
random_file = ${certdir}/random<br> fragment_size = 1024<br> include_length = yes<br> }<br> <br>
ttls {<br> default_eap_type = md5<br> copy_request_to_tunnel = no<br> use_tunneled_reply = no<br> }<br>}<br><br><br>Following is the output of freeRadius.<br>
<br>rad_recv: Access-Request packet from host <a href="http://12.12.12.2:52660">12.12.12.2:52660</a>, id=201, length=300<br> User-Name = "<a href="mailto:test123@mynet.net">test123@mynet.net</a>"<br> NAS-Port = 68<br>
State = 0x31f6a6d18c0edbbe0a8135be701c9eff<br> EAP-Message = 0x020e00801500170301002003c6f62435902b65dc7748b238fc47a7e5af9cfdbfed7ce3763b8a3830ac25a41703010050bd010059a58d0a9db18cb4df099dca43c1cadebca1672d9fb2b08a9131aa32b657e2d497196c130405e11396402abbcc130558325bc9ef888c19692d6ce7e2d736b463e6bfa09de4cacdc2511be08c20<br>
Message-Authenticator = 0x9b2ba395fe336634039600437f39e5e4<br> Acct-Session-Id = "8O2.1x81680002"<br> NAS-Port-Id = "ge-0/0/0.0"<br> Calling-Station-Id = "00-30-48-8b-7f-ff"<br>
Called-Station-Id = "00-1f-12-3f-89-40"<br> NAS-Identifier = "bng-l24f1-dev"<br> NAS-Port-Type = Virtual<br> Processing the authorize section of radiusd.conf<br>modcall: entering group authorize for request 5<br>
modcall[authorize]: module "preprocess" returns ok for request 5<br> rlm_eap: EAP packet type response id 14 length 128<br> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br> modcall[authorize]: module "eap" returns updated for request 5<br>
users: Matched DEFAULT at 164<br> users: Matched <a href="mailto:test123@mynet.net">test123@mynet.net</a> at 235<br> modcall[authorize]: module "files" returns ok for request 5<br>modcall: group authorize returns updated for request 5<br>
rad_check_password: Found Auth-Type EAP<br>auth: type "EAP"<br> Processing the authenticate section of radiusd.conf<br>modcall: entering group authenticate for request 5<br> rlm_eap: Request found, released from the list<br>
rlm_eap: EAP/ttls<br> rlm_eap: processing type ttls<br> rlm_eap_ttls: Authenticate<br> rlm_eap_tls: processing TLS<br> eaptls_verify returned 7 <br> rlm_eap_tls: Done initial handshake<br> eaptls_process returned 7 <br>
rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes.<br> TTLS: Got tunneled request<br> User-Name = "<a href="mailto:test123@mynet.net">test123@mynet.net</a>"<br> User-Password = "test123"<br>
FreeRADIUS-Proxied-To = 127.0.0.1<br> TTLS: Sending tunneled request<br> User-Name = "<a href="mailto:test123@mynet.net">test123@mynet.net</a>"<br> User-Password = "test123"<br> FreeRADIUS-Proxied-To = 127.0.0.1<br>
Processing the authorize section of radiusd.conf<br>modcall: entering group authorize for request 5<br> modcall[authorize]: module "preprocess" returns ok for request 5<br> rlm_eap: No EAP-Message, not doing EAP<br>
modcall[authorize]: module "eap" returns noop for request 5<br> users: Matched DEFAULT at 164<br> users: Matched <a href="mailto:test123@mynet.net">test123@mynet.net</a> at 235<br> modcall[authorize]: module "files" returns ok for request 5<br>
modcall: group authorize returns ok for request 5<br> rad_check_password: Found Auth-Type System<br>auth: type "System"<br> ERROR: Unknown value specified for Auth-Type. Cannot perform requested action.<br>auth: Failed to validate the user.<br>
TTLS: Got tunneled reply RADIUS code 3<br> TTLS: Got tunneled Access-Reject<br> rlm_eap: Handler failed in EAP/ttls<br> rlm_eap: Failed in EAP select<br> modcall[authenticate]: module "eap" returns invalid for request 5<br>
modcall: group authenticate returns invalid for request 5<br>auth: Failed to validate the user.<br>Delaying request 5 for 1 seconds<br>Finished request 5<br>Going to the next request<br>Waking up in 6 seconds...<br>rad_recv: Access-Request packet from host <a href="http://12.12.12.2:52660">12.12.12.2:52660</a>, id=201, length=300<br>
Sending Access-Reject of id 201 to <a href="http://12.12.12.2:52660">12.12.12.2:52660</a><br> EAP-Message = 0x040e0004<br> Message-Authenticator = 0x00000000000000000000000000000000<br><br>