<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
<title></title>
</head>
<body>
<p style="margin: 0px;"><span></span></p>
Hi Folks,<br />
<br />
I'm running into some very bad issue: when running freeradius in threaded mode (default)<br />
it's mixing up CONCURRENT requests resulting in a wrong vlan assignment.<br />
<br />
Here are the logs of two clients (OSX and Ubuntu). The Ubuntu supplicant (wpa-suppl.)<br />
always fails the first login try, but this is normal.<br />
<br />
This is with reauthentification interval of 10 seconds, so requests seem to overlap:<br />
<br />
Tue Sep 7 16:45:36 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:45:38 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:45:38 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:45:39 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:45:41 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB)<br />
Tue Sep 7 16:45:44 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 208 due to unfinished request 267<br />
Tue Sep 7 16:45:53 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:45:59 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB)<br />
Tue Sep 7 16:46:01 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 232 due to unfinished request 291<br />
<br />
Now let's check what Vlans got assigned (this is the vmps log, vmps gets only this MAC via rad2vmps and looks up the vlan in a mysql db):<br />
<br />
ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39<br />
ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39<br />
ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39<br />
ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39<br />
<br />
So freeradius takes the MAC of the OSX client and inserts it into the<br />
request that is associated with the Ubuntu client - VERY BAD.<br />
<br />
Now I only changed the reauthentification interval to 20 seconds, so the requests do not overlap anymore for sure.<br />
<br />
Tue Sep 7 16:46:50 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:46:53 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:46:53 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:46:57 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:46:57 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB)<br />
Tue Sep 7 16:47:17 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:47:20 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:47:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C)<br />
Tue Sep 7 16:47:25 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel)<br />
Tue Sep 7 16:47:25 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB)<br />
<br />
Vmps log:<br />
<br />
ALLOW: 00:1c:25:a2:10:3c -> FBIB, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/37<br />
ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39<br />
ALLOW: 00:1c:25:a2:10:3c -> FBIB, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/37<br />
ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39<br />
<br />
The short reauthentification interval is just to simulate a few more clients for stresstesting purposes.<br />
<br />
Can anyone help? The operating system is FreeBSD 8.1-RELEASE i386 and always las load averages of 0.00, 0.00, 0.00<br />
Switch hardware is cisco WS-C3560G-48PS with firmware (12.2(53)SE2 C3560-IPSERVICESK9-M).<br />
<br />
Best, Jan<br />
<br />
<br />
</body>
</html>