<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1317682482;
mso-list-type:hybrid;
mso-list-template-ids:2031231328 1583358562 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:\F0F0;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:1671249881;
mso-list-type:hybrid;
mso-list-template-ids:1757956452 -724275906 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:\F0E8;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I was wondering if anybody had any more information with this topic. Winbind authentication works every time during testing of ntlm_auth, but PEAP will only work once after a reboot and then fails every time. I can see a difference in the EAP-Message when running in debug mode once it gets Request 3’s Access-Request packet. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>>> When Successful:<o:p></o:p></p><p class=MsoNormal>rad_recv: Access-Request packet from host 172.20.1.99 port 65288, id=212, length=522<o:p></o:p></p><p class=MsoNormal> User-Name = " MYDOMAIN\\myuser"<o:p></o:p></p><p class=MsoNormal> NAS-Port = 68<o:p></o:p></p><p class=MsoNormal> State = 0xbdba4064bfb959ed871d7a760f4a6189<o:p></o:p></p><p class=MsoNormal> EAP-Message = 0x02030150198000000146160301010610000102010041edfd5ca690a35d3f2b0852c9b0018961373e600fa0f7d65fd7b37580cd527e634e4eba1fcf9ac1103146b7520c7d273f43d6698c3ce14a6d7650d6a1deaa28bc9d3156ffa21d627d91d6b7da5b229abfcab7a73b083fdb79e43a49dc98f0d20c497600cd96f2fe13587bb0d5e59f49c32cb36a0ee8efe471e77f4d128bfa815336b198e84a3d3549f1eaf2a7cce6b0ddc0c1d01b2685f34d23d8170f8e657ebfa9b33e5c95ba5e1fc1bf83f49a1031b228272d2f21af93c904cfc31a9689a3028ccd4f8eb0eed67d54b07459deef5618bff59d2ba2a6fe801868ddaa6b321200824fd6d2011a5f<o:p></o:p></p><p class=MsoNormal> EAP-Message = 0x640caaf2df40538fd91c1da8c2189b89d9d59e66b40f816d14030100010116030100303628b50481fc50a51db0c5315a5898ada3f498ed9385706e9b165e322cdb655704b73380d527cfa1966359f43e23b54a<o:p></o:p></p><p class=MsoNormal> Message-Authenticator = 0xe0435af614c2b43a52ab07911e607257<o:p></o:p></p><p class=MsoNormal> Acct-Session-Id = "8O2.1x8155007a0006d0e1"<o:p></o:p></p><p class=MsoNormal> NAS-Port-Id = "ge-0/0/1.0"<o:p></o:p></p><p class=MsoNormal> Calling-Station-Id = "00-21-86-a0-d5-b6"<o:p></o:p></p><p class=MsoNormal> Called-Station-Id = "00-1f-12-35-a3-40"<o:p></o:p></p><p class=MsoNormal> NAS-IP-Address = 172.20.1.99<o:p></o:p></p><p class=MsoNormal> NAS-Identifier = "CL-SW-SPARE-P48-1"<o:p></o:p></p><p class=MsoNormal> NAS-Port-Type = Ethernet<o:p></o:p></p><p class=MsoNormal>….<o:p></o:p></p><p class=MsoNormal>[eap] Request found, released from the list<o:p></o:p></p><p class=MsoNormal>[eap] EAP/peap<o:p></o:p></p><p class=MsoNormal>[eap] processing type peap<o:p></o:p></p><p class=MsoNormal>[peap] processing EAP-TLS<o:p></o:p></p><p class=MsoNormal> TLS Length 326 <o:p></o:p></p><p class=MsoNormal>[peap] Length Included<o:p></o:p></p><p class=MsoNormal>[peap] eaptls_verify returned 11 <o:p></o:p></p><p class=MsoNormal>[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange <o:p></o:p></p><p class=MsoNormal>[peap] TLS_accept: SSLv3 read client key exchange A <o:p></o:p></p><p class=MsoNormal>[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] <o:p></o:p></p><p class=MsoNormal>[peap] <<< TLS 1.0 Handshake [length 0010], Finished <o:p></o:p></p><p class=MsoNormal>[peap] TLS_accept: SSLv3 read finished A <o:p></o:p></p><p class=MsoNormal>[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] <o:p></o:p></p><p class=MsoNormal>[peap] TLS_accept: SSLv3 write change cipher spec A <o:p></o:p></p><p class=MsoNormal>[peap] >>> TLS 1.0 Handshake [length 0010], Finished <o:p></o:p></p><p class=MsoNormal>[peap] TLS_accept: SSLv3 write finished A <o:p></o:p></p><p class=MsoNormal>[peap] TLS_accept: SSLv3 flush data <o:p></o:p></p><p class=MsoNormal>[peap] (other): SSL negotiation finished successfully <o:p></o:p></p><p class=MsoNormal>SSL Connection Established<o:p></o:p></p><p class=MsoNormal>[peap] eaptls_process returned 13 <o:p></o:p></p><p class=MsoNormal>[peap] EAPTLS_HANDLED<o:p></o:p></p><p class=MsoNormal>++[eap] returns handled<o:p></o:p></p><p class=MsoNormal>Sending Access-Challenge of id 212 to 172.20.1.99 port 65288<o:p></o:p></p><p class=MsoNormal> EAP-Message = 0x01040041190014030100010116030100304722cf0ba4ff47b05d93e56d91e9f7fb385859f4517e96acb6f13887cee6d51e2e786637fb3a783ce362542c4004da32<o:p></o:p></p><p class=MsoNormal> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></p><p class=MsoNormal> State = 0xbdba4064bebe59ed871d7a760f4a6189<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>>> When Fails:<o:p></o:p></p><p class=MsoNormal>rad_recv: Access-Request packet from host 172.20.1.99 port 60566, id=62, length=190<o:p></o:p></p><p class=MsoNormal> User-Name = "MYDOMAIN\\myuser"<o:p></o:p></p><p class=MsoNormal> NAS-Port = 68<o:p></o:p></p><p class=MsoNormal> State = 0x98b30a269ab013ceb4bf9c4f43040953<o:p></o:p></p><p class=MsoNormal> EAP-Message = 0x020300061900<o:p></o:p></p><p class=MsoNormal> Message-Authenticator = 0x20ce44a84dc4391f888de907003c74b8<o:p></o:p></p><p class=MsoNormal> Acct-Session-Id = "8O2.1x81c3024a00011abf"<o:p></o:p></p><p class=MsoNormal> NAS-Port-Id = "ge-0/0/1.0"<o:p></o:p></p><p class=MsoNormal> Calling-Station-Id = "00-21-86-a0-d5-b6"<o:p></o:p></p><p class=MsoNormal> Called-Station-Id = "00-1f-12-35-a3-40"<o:p></o:p></p><p class=MsoNormal> NAS-IP-Address = 172.20.1.99<o:p></o:p></p><p class=MsoNormal> NAS-Identifier = "CL-SW-SPARE-P48-1"<o:p></o:p></p><p class=MsoNormal> NAS-Port-Type = Ethernet<o:p></o:p></p><p class=MsoNormal>….<o:p></o:p></p><p class=MsoNormal>[eap] Request found, released from the list<o:p></o:p></p><p class=MsoNormal>[eap] EAP/peap<o:p></o:p></p><p class=MsoNormal>[eap] processing type peap<o:p></o:p></p><p class=MsoNormal>[peap] processing EAP-TLS <o:p></o:p></p><p class=MsoNormal>[peap] Received TLS ACK<o:p></o:p></p><p class=MsoNormal>[peap] ACK handshake fragment handler<o:p></o:p></p><p class=MsoNormal>[peap] eaptls_verify returned 1 <o:p></o:p></p><p class=MsoNormal>[peap] eaptls_process returned 13 <o:p></o:p></p><p class=MsoNormal>[peap] EAPTLS_HANDLED<o:p></o:p></p><p class=MsoNormal>++[eap] returns handled<o:p></o:p></p><p class=MsoNormal>Sending Access-Challenge of id 62 to 172.20.1.99 port 60566<o:p></o:p></p><p class=MsoNormal> EAP-Message = 0x010400061900<o:p></o:p></p><p class=MsoNormal> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></p><p class=MsoNormal> State = 0x98b30a269bb713ceb4bf9c4f43040953<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>From what I can see, I’m getting a TLS ACK and no SSL connection established when it fails. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I generated my server certificate from our internal Microsoft Certificate Authority and installed them on the server. I’m pretty sure everything is okay since my Windows 2007 computer authenticates every time if configured to use certificate authentication rather than PEAP. Also, if I use Microsoft IAS as my radius server PEAP works every time, therefore I don’t believe my network equipment is having any problems. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any additional ideas would be greatly appreciated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks, <o:p></o:p></p><p class=MsoNormal>Nick<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><table class=MsoNormalTable border=0 cellspacing=1 cellpadding=0><tr><td style='padding:.75pt .75pt .75pt .75pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td style='padding:.75pt .75pt .75pt .75pt'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></td></tr><tr><td valign=top style='padding:.75pt .75pt .75pt .75pt'><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>