<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-mailStijl17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=NL-BE link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoNormal>Hi all,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>We use a freeradius proxy for proxying wireless PEAP requests
to one of our two domains (via IAS and NPS in the near future) or to the next
Eduroam proxy.<o:p></o:p></p>
<p class=MsoNormal>Visa versa PEAP requests send by our students at other
schools are forwarded to our freeradius proxy. <o:p></o:p></p>
<p class=MsoNormal>Everything seems to work when we use the wireless clients of
Windows, Mac OS 10, Linux, smartphones, etc…), but there is one scenario
where it won’t work and what some schools use for testing.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I managed to reproduce that situation by using eapol_test, in
that case requests to IAS aren’t logged and it never replies with a Access-Challenge.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The versions of the software are:<o:p></o:p></p>
<p class=MsoNormal>FreeRADIUS 2.1.8+dfsg-1ubuntu1<o:p></o:p></p>
<p class=MsoNormal>OpenSSL 0.9.8k-7ubuntu8.3<o:p></o:p></p>
<p class=MsoNormal>Eapol_test from wpa_supplicant 0.7.3<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The configuration is simple and transparant, we have some
clients and some proxies, on the base of the realm the request is proxied to
the next radius server, without termination of EAP at freeradius.<o:p></o:p></p>
<p class=MsoNormal>If EAP is the problem, I could terminate the EAP tunnel for
our 2 domain on freeradius, how should I do that? Do I need to use the
inner-tunnel? Or proxy-inner-tunnel (what about Proxy-To-Realm than because we
have 2 domains)?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>In any case I would like to use a method without using
winbind.<o:p></o:p></p>
<p class=MsoNormal>Hope someone will give me a hint…<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Best regards,<o:p></o:p></p>
<p class=MsoNormal>Peter Kruppa<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<pre>
</pre></body>
</html>