<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial, sans-serif" size="2">
<div>Hi,</div>
<div> </div>
<div>I have a little problem.</div>
<div>I have two devices within the same huntgroup, but i get in trouble with one of them.</div>
<div>Both are Cisco Nexus, but there is one difference:</div>
<div>The working one has NXOS 5.x, the one that is not working as expected NXOS 4.x</div>
<div> </div>
<div>Why is the right line in the users file found for the working device (line 67), but not found for the other device (line 136)?</div>
<div>While both devices are in the same huntgroup and both requests look identically?</div>
<div> </div>
<div>Any ideas?</div>
<div>Am i just blind?</div>
<div> </div>
<div>The interesting part is, that both requests look identical (even in tcpdump!).</div>
<div>But the answer paket always shows a "bad udp checksum" when i´m not able to log in.</div>
<div> </div>
<div>17:33:57.201238 IP (tos 0x0, ttl 64, id 1280, offset 0, flags [none], proto: UDP (17), length: 48) radius-server.datametrics > 10.48.137.62 .40077: [bad udp cksum 2dde!] RADIUS, length: 20</div>
<div> Access Reject (3), id: 0x17, Authenticator: 436530c99d29615e3a35aa878275a97d</div>
<div> </div>
<div>Is it possible that this causes my problem?</div>
<div> </div>
<div>Jan</div>
<div> </div>
<div> </div>
<div>Huntgroups:</div>
<div>================================</div>
<div>nexus NAS-IP-Address == 10.48.141.157</div>
<div>nexus NAS-IP-Address == 10.48.137.62</div>
<div> </div>
<div> </div>
<div>Users:</div>
<div>================================</div>
<div>Line 67 ff:</div>
<div>test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6 "</div>
<div> Login-Service = Telnet,</div>
<div> Vendor-Specific = 9,</div>
<div> Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\""</div>
<div> </div>
<div>Line 136:</div>
<div>DEFAULT Auth-Type := Reject</div>
<div> </div>
<div> </div>
<div>Not Working:</div>
<div>================================</div>
<div> </div>
<div>rad_recv: Access-Request packet from host 10.48.137.62 port 7032, id=63, length=62</div>
<div> User-Name = "test"</div>
<div> User-Password = "test"</div>
<div> NAS-Port-Type = Virtual</div>
<div> NAS-Port = 3002</div>
<div> NAS-IP-Address = 10.48.137.62</div>
<div>+- entering group authorize {...}</div>
<div>++[preprocess] returns ok</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>[files] users: Matched entry DEFAULT at line 136</div>
<div>++[files] returns ok</div>
<div>[ldap] performing user authorization for test</div>
<div>[ldap] expand: (uid=%u) -> (uid=test)</div>
<div>[ldap] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>[ldap] search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>++[ldap] returns notfound</div>
<div>[pap] Found existing Auth-Type, not changing it.</div>
<div>++[pap] returns noop</div>
<div>Found Auth-Type = Reject</div>
<div>Auth-Type = Reject, rejecting user</div>
<div>Failed to authenticate the user.</div>
<div>Login incorrect (rlm_ldap: User not found): [test] (from client RZ-XXX port 3002)</div>
<div>Using Post-Auth-Type Reject</div>
<div>+- entering group REJECT {...}</div>
<div>[attr_filter.access_reject] expand: %{User-Name} -> test</div>
<div> attr_filter: Matched entry DEFAULT at line 11</div>
<div>++[attr_filter.access_reject] returns updated</div>
<div>Sending Access-Reject of id 63 to 10.48.137.62 port 7032</div>
<div>Finished request 20.</div>
<div>Going to the next request</div>
<div>Waking up in 4.9 seconds.</div>
<div> </div>
<div> </div>
<div>Working:</div>
<div>================================</div>
<div> </div>
<div>rad_recv: Access-Request packet from host 10.48.141.157 port 48132, id=229, length=62</div>
<div> User-Name = "test"</div>
<div> User-Password = "test"</div>
<div> NAS-Port-Type = Virtual</div>
<div> NAS-Port = 3019</div>
<div> NAS-IP-Address = 10.48.141.157</div>
<div>+- entering group authorize {...}</div>
<div>++[preprocess] returns ok</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>rlm_ldap: Entering ldap_groupcmp()</div>
<div>[files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>[files] expand: (uid=%u) -> (uid=test)</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>rlm_ldap::ldap_groupcmp: search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>[files] users: Matched entry test at line 67</div>
<div>++[files] returns ok</div>
<div>[ldap] performing user authorization for test</div>
<div>[ldap] expand: (uid=%u) -> (uid=test)</div>
<div>[ldap] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test)</div>
<div>rlm_ldap: object not found</div>
<div>[ldap] search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>++[ldap] returns notfound</div>
<div>[pap] Normalizing MD5-Password from hex encoding</div>
<div>[pap] Found existing Auth-Type, not changing it.</div>
<div>++[pap] returns noop</div>
<div>Found Auth-Type = PAP</div>
<div>+- entering group PAP {...}</div>
<div>[pap] login attempt with password "test"</div>
<div>[pap] Using MD5 encryption.</div>
<div>[pap] User authenticated successfully</div>
<div>++[pap] returns ok</div>
<div>Login OK: [test] (from client RZ-XXX port 3019)</div>
<div> WARNING: Empty section. Using default return values.</div>
<div>Sending Access-Accept of id 229 to 10.48.141.157 port 48132</div>
<div> Login-Service = Telnet</div>
<div> Vendor-Specific = 0x39</div>
<div> Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\""</div>
<div>Finished request 17.</div>
<div>Going to the next request</div>
<div>Waking up in 4.9 seconds.</div>
<div> </div>
</font>
</body>
</html>