<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div><br>Date: Fri, 16 Dec 2011 16:39:07 +0000<br>From: Phil Mayers <<a href="mailto:p.mayers@imperial.ac.uk">p.mayers@imperial.ac.uk</a>><br>Subject: Re: FreeRadius going through ISA to reach federation<br>To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>Message-ID: <<a href="mailto:4EEB742B.50302@imperial.ac.uk">4EEB742B.50302@imperial.ac.uk</a>><br>Content-Type: text/plain; charset=ISO-8859-1; format=flowed<br><br>On 16/12/11 14:29, Rui Ribeiro wrote:<br><blockquote type="cite">Hi all,<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I have configuring a FreeRadius, and I need to go through a IAS to reach the<br></blockquote><br>Ugh. Nasty. IAS as an eduroam proxy!<br></div></blockquote><div><br></div>Actually is just for testing, will talk with the responsible entity next week, but with the festivities at the door, roaming through IAS would probably allow me to switch to freeradius sooner.</div><div><br><blockquote type="cite"><div><br><blockquote type="cite">eduroam federation. I created a realm for our local domain, created a<br></blockquote><blockquote type="cite">DEFAULT proxy for users with other domains pointing to the IAS server, both<br></blockquote><blockquote type="cite">are as clients of each other, share the same secret, and also defined a<br></blockquote><blockquote type="cite">Remote access policy in IAS.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Tried already some alternatives, and inserted Reply-Message = "Yes", as<br></blockquote><blockquote type="cite">suggested on another post in the list.<br></blockquote><br>Eh? Who suggested that?<br></div></blockquote><div>Another freeradius<->IAS thread in this list.</div><br><blockquote type="cite"><div><br><blockquote type="cite"><br></blockquote><blockquote type="cite">Despite all the efforts, when talking with the IAS, I receive back the error<br></blockquote><blockquote type="cite">Proxy-State = 0x3137.<br></blockquote><br>That's not an error; it's just a radius attribute.<br><br></div></blockquote><div>In the debug logs, I have: </div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; ">ad_recv: Access-Reject packet from host 10.10.66.18 port 1812, id=251,<br>length=24<br> Proxy-State = 0x3137</span></div><div><br></div><br><blockquote type="cite"><div><blockquote type="cite"><br></blockquote><blockquote type="cite">Any advice?<br></blockquote><br>You will need to debug this on the IAS server, since it is sending (or <br>proxying) the reject. My guess is the policies in IAS are wrong.<br><br><br></div></blockquote><div>Tried to see the IAS logs, they didn't much sense. Will have a look at system events.</div><br><blockquote type="cite"><div>------------------------------<br><br></div></blockquote></div><br></body></html>