<p>I was out if the office and in a meeting on my cell phone. Sorry.. didn't mean to offend.</p>
<div class="gmail_quote">On Apr 25, 2012 4:04 PM, <<a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Send Freeradius-Users mailing list submissions to<br>
<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.freeradius.org/mailman/listinfo/freeradius-users" target="_blank">http://lists.freeradius.org/mailman/listinfo/freeradius-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:freeradius-users-owner@lists.freeradius.org">freeradius-users-owner@lists.freeradius.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Freeradius-Users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Fwd: FreeRadius Dictionary Attributes (Alan DeKok)<br>
2. Re: Assign VLAN from freeradius to Cisco 3550 switch.<br>
(Wassim Zaarour)<br>
3. Re: Assign VLAN from freeradius to Cisco 3550 switch. (alan buxey)<br>
4. Cisco WLC - Freeradius Vlan assigment problem (Martin Silvero)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 25 Apr 2012 18:03:06 +0200<br>
From: Alan DeKok <<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Fwd: FreeRadius Dictionary Attributes<br>
Message-ID: <<a href="mailto:4F98203A.3080303@deployingradius.com">4F98203A.3080303@deployingradius.com</a>><br>
Content-Type: text/plain; charset=ISO-8859-1<br>
<br>
Corey Jones wrote:<br>
> ---------- Forwarded message ----------<br>
...<br>
<br>
That's not nice. Is it really that difficult to post the *original*<br>
message? Why forward a bounce?<br>
<br>
> I'm trying to get a freeradius server up and running but I'm having<br>
> trouble with the attributes I've included in the master dictionary file<br>
> showing up in the detail file:<br>
><br>
> ATTRIBUTE client-mac-address 9001 string<br>
<br>
This is wrong.<br>
<br>
Read share/dictionary. Use the numbers *it* recommends, rather than<br>
inventing your own.<br>
<br>
> The output of the detail-<date> file of the non-functioning server:<br>
<br>
Which is... which version? How did you configure it?<br>
<br>
> The output of the detail-<date> file for the functioning server:<br>
<br>
Which is... which version? How did you configure it?<br>
<br>
> If you compare the non-functioning server output file to the functioning<br>
> server output file, there are two fields that are missing that are<br>
> defined in the master dictionary file.<br>
><br>
> disc-cause-ext = "PPP Receive Term" <---------------HERE<br>
> client-mac-address = "0002.xxxx.xxxx" <---------------HERE<br>
<br>
If the two servers are identical, they will behave the same.<br>
<br>
If they're different, find out what the differences are, and fix them.<br>
<br>
> I am having trouble with a different part of the server setup where that<br>
> file is pulled and those fields are read and needed by another application.<br>
<br>
What does that mean?<br>
<br>
> Does anyone know why those two fields are not pulled or processed on the<br>
> non-functioning server's output file?<br>
<br>
The fields are "pulled" from... where?<br>
<br>
> freeradius -X dump of non-functioning server:<br>
<br>
In which it doesn't receive any packets. So it's useless.<br>
<br>
Good questions get good answers.<br>
<br>
These questions are bad. As a result, the only possible answer is<br>
unhelpful. Along with the advice "ask good questions."<br>
<br>
Alan DeKok.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 25 Apr 2012 19:05:26 +0300<br>
From: Wassim Zaarour <<a href="mailto:wassim.zaarour@navlink.com">wassim.zaarour@navlink.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Assign VLAN from freeradius to Cisco 3550 switch.<br>
Message-ID: <<a href="mailto:CBBDFB26.EE39%25wassim.zaarour@navlink.com">CBBDFB26.EE39%wassim.zaarour@navlink.com</a>><br>
Content-Type: text/plain; CHARSET=US-ASCII<br>
<br>
Hi Brian,<br>
<br>
Thanks for your reply, where do I exactly need to put this configuration?<br>
In the users file?<br>
<br>
Do you have any experience with the 2960 switches?<br>
<br>
<br>
Wassim<br>
<br>
<br>
<br>
<br>
<br>
On 4/25/12 4:07 PM, "Brian Julin" <<a href="mailto:BJulin@clarku.edu">BJulin@clarku.edu</a>> wrote:<br>
<br>
><br>
>Wassim Zaarour wrote:<br>
>> Look at this<br>
>><br>
>><a href="http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg4016" target="_blank">http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg4016</a><br>
>>2.html<br>
>><br>
>> The user says that it worked, I tried the attributes he used and still<br>
>>got<br>
>> the same error.<br>
><br>
>I don't even know how this was ever working for that user. On my wired<br>
>switch plant, which<br>
>includes some 3550s, wherever I have tested VLAN assignment I have had to<br>
>use Cisco's<br>
>cretinous hack:<br>
><br>
><br>
> if (Cisco-AVPair) { # Cisco switch.<br>
> # We have to "Accept" it to the Registration VLAN manually<br>
> # (because host-mode multi-auth is currently retarded.)<br>
> update reply {<br>
> Tunnel-Type = VLAN<br>
> Tunnel-Medium-Type = 6<br>
> # CISCO broke the IETF attribute...<br>
> # Tunnel-Private-Group-Id = "Registration"<br>
> # ... so use their proprietary method to get it in there.<br>
> # NOTE: This is CaSe SeNsItIvE!!<br>
> Cisco-AVPair += "tunnel-private-group-id=Registration"<br>
> }<br>
><br>
>This is of course extremely case-sensitive. It also uses the vlan names,<br>
>not the numbers, though<br>
>you can use the automatically generated names just fine.<br>
><br>
>Be warned the 3550s are old EOL switches and their latest software<br>
>version (the one that is only<br>
>supposed to be used for the 24 port switch but works on the 48 port one)<br>
>is still not current enough<br>
>to pick up the latest bugfixes to multi-auth mode. Not that multi-auth<br>
>mode works sensibly in the<br>
>newest firmware either, but at least it has workarounds.<br>
><br>
>(BTW, even I am starting to pull these 3550s from the net, and I tend to<br>
>try to bleed devices for every<br>
>minute they can manage to hack it. Right now the only ones I have out<br>
>there are essentially<br>
>serving as lightening rods for this summer's thunder storms, and then<br>
>will be replaced by new<br>
>switches after that.)<br>
><br>
>Typical switch port configuration (this is not from a 3550, sorry):<br>
><br>
><br>
>interface FastEthernet0/24<br>
> switchport access vlan XXX<br>
> switchport mode access<br>
> switchport block unicast<br>
> switchport port-security maximum 16<br>
> switchport port-security<br>
> switchport port-security aging time 240<br>
> switchport port-security violation restrict<br>
> switchport port-security aging type inactivity<br>
> ip arp inspection limit rate 100<br>
> authentication control-direction in<br>
> authentication event fail action authorize vlan YYY<br>
> authentication event server dead action authorize vlan XXX<br>
> authentication event no-response action authorize vlan XXX<br>
> authentication event server alive action reinitialize<br>
> authentication host-mode multi-auth<br>
> authentication order mab<br>
> authentication priority mab<br>
> authentication port-control auto<br>
> authentication periodic<br>
> authentication timer reauthenticate 1300<br>
> authentication timer inactivity 1200<br>
> authentication violation restrict<br>
> mab<br>
> no lldp transmit<br>
> no lldp receive<br>
> no cdp enable<br>
> no cdp tlv server-location<br>
> no cdp tlv app<br>
> spanning-tree portfast<br>
> spanning-tree bpduguard enable<br>
> ip verify source port-security<br>
> ip dhcp snooping limit rate 50<br>
>end<br>
><br>
><br>
>XXX and YYY above are actually decimals.<br>
><br>
>Note that the auth-fail VLAN setting is not actually used, because in<br>
>order to get multi-auth to behave<br>
>sensibly (so you can handle VMs) you have to actually succeed every<br>
>authentication and just send<br>
>the quaranteen VLAN from RADIUS when you want the user locked out.<br>
>-<br>
>List info/subscribe/unsubscribe? See<br>
><a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Wed, 25 Apr 2012 18:13:22 +0100<br>
From: alan buxey <<a href="mailto:A.L.M.Buxey@lboro.ac.uk">A.L.M.Buxey@lboro.ac.uk</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Assign VLAN from freeradius to Cisco 3550 switch.<br>
Message-ID: <<a href="mailto:20120425171322.GB9623@lboro.ac.uk">20120425171322.GB9623@lboro.ac.uk</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
Hi,<br>
<br>
> Thanks for your reply, where do I exactly need to put this configuration?<br>
> In the users file?<br>
<br>
I can tell you right now that you dont need that hack to assign VLANs on cisco<br>
switches (well, not if you are running reasonably up to date firmware on the<br>
cisco devices anyway - ie something less than 2 years old)<br>
<br>
we run an enterprise network of > 1500 cisco switches, most of them using<br>
FreeRADIUS as the AAA server in 802.1X mode (others still have VMPS - with FreeRADIUS<br>
of course). we certainly dont have that kind of configuration for VLAN assignment.<br>
straight simple reply values are all that are needed.<br>
as already said, the issue looks like its your Cisco config - and the cisco<br>
guides tell you exactly how to configure the cisco switches, its not a freeRADIUS<br>
question.<br>
<br>
alan<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Wed, 25 Apr 2012 16:49:29 -0300<br>
From: Martin Silvero <<a href="mailto:silvero.martin@gmail.com">silvero.martin@gmail.com</a>><br>
To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
Subject: Cisco WLC - Freeradius Vlan assigment problem<br>
Message-ID:<br>
<<a href="mailto:CALmvTSSRrfx9eyOoXxcwYjtxF6oEKHS8MNtewGBONG_wxP9cTQ@mail.gmail.com">CALmvTSSRrfx9eyOoXxcwYjtxF6oEKHS8MNtewGBONG_wxP9cTQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
We are modifying the Wireless acccess to our LAN.<br>
We are trying to use a Cisco WLC and our freeradius. We've been using this<br>
same freeradius for authenticating users against the corporate LDAP. Now<br>
we want WLC to talk to the radius server without losing any functionality<br>
like user authentication or vlan assignment.<br>
<br>
Our main problem is that the vlan assingment is not working when we use the<br>
WLC. The scenario with the APs talking to the radius directly works fine,<br>
but when we use lightweight AP and the WLC we can see that the vlan<br>
assignment part is skipped by the authentication process and all the users<br>
are sent to the same vlan.<br>
<br>
The following is the output of the two cases. One of them is a user<br>
authenticating without WLC, the AP talks directly to the Radius Server, and<br>
the other is an authentication where WLC talks to the Radius Server (the<br>
one that is not working)<br>
<br>
- 10.32.2.81 is the WLC IP address.<br>
<br>
- 10.32.2.39 is the AP IP address.<br>
<br>
WLC Soft Version: 7.0.116.0<br>
<br>
These are the outputs:<br>
<br>
1) AP - RADIUS (No WLC)<br>
<br>
*****************************************************<br>
rad_recv: Access-Request packet from host 10.32.2.39 port 1645, id=205,<br>
length=184<br>
User-Name = "fcanales"<br>
Framed-MTU = 1400<br>
Called-Station-Id = "001d.4551.7da0"<br>
Calling-Station-Id = "5894.6b0d.e86c"<br>
Service-Type = Login-User<br>
Message-Authenticator = 0x46192e9a5e4720bd6c721e03d8e6c3b4<br>
EAP-Message =<br>
0x0208002b19001703010020f7e5545e9d9e05ecff5f8be2d1bc992eeddba82eb4adef509bded9dd6c132712<br>
NAS-Port-Type = Wireless-802.11<br>
NAS-Port = 59460<br>
State = 0xf4160a33f11e13898255a02243c509d6<br>
NAS-IP-Address = 10.32.2.39<br>
NAS-Identifier = "ap-Reco32"<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
[suffix] No '@' in User-Name = "fcanales", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
[eap] EAP packet type response id 8 length 43<br>
[eap] Continuing tunnel setup.<br>
++[eap] returns ok<br>
Found Auth-Type = EAP<br>
+- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/peap<br>
[eap] processing type peap<br>
[peap] processing EAP-TLS<br>
[peap] eaptls_verify returned 7<br>
[peap] Done initial handshake<br>
[peap] eaptls_process returned 7<br>
[peap] EAPTLS_OK<br>
[peap] Session established. Decoding tunneled attributes.<br>
[peap] Identity - fcanales<br>
[peap] Got tunneled request<br>
EAP-Message = 0x0208000d016663616e616c6573<br>
server {<br>
PEAP: Got tunneled identity of fcanales<br>
PEAP: Setting default EAP type for tunneled EAP session.<br>
PEAP: Setting User-Name to fcanales<br>
Sending tunneled request<br>
EAP-Message = 0x0208000d016663616e616c6573<br>
FreeRADIUS-Proxied-To = 127.0.0.1<br>
User-Name = "fcanales"<br>
Framed-MTU = 1400<br>
Called-Station-Id = "001d.4551.7da0"<br>
Calling-Station-Id = "5894.6b0d.e86c"<br>
Service-Type = Login-User<br>
NAS-Port-Type = Wireless-802.11<br>
NAS-Port = 59460<br>
NAS-IP-Address = 10.32.2.39<br>
NAS-Identifier = "ap-Reco32"<br>
server inner-tunnel {<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++? if (!Huntgroup-Name)<br>
? Evaluating !(Huntgroup-Name) -> FALSE<br>
++? if (!Huntgroup-Name) -> FALSE<br>
++? if (Huntgroup-Name == "list")<br>
? Evaluating (Huntgroup-Name == "list") -> TRUE<br>
++? if (Huntgroup-Name == "list") -> TRUE<br>
++- entering if (Huntgroup-Name == "list") {...}<br>
+++? if (Ldap-Group == "WIFI-Direccion")<br>
rlm_ldap: Entering ldap_groupcmp()<br>
expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar<br>
expand: (uid=%u) -> (uid=fcanales)<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(uid=fcanales)<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
WARNING: Deprecated conditional expansion ":-". See "man unlang" for<br>
details<br>
expand:<br>
(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}}))<br>
-> (&(objectClass=posixGroup)(memberUid=fcanales))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(&(cn=WIFI-Direccion)(&(objectClass=posixGroup)(memberUid=fcanales)))<br>
rlm_ldap: object not found<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
rlm_ldap::ldap_groupcmp: Group WIFI-Direccion not found or user is not a<br>
member.<br>
+++? if (Ldap-Group == "WIFI-MKTyCC")<br>
rlm_ldap: Entering ldap_groupcmp()<br>
expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar<br>
<br>
WARNING: Deprecated conditional expansion ":-". See "man unlang" for<br>
details<br>
expand:<br>
(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}}))<br>
-> (&(objectClass=posixGroup)(memberUid=fcanales))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(&(cn=WIFI-Finanzas)(&(objectClass=posixGroup)(memberUid=fcanales)))<br>
rlm_ldap: object not found<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
rlm_ldap::ldap_groupcmp: Group WIFI-Finanzas not found or user is not a<br>
member.<br>
+++? if (Ldap-Group == "WIFI-TyO")<br>
rlm_ldap: Entering ldap_groupcmp()<br>
expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar<br>
WARNING: Deprecated conditional expansion ":-". See "man unlang" for<br>
details<br>
expand:<br>
(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}}))<br>
-> (&(objectClass=posixGroup)(memberUid=fcanales))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(&(cn=WIFI-TyO)(&(objectClass=posixGroup)(memberUid=fcanales)))<br>
rlm_ldap::ldap_groupcmp: User found in group WIFI-TyO<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
? Evaluating (Ldap-Group == "WIFI-TyO") -> TRUE<br>
+++? if (Ldap-Group == "WIFI-TyO") -> TRUE<br>
+++- entering if (Ldap-Group == "WIFI-TyO") {...}<br>
++++[reply] returns ok<br>
+++- if (Ldap-Group == "WIFI-TyO") returns ok<br>
+++? if (Ldap-Group == "WIFI-ITfuncional")<br>
rlm_ldap: Entering ldap_groupcmp()<br>
expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar<br>
WARNING: Deprecated conditional expansion ":-". See "man unlang" for<br>
details<br>
expand:<br>
(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}}))<br>
-> (&(objectClass=posixGroup)(memberUid=fcanales))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(&(cn=WIFI-Monit)(&(objectClass=posixGroup)(memberUid=fcanales)))<br>
rlm_ldap: object not found<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
rlm_ldap::ldap_groupcmp: Group WIFI-Monit not found or user is not a member.<br>
++- if (Huntgroup-Name == "list") returns ok<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
++[unix] returns updated<br>
[suffix] No '@' in User-Name = "fcanales", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
++[control] returns noop<br>
[eap] EAP packet type response id 8 length 13<br>
[eap] No EAP Start, assuming it's an on-going EAP conversation<br>
++[eap] returns updated<br>
++[files] returns noop<br>
[ldap] performing user authorization for fcanales<br>
[ldap] expand: (uid=%u) -> (uid=fcanales)<br>
[ldap] expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(uid=fcanales)<br>
[ldap] looking for check items in directory...<br>
rlm_ldap: sambaNtPassword -> NT-Password ==<br>
0x3441313536383141373845384430414446424135364139373343343736374646<br>
rlm_ldap: sambaLmPassword -> LM-Password ==<br>
0x4446323634314431373041414432333739433530313441453437313841374545<br>
[ldap] looking for reply items in directory...<br>
WARNING: No "known good" password was found in LDAP. Are you sure that the<br>
user is configured correctly?<br>
[ldap] user fcanales authorized to use remote access<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>
++[expiration] returns noop<br>
++[logintime] returns noop<br>
[pap] Normalizing NT-Password from hex encoding<br>
[pap] Normalizing LM-Password from hex encoding<br>
[pap] Found existing Auth-Type, not changing it.<br>
++[pap] returns noop<br>
Found Auth-Type = EAP<br>
+- entering group authenticate {...}<br>
[eap] EAP Identity<br>
[eap] processing type mschapv2<br>
rlm_eap_mschapv2: Issuing Challenge<br>
++[eap] returns handled<br>
} # server inner-tunnel<br>
[peap] Got tunneled reply code 11<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "212"<br>
EAP-Message =<br>
0x010900221a0109001d108279970f23460b83f1fffcc6e09626c56663616e616c6573<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0x158baf111582b5a1fb3a126781117cd4<br>
[peap] Got tunneled reply RADIUS code 11<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "212"<br>
EAP-Message =<br>
0x010900221a0109001d108279970f23460b83f1fffcc6e09626c56663616e616c6573<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0x158baf111582b5a1fb3a126781117cd4<br>
[peap] Got tunneled Access-Challenge<br>
++[eap] returns handled<br>
Sending Access-Challenge of id 205 to 10.32.2.39 port 1645<br>
EAP-Message =<br>
0x0109004b19001703010040640c0cb308474b42ecc083db0b3f47c66731a31c01801dde9b162f50d5bde13456412ab71e4d7d0e743b50cc42e91bba22dabeb375116f48b625e9691a3d3932<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xf4160a33f21f13898255a02243c509d6<br>
Finished request 38.<br>
<br>
*****************************************************<br>
<br>
<br>
<br>
<br>
2) WLC - RADIUS<br>
<br>
*****************************************************<br>
<br>
rad_recv: Access-Request packet from host 10.32.2.81 port 32768, id=119,<br>
length=280<br>
User-Name = "fcanales"<br>
Calling-Station-Id = "58-94-6b-0d-e8-6c"<br>
Called-Station-Id = "30-37-a6-4b-9f-90:IReconquista"<br>
NAS-Port = 1<br>
Cisco-AVPair = "audit-session-id=0a2002510000000f4eaaf051"<br>
NAS-IP-Address = 10.32.2.81<br>
NAS-Identifier = "Iplan_wcs"<br>
Airespace-Wlan-Id = 1<br>
Service-Type = Framed-User<br>
Framed-MTU = 1300<br>
NAS-Port-Type = Wireless-802.11<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "60"<br>
EAP-Message =<br>
0x0208002b190017030100200c857843d879e361aad79c8a2dccee6de8b04225d90b753a81b636a8090f0193<br>
State = 0xcb0bb3aace03aab2864a9aacb255d323<br>
Message-Authenticator = 0x62ca91e9e88fbba794e6e51db7aa67ec<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
[suffix] No '@' in User-Name = "fcanales", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
[eap] EAP packet type response id 8 length 43<br>
[eap] Continuing tunnel setup.<br>
++[eap] returns ok<br>
Found Auth-Type = EAP<br>
+- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/peap<br>
[eap] processing type peap<br>
[peap] processing EAP-TLS<br>
[peap] eaptls_verify returned 7<br>
[peap] Done initial handshake<br>
[peap] eaptls_process returned 7<br>
[peap] EAPTLS_OK<br>
[peap] Session established. Decoding tunneled attributes.<br>
[peap] Identity - fcanales<br>
[peap] Got tunneled request<br>
EAP-Message = 0x0208000d016663616e616c6573<br>
server {<br>
PEAP: Got tunneled identity of fcanales<br>
PEAP: Setting default EAP type for tunneled EAP session.<br>
PEAP: Setting User-Name to fcanales<br>
Sending tunneled request<br>
EAP-Message = 0x0208000d016663616e616c6573<br>
FreeRADIUS-Proxied-To = 127.0.0.1<br>
User-Name = "fcanales"<br>
Calling-Station-Id = "58-94-6b-0d-e8-6c"<br>
Called-Station-Id = "30-37-a6-4b-9f-90:IReconquista"<br>
NAS-Port = 1<br>
Cisco-AVPair = "audit-session-id=0a2002510000000f4eaaf051"<br>
NAS-IP-Address = 10.32.2.81<br>
NAS-Identifier = "Iplan_wcs"<br>
Airespace-Wlan-Id = 1<br>
Service-Type = Framed-User<br>
Framed-MTU = 1300<br>
NAS-Port-Type = Wireless-802.11<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "60"<br>
server inner-tunnel {<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++? if (!Huntgroup-Name)<br>
? Evaluating !(Huntgroup-Name) -> TRUE<br>
++? if (!Huntgroup-Name) -> TRUE<br>
++- entering if (!Huntgroup-Name) {...}<br>
+++[reply] returns ok<br>
++- if (!Huntgroup-Name) returns ok<br>
++? if (Huntgroup-Name == "list")<br>
(Attribute Huntgroup-Name was not found)<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
++[unix] returns updated<br>
[suffix] No '@' in User-Name = "fcanales", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
++[control] returns noop<br>
[eap] EAP packet type response id 8 length 13<br>
[eap] No EAP Start, assuming it's an on-going EAP conversation<br>
++[eap] returns updated<br>
++[files] returns noop<br>
[ldap] performing user authorization for fcanales<br>
[ldap] expand: (uid=%u) -> (uid=fcanales)<br>
[ldap] expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter<br>
(uid=fcanales)<br>
[ldap] looking for check items in directory...<br>
rlm_ldap: sambaNtPassword -> NT-Password ==<br>
0x3441313536383141373845384430414446424135364139373343343736374646<br>
rlm_ldap: sambaLmPassword -> LM-Password ==<br>
0x4446323634314431373041414432333739433530313441453437313841374545<br>
[ldap] looking for reply items in directory...<br>
WARNING: No "known good" password was found in LDAP. Are you sure that the<br>
user is configured correctly?<br>
[ldap] user fcanales authorized to use remote access<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>
++[expiration] returns noop<br>
++[logintime] returns noop<br>
[pap] Normalizing NT-Password from hex encoding<br>
[pap] Normalizing LM-Password from hex encoding<br>
[pap] Found existing Auth-Type, not changing it.<br>
++[pap] returns noop<br>
Found Auth-Type = EAP<br>
+- entering group authenticate {...}<br>
[eap] EAP Identity<br>
[eap] processing type mschapv2<br>
rlm_eap_mschapv2: Issuing Challenge<br>
++[eap] returns handled<br>
} # server inner-tunnel<br>
[peap] Got tunneled reply code 11<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "249"<br>
EAP-Message =<br>
0x010900221a0109001d10cc9cc5bb2b5812cf48051342472ad3af6663616e616c6573<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xab42e29bab4bf81ef23bc50dea94c334<br>
[peap] Got tunneled reply RADIUS code 11<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "249"<br>
EAP-Message =<br>
0x010900221a0109001d10cc9cc5bb2b5812cf48051342472ad3af6663616e616c6573<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xab42e29bab4bf81ef23bc50dea94c334<br>
[peap] Got tunneled Access-Challenge<br>
++[eap] returns handled<br>
Sending Access-Challenge of id 119 to 10.32.2.81 port 32768<br>
EAP-Message =<br>
0x0109004b1900170301004075cf3c75c7a8311c01bc5581aac330e49586ce6e0001e8add345d7773aeeacba61b235c462fe0966e565d9e6279f111bf94fa3d8a4bff8a4ce82ab24d65f9c31<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xcb0bb3aacd02aab2864a9aacb255d323<br>
Finished request 48.<br>
Going to the next request<br>
Waking up in 4.9 seconds.<br>
<br>
*****************************************************<br>
<br>
Thanks for all.<br>
<br>
<br>
--<br>
--<br>
<br>
Silvero Martin<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120425/4200c3a7/attachment.html" target="_blank">http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120425/4200c3a7/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
End of Freeradius-Users Digest, Vol 84, Issue 96<br>
************************************************<br>
</blockquote></div>