<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Nur Text Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Arial","sans-serif";}
span.NurTextZchn
{mso-style-name:"Nur Text Zchn";
mso-style-priority:99;
mso-style-link:"Nur Text";
font-family:"Arial","sans-serif";
mso-fareast-language:DE;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText><span lang=EN-US>Hi!<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>I was still not able to get a trace on the client site, but I believe these debug log entries should help. This time I got the start packet and it is within some seconds that I get the 2 packet to the radius server and the State variable seems to be the same.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>Ready to process requests.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'>rad_recv: Access-Request packet from host 10.xx.xx.5 port 54217, id=11, length=152<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> User-Name = "host/xxxxxxxxxxxxx.local"<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> EAP-Message = 0x02ff002101686f73742f4456542d303039363832322e7469726f6c2e6c6f63616c<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-IP-Address = 10.xx.xx.5<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> Service-Type = Login-User<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> Calling-Station-Id = "xx-xx-xx-xx-xx-xx"<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-Port-Id = "1:29"<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-Port = 1029<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-Port-Type = Ethernet<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> Message-Authenticator = 0xd080844ef3e47a9bc21e8c848b5a8548<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>……<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[eap] EAP packet type response id 255 length 33<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[eap] No EAP Start, assuming it's an on-going EAP conversation<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>+++[eap] returns updated<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>++- else else returns updated<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>Found Auth-Type = EAP<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'># Executing group from file /etc/raddb/sites-enabled/default<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>+- entering group EAP {...}<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[eap] EAP Identity<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[eap] processing type tls<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[tls] Requiring client certificate<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[tls] Initiate<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>[tls] Start returned 1<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>……<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#4F6228;mso-style-textfill-fill-color:#4F6228;mso-style-textfill-fill-alpha:100.0%'>Sending Access-Challenge of id 11 to 10.xx.xx.5 port 54217<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#4F6228;mso-style-textfill-fill-color:#4F6228;mso-style-textfill-fill-alpha:100.0%'> EAP-Message = 0x010000060d20<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#4F6228;mso-style-textfill-fill-color:#4F6228;mso-style-textfill-fill-alpha:100.0%'> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#4F6228;mso-style-textfill-fill-color:#4F6228;mso-style-textfill-fill-alpha:100.0%'> State = <span style='background:yellow;mso-highlight:yellow'>0x642534cc642539e20b4be1e3ae0328c0</span><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>Finished request 62603.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>Going to the next request<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New"'>Waking up in 4.9 seconds.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'>rad_recv: Access-Request packet from host 10. xx.xx.5 port 54217, id=12, length=242<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> User-Name = "host/xxxxxxxxxxxxx.tirol.local"<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> EAP-Message = 0x02ff00690d800000005f160301005a01000056030150bd9377fb696c9f5eaedc568220f9aa35ab65930cf2232f4131c054b0562954000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-IP-Address = 10.xx.xx.5<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> Service-Type = Login-User<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> Calling-Station-Id = "xx-xx-xx-xx-xx-xx"<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-Port-Id = "1:29"<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-Port = 1029<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> NAS-Port-Type = Ethernet<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> State = <span style='background:yellow;mso-highlight:yellow'>0x642534cc642539e20b4be1e3ae0328c0</span><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='font-family:"Courier New";color:#953735;mso-style-textfill-fill-color:#953735;mso-style-textfill-fill-alpha:100.0%'> Message-Authenticator = 0xeada93f9da1ca47a6f0325e8ad0414a9<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>…….<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>[eap] EAP packet type response id 255 length 105<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>[eap] No EAP Start, assuming it's an on-going EAP conversation<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>+++[eap] returns updated<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>++- else else returns updated<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>Found Auth-Type = EAP<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US># Executing group from file /etc/raddb/sites-enabled/default<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>+- entering group EAP {...}<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US style='background:yellow;mso-highlight:yellow'>rlm_eap: No EAP session matching the State variable.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>[eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>[eap] Failed in handler<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>++[eap] returns invalid<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>There is no other packet between this two and only 5 seconds, server has not been restarted.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>Robert<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>-----Ursprüngliche Nachricht-----<br>Von: freeradius-users-bounces+robert.penz=tirol.gv.at@lists.freeradius.org [mailto:freeradius-users-bounces+robert.penz=tirol.gv.at@lists.freeradius.org] Im Auftrag von PENZ Robert<br>Gesendet: Dienstag, 27. November 2012 17:38<br>An: FreeRadius users mailing list<br>Betreff: AW: AW: EAP-TLS Failed in handler question<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>> > With first packet I meant first packet the radius server saw in some time ... the switch forces a reauthentification every 2h<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> A re-auth is a fresh EAP session. So even on a re-auth, the first packet <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> would not have a "State" attribute, absent software bugs.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>ok<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>> >> It *could* be that the client just got stuck and is responding (very)<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> >> late. But I'm quite surprised the NAS didn't timeout the EAP auth before<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> >> that.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> ><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> > We're running Extreme Networks Switches with following timers set:<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> ><o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> > configure netlogin dot1x timers quiet-period 30<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> > configure netlogin dot1x timers reauth-period 7200<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> We run SummitX edge, and when I've tested dot1x netlogin in the past, I <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> haven't seen this issue. We've never widely deployed it, however, so <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> it's possible there's an XOS bug where a small percentage of re-auths <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> erroneously re-use the "State". You'd need to get a packet capture to be <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> sure.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>ok ... will try to get one .. is not easy ... <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>> > but reject means the switch sets the port to the guest vlan, and therefor the PC loses the connections ... is there a way to request a new full eap/tls handshake from the client?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> You're not understanding, or I'm not making myself clear.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> Suggestion: fire up wireshark, and take a careful look at a normal EAP <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> authentication. You'll see that the first packet is an EAP-Identity <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> without a "State" attribute, which the server responds to with an <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> Access-Challenge containing the default eap type "start" payload, and a <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> "State" attribute.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> Are you *absolutely sure* that these packets are really the first RADIUS <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> packet in the auth/re-auth?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>will check again and get back to you<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>> If you're sure, your problem seems to be that the correct first packet <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> isn't being sent; the switch is just jumping straight in with the EAP <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> payload *and* a "State" attribute. I am curious to know where it's <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> getting that "State" attribute.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> The server source code assumes that a "State" attribute will be valid. <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> There's no setting to "just accept it".<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> Interestingly, I see the RADIUS RFC does actually allow clients to send <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> a previous "State" if you send an Access-Accept with:<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> Termination-Action = RADIUS-request<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> You're not doing that, are you?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>no, I'm not<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>> No. As above, re-auths start new EAP sessions. You would only reject any <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> EAP sessions that were in the *middle* of performing an auth, as the <o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>> "state" would be lost across restarts. But this is a very narrow window.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>so I would be best to set iptables to drop requests for 1min than restart the radius und remove the iptables rules? or can I set freeradius in a mode where is does not accept new sessions? and after 2 minutes I restart it? So that the switch is forced onto the other switch.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>or what is the best practice to never have falls rejects?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>-<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html"><span style='color:windowtext;text-decoration:none'>http://www.freeradius.org/list/users.html</span></a><o:p></o:p></span></p></div></body></html>