<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:·s²Ó©úÅé
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thanks alan for help. But I haven't got it done now..still cannot let it get into post-proxy-fail section.<div>please take a look on my config and another debug log! Thanks!</div><div><br></div><div>Below is my proxy.conf.</div><div><div><b>home_server test_1 {</b></div><div><b> type=auth+acct</b></div><div><b> ipaddr=172.30.179.22</b></div><div><b> port=1812</b></div><div><b> secret = test123</b></div><div><b> require_message_authenticator=no</b></div><div><b> response_window = 5</b></div><div><b> zombie_period = 5</b></div><div><b> revive_interval = 5</b></div><div><b> status_check = none</b></div><div><b> check_interval = 30</b></div><div><b> num_answers_to_alive = 3</b></div><div><b>}</b></div><div><b>home_server_pool test_pool {</b></div><div><b> type = fail-over</b></div><div><b> home_server = test_1</b></div><div><b>}</b></div><div><b>realm test {</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>pool = test_pool</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>nostrip</b></div><div><b>}</b></div></div><div><br></div><div>Because the scenario what I simulate is that external AAA might not be freeradius, so I set status_check to "none". Also, as alan mentioned, I set response_window and zombie_period to 5.</div><div><br></div><div>About my ./site-available/default config, I only show the part of post-proxy. You can find that in Post-Proxy-Type Fail section, I want to update a Tmp-String value. Then I can know it is proxy timeout so that I will write down a log in perl.</div><div><div><b>post-proxy {</b></div><div><b><br></b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span># If you want to have a log of replies from a home server,</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span># un-comment the following line, and the 'detail post_proxy_log'</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span># section, above.</b></div><div><b>#<span class="Apple-tab-span" style="white-space:pre"> </span>post_proxy_log</b></div><div><b><br></b></div><div><b>#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_rewrite</b></div><div><b><br></b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span># Uncomment the following line if you want to filter replies from</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span># remote proxies based on the rules defined in the 'attrs' file.</b></div><div><b>#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.post-proxy</b></div><div><b><br></b></div><div><br></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Post-Proxy-Type Fail {</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>update control {</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>Tmp-String-0 := "PJ-TO"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>}</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>perl-log-module-here</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>}</b></div><div><b>}</b></div></div><div><b><br></b></div><div>last is my debug log:</div><div><br></div><div><div><b>rad_recv: Access-Request packet from host 172.30.179.21 port 55342, id=27, length=79</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 0</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x3d63469358ade53b4181dc50a857762b</b></div><div><b># Executing section authorize from file /opt/freeRADIUS/etc/raddb/sites-enabled/default</b></div><div><b>+- entering group authorize {...}</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{client:Gateway-Type} -> ALU</b></div><div><b>++[control] returns notfound</b></div><div><b>rlm_perl: RAD_CONFIG: Tmp-String-8 = ALU</b></div><div><b>rlm_perl: Added pair User-Name = test@test</b></div><div><b>rlm_perl: Added pair User-Password = 123</b></div><div><b>rlm_perl: Added pair NAS-Port = 0</b></div><div><b>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1</b></div><div><b>rlm_perl: Added pair Message-Authenticator = 0x3d63469358ade53b4181dc50a857762b</b></div><div><b>rlm_perl: Added pair Tmp-String-8 = ALU</b></div><div><b>++[test_client_config] returns noop</b></div><div><b>++[preprocess] returns ok</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Packet-Src-IP-Address} -> 172.30.179.21</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /opt/freeRADIUS/var/log/radius/radacct/172.30.179.21/auth-detail-20140214</b></div><div><b>[auth_log] /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /opt/freeRADIUS/var/log/radius/radacct/172.30.179.21/auth-detail-20140214</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %t -> Fri Feb 14 09:36:15 2014</b></div><div><b>++[auth_log] returns ok</b></div><div><b>++[chap] returns noop</b></div><div><b>++[mschap] returns noop</b></div><div><b>++[digest] returns noop</b></div><div><b>[suffix] Looking up realm "test" for User-Name = "test@test"</b></div><div><b>[suffix] Found realm "test"</b></div><div><b>[suffix] Adding Realm = "test"</b></div><div><b>[suffix] Proxying request from user test to realm test</b></div><div><b>[suffix] Preparing to proxy authentication request to realm "test" </b></div><div><b>++[suffix] returns updated</b></div><div><b>[eap] No EAP-Message, not doing EAP</b></div><div><b>++[eap] returns noop</b></div><div><b>++[files] returns noop</b></div><div><b>++[expiration] returns noop</b></div><div><b>++[logintime] returns noop</b></div><div><b>++[pap] returns noop</b></div><div><b># Executing section pre-proxy from file /opt/freeRADIUS/etc/raddb/sites-enabled/default</b></div><div><b>+- entering group pre-proxy {...}</b></div><div><b>[attr_filter.pre-proxy] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Realm} -> test</b></div><div><b>attr_filter: Matched entry DEFAULT at line 50</b></div><div><b>++[attr_filter.pre-proxy] returns updated</b></div><div><b>Sending Access-Request of id 219 to 172.30.179.22 port 1812</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x00000000000000000000000000000000</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Proxy-State = 0x3237</b></div><div><b>Proxying request 0 to home server 172.30.179.22 port 1812</b></div><div><b>Sending Access-Request of id 219 to 172.30.179.22 port 1812</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x00000000000000000000000000000000</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Proxy-State = 0x3237</b></div><div><b>Going to the next request</b></div><div><b>Waking up in 0.9 seconds.</b></div><div><b>Waking up in 4.0 seconds.</b></div><div><b>Cleaning up request 0 ID 27 with timestamp +7</b></div><div><b>Marking home server 172.30.179.22 port 1812 as zombie (it looks like it is dead).</b></div><div><b>rad_recv: Access-Request packet from host 172.30.179.21 port 55342, id=27, length=79</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 0</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x3d63469358ade53b4181dc50a857762b</b></div><div><b># Executing section authorize from file /opt/freeRADIUS/etc/raddb/sites-enabled/default</b></div><div><b>+- entering group authorize {...}</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{client:Gateway-Type} -> ALU</b></div><div><b>++[control] returns notfound</b></div><div><b>rlm_perl: RAD_CONFIG: Tmp-String-8 = ALU</b></div><div><b>rlm_perl: Added pair User-Name = test@test</b></div><div><b>rlm_perl: Added pair User-Password = 123</b></div><div><b>rlm_perl: Added pair NAS-Port = 0</b></div><div><b>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1</b></div><div><b>rlm_perl: Added pair Message-Authenticator = 0x3d63469358ade53b4181dc50a857762b</b></div><div><b>rlm_perl: Added pair Tmp-String-8 = ALU</b></div><div><b>++[test_client_config] returns noop</b></div><div><b>++[preprocess] returns ok</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Packet-Src-IP-Address} -> 172.30.179.21</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /opt/freeRADIUS/var/log/radius/radacct/172.30.179.21/auth-detail-20140214</b></div><div><b>[auth_log] /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /opt/freeRADIUS/var/log/radius/radacct/172.30.179.21/auth-detail-20140214</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %t -> Fri Feb 14 09:36:20 2014</b></div><div><b>++[auth_log] returns ok</b></div><div><b>++[chap] returns noop</b></div><div><b>++[mschap] returns noop</b></div><div><b>++[digest] returns noop</b></div><div><b>[suffix] Looking up realm "test" for User-Name = "test@test"</b></div><div><b>[suffix] Found realm "test"</b></div><div><b>[suffix] Adding Realm = "test"</b></div><div><b>[suffix] Proxying request from user test to realm test</b></div><div><b>[suffix] Preparing to proxy authentication request to realm "test" </b></div><div><b>++[suffix] returns updated</b></div><div><b>[eap] No EAP-Message, not doing EAP</b></div><div><b>++[eap] returns noop</b></div><div><b>++[files] returns noop</b></div><div><b>++[expiration] returns noop</b></div><div><b>++[logintime] returns noop</b></div><div><b>++[pap] returns noop</b></div><div><b># Executing section pre-proxy from file /opt/freeRADIUS/etc/raddb/sites-enabled/default</b></div><div><b>+- entering group pre-proxy {...}</b></div><div><b>[attr_filter.pre-proxy] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Realm} -> test</b></div><div><b>attr_filter: Matched entry DEFAULT at line 50</b></div><div><b>++[attr_filter.pre-proxy] returns updated</b></div><div><b>Sending Access-Request of id 69 to 172.30.179.22 port 1812</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x00000000000000000000000000000000</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Proxy-State = 0x3237</b></div><div><b>Proxying request 1 to home server 172.30.179.22 port 1812</b></div><div><b>Sending Access-Request of id 69 to 172.30.179.22 port 1812</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x00000000000000000000000000000000</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Proxy-State = 0x3237</b></div><div><b>Going to the next request</b></div><div><b>Waking up in 0.9 seconds.</b></div><div><b>Waking up in 4.0 seconds.</b></div><div><b>Marking home server 172.30.179.22 port 1812 as dead.</b></div><div><b>Cleaning up request 1 ID 27 with timestamp +12</b></div><div><b>rad_recv: Access-Request packet from host 172.30.179.21 port 55342, id=27, length=79</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "test@test"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "123"</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 127.0.0.1</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 0</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x3d63469358ade53b4181dc50a857762b</b></div><div><b># Executing section authorize from file /opt/freeRADIUS/etc/raddb/sites-enabled/default</b></div><div><b>+- entering group authorize {...}</b></div><div><b><span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{client:Gateway-Type} -> ALU</b></div><div><b>++[control] returns notfound</b></div><div><b>rlm_perl: RAD_CONFIG: Tmp-String-8 = ALU</b></div><div><b>rlm_perl: Added pair User-Name = test@test</b></div><div><b>rlm_perl: Added pair User-Password = 123</b></div><div><b>rlm_perl: Added pair NAS-Port = 0</b></div><div><b>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1</b></div><div><b>rlm_perl: Added pair Message-Authenticator = 0x3d63469358ade53b4181dc50a857762b</b></div><div><b>rlm_perl: Added pair Tmp-String-8 = ALU</b></div><div><b>++[test_client_config] returns noop</b></div><div><b>++[preprocess] returns ok</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Packet-Src-IP-Address} -> 172.30.179.21</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /opt/freeRADIUS/var/log/radius/radacct/172.30.179.21/auth-detail-20140214</b></div><div><b>[auth_log] /opt/freeRADIUS/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /opt/freeRADIUS/var/log/radius/radacct/172.30.179.21/auth-detail-20140214</b></div><div><b>[auth_log] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %t -> Fri Feb 14 09:36:25 2014</b></div><div><b>++[auth_log] returns ok</b></div><div><b>++[chap] returns noop</b></div><div><b>++[mschap] returns noop</b></div><div><b>++[digest] returns noop</b></div><div><b>[suffix] Looking up realm "test" for User-Name = "test@test"</b></div><div><b>[suffix] Found realm "test"</b></div><div><b>[suffix] Adding Realm = "test"</b></div><div><b>[suffix] Proxying request from user test to realm test</b></div><div><b>[suffix] Preparing to proxy authentication request to realm "test" </b></div><div><b>++[suffix] returns updated</b></div><div><b>[eap] No EAP-Message, not doing EAP</b></div><div><b>++[eap] returns noop</b></div><div><b>++[files] returns noop</b></div><div><b>++[expiration] returns noop</b></div><div><b>++[logintime] returns noop</b></div><div><b>++[pap] returns noop</b></div><div><b><font color="#ac193d">ERROR: Failed to find live home server for realm test</font></b></div><div><b><font color="#ac193d">There was no response configured: rejecting request 2</font></b></div><div><b>Using Post-Auth-Type REJECT</b></div><div><b># Executing group from file /opt/freeRADIUS/etc/raddb/sites-enabled/default</b></div><div><b>+- entering group REJECT {...}</b></div><div><b>[attr_filter.access_reject] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> test@test</b></div><div><b>attr_filter: Matched entry DEFAULT at line 11</b></div><div><b>++[attr_filter.access_reject] returns updated</b></div><div><b>Delaying reject of request 2 for 1 seconds</b></div><div><b>Going to the next request</b></div><div><b>Waking up in 0.9 seconds.</b></div><div><b>Sending delayed reject for request 2</b></div><div><b>Sending Access-Reject of id 27 to 172.30.179.21 port 55342</b></div><div><b>Waking up in 4.9 seconds.</b></div><div><b>Cleaning up request 2 ID 27 with timestamp +17</b></div><div><b>Waking up in 53.9 seconds.</b></div><div><b>Marking home server 172.30.179.22 port 1812 alive again... we have no idea if it really is alive or not.</b></div><div><b>Ready to process requests.</b></div></div><div><br></div><div>Is there anything I still need to get it down? Thanks for all your patience!</div><div><br></div><div>Okis</div><div><br></div><div><br></div> </div></body>
</html>