<div dir="ltr">Hi Russell,<div><br></div><div>I changed the authorisation method on my device to EAP-TTLS, I could not get PAP to work. Now Session-Timeout is received by NAS. No more code 11. But for some reason MikroTik does not terminate the session after the assigned time. </div>
<div><br></div><div>I made post in <a href="http://forum.mikrotik.com/viewtopic.php?f=2&t=84986&p=426217#p426217">http://forum.mikrotik.com/viewtopic.php?f=2&t=84986&p=426217#p426217</a>. I will try to upgrade RouterOS to 6.12. Apart from this don't know what else to do.</div>
<div><br></div><div>Thank you for your kind help.</div><div><br></div><div>Jake He</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 14, 2014 at 6:16 PM, Russell Mike <span dir="ltr"><<a href="mailto:radius.sir@gmail.com" target="_blank">radius.sir@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><span style="font-family:trebuchet ms,sans-serif">Hi,<br><br> i am sure you are doing all that in LAB, why complex? try with PAP at least to make sure stuff works. And then configure EAP later. don't do anything to inner-tunnel. <br>
<br></span></div><span style="font-family:trebuchet ms,sans-serif">Thanks / Regards</span><br><br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 13, 2014 at 11:39 PM, * <span dir="ltr"><<a href="mailto:zhex900@gmail.com" target="_blank">zhex900@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "<b>eap_peap : Got tunneled reply code 11." </b>My NAS is receiving other Access-Challenge requests but not this one. </div>
<div><br></div><div>I tried to find out what code 11 but I cannot find a simple answer. </div><div><br></div><div>Do I need to configure my inner-tunnel? </div><div><br></div><div>Jake He</div><div><br></div><div><br></div>
<div><div><b>Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095</b></div>
<div><b><span style="white-space:pre-wrap"> </span>Session-Timeout := 600</b></div><div><b><span style="white-space:pre-wrap"> </span>Idle-Timeout := 30</b></div><div><div><b><span style="white-space:pre-wrap"> </span>EAP-Message = 0x010200061920</b></div>
<div><b><span style="white-space:pre-wrap"> </span>Message-Authenticator = 0x00000000000000000000000000000000</b></div></div><div><b><span style="white-space:pre-wrap"> </span>State = 0xb77514c3b6770d58e310744eea16afdc</b></div>
<div><b>(1) Finished request 1.</b></div><div><br></div><div>(8) [pap] = noop</div><div>(8) } # authorize = updated</div><div>(8) Found Auth-Type = EAP</div><div>(8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel</div>
<div>(8) authenticate {</div><div>(8) eap : Expiring EAP session with state 0x7b061f337b0e0549</div><div>(8) eap : Finished EAP session with state 0x7b061f337b0e0549</div><div>(8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list</div>
<div>(8) eap : Peer sent MSCHAPv2 (26)</div><div>(8) eap : EAP MSCHAPv2 (26)</div><div>(8) eap : Calling eap_mschapv2 to process EAP data</div><div>(8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel</div>
<div>(8) eap_mschapv2 : Auth-Type MS-CHAP {</div><div>(8) mschap : Found Cleartext-Password, hashing to create LM-Password</div><div>(8) mschap : Found Cleartext-Password, hashing to create NT-Password</div><div>(8) mschap : Creating challenge hash with username: bob</div>
<div>(8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password</div><div>(8) mschap : adding MS-CHAPv2 MPPE keys</div><div>(8) [mschap] = ok</div><div>(8) } # Auth-Type MS-CHAP = ok</div><div>MSCHAP Success </div>
<div>(8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549</div><div>(8) [eap] = handled</div><div>(8) } # authenticate = handled</div><div>} # server inner-tunnel</div><div><b>(8) eap_peap : Got tunneled reply code 11</b></div>
<div><b><span style="white-space:pre-wrap"> </span>Session-Timeout := 600</b></div><div><b><span style="white-space:pre-wrap"> </span>Idle-Timeout := 30</b></div><div><b><span style="white-space:pre-wrap"> </span>EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738</b></div>
<div><b><span style="white-space:pre-wrap"> </span>Message-Authenticator = 0x00000000000000000000000000000000</b></div><div><b><span style="white-space:pre-wrap"> </span>State = 0x7b061f337a0f0549d125cd93a8b94882</b></div>
<div>(8) eap_peap : Got tunneled reply RADIUS code 11</div><div><span style="white-space:pre-wrap"> </span>Session-Timeout := 600</div><div><span style="white-space:pre-wrap"> </span>Idle-Timeout := 30</div><div><span style="white-space:pre-wrap"> </span>EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738</div>
<div><span style="white-space:pre-wrap"> </span>Message-Authenticator = 0x00000000000000000000000000000000</div><div><span style="white-space:pre-wrap"> </span>State = 0x7b061f337a0f0549d125cd93a8b94882</div><div>
(8) eap_peap : Got tunneled Access-Challenge</div><div>(8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58</div><div>(8) [eap] = handled</div><div>(8) } # authenticate = handled</div>
</div><div><br></div><div><br></div><div><br></div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 13, 2014 at 9:32 PM, Russell Mike <span dir="ltr"><<a href="mailto:radius.sir@gmail.com" target="_blank">radius.sir@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote"><div>On Tue, May 13, 2014 at 12:30 PM, * <span dir="ltr"><<a href="mailto:zhex900@gmail.com" target="_blank">zhex900@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>Thank you for your patience. I am very happy someone can help me. Now I made some progress.</div>
<div><br></div><div>I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this:</div><div>
<div><span style="font-family:'trebuchet ms',sans-serif;font-size:13px"> query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(</span><span style="font-family:'trebuchet ms',sans-serif;font-size:13px">NOW(), MIN(AcctStartTime))),0) FROM <b><font color="#3d85c6">`radacct`</font> </b>WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"</span><br>
</div><div><span style="font-family:'trebuchet ms',sans-serif;font-size:13px"><br></span></div></div></div></blockquote></div><div><span style="font-family:trebuchet ms,sans-serif">Okay, good, there was error in username veritable as well in your previous query (<span style="font-size:13px">'%{%k}' </span>). Anyways. </span>happy it worked !!<br>
<br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><span style="font-family:'trebuchet ms',sans-serif;font-size:13px"></span></div>
</div><div><font face="trebuchet ms, sans-serif">Now, have one more problem. </font></div><div><font face="trebuchet ms, sans-serif"><br>
</font></div><div><font face="trebuchet ms, sans-serif">My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see </font>Acct-Session-Time. <span style="font-family:'trebuchet ms',sans-serif">Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds. </span></div>
<div><br></div><div><font face="trebuchet ms, sans-serif">Freeradius is sending it:</font></div><div><font face="trebuchet ms, sans-serif"><br></font></div><div><div>(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60</div>
<div>(2) [dailycounter] = ok</div></div><div><font face="trebuchet ms, sans-serif"><br></font></div><div><div>Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097</div><div><span style="white-space:pre-wrap"> </span>Session-Timeout = 60</div>
<div><span style="white-space:pre-wrap"> </span>EAP-Message = 0x010200061920</div><div><span style="white-space:pre-wrap"> </span>Message-Authenticator = 0x00000000000000000000000000000000</div><div><span style="white-space:pre-wrap"> </span>State = 0x543a9074553889da6f504855ab4e7a4b</div>
<div>(2) Finished request 2.</div></div><div><br></div><div>I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log. </div><div><br></div><div>
Is it my a problem with NAS configuration?</div><div><br></div><div><span style="font-family:'trebuchet ms',sans-serif;font-size:13px">What should I do now?</span></div></div></blockquote><div><span style="font-family:trebuchet ms,sans-serif"><br>
</span></div></div><div><span style="font-family:trebuchet ms,sans-serif">The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And</span><span style="font-family:trebuchet ms,sans-serif"> you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results. <br>
<br></span></div><div><span style="font-family:trebuchet ms,sans-serif">FreeRADIUS is now fine. </span><span style="font-family:trebuchet ms,sans-serif"><span style="font-family:trebuchet ms,sans-serif">Configure your NAS properly<br>
<br></span></span></div><div><span style="font-family:trebuchet ms,sans-serif">NOTE: Check item is for FreeRADIUS. reply item is for NAS. <br></span></div><div><span style="font-family:trebuchet ms,sans-serif"><br></span></div>
<div><span style="font-family:trebuchet ms,sans-serif">Thanks / Regards<span><font color="#888888"><br><br></font></span></span></div><span><font color="#888888"><div><span style="font-family:trebuchet ms,sans-serif">--RM <br>
<br><br></span></div></font></span><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div><span style="font-family:'trebuchet ms',sans-serif;font-size:13px"><br>
</span></div><div><span style="font-family:'trebuchet ms',sans-serif;font-size:13px">Jake He</span></div></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div>On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell <span dir="ltr"><<a href="mailto:a.cudbardb@freeradius.org" target="_blank">a.cudbardb@freeradius.org</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><div><br>
On 13 May 2014, at 08:46, * <<a href="mailto:zhex900@gmail.com" target="_blank">zhex900@gmail.com</a>> wrote:<br>
<br>
> You mean I need to upgrade to 3.0.3?<br>
<br>
</div>yes.<br>
<div><div><br>
Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org" target="_blank">a.cudbardb@freeradius.org</a>><br>
FreeRADIUS Development Team<br>
<br>
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br>
<br>
</div></div><br></div></div><div>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></div></blockquote></div><br></div>
<br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div></div><br></div></div>
<br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div>
</div></div><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div>
</div></div><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div>