September 2008 - Freeradius-Users - lists.freeradius.org

FreeRadius Question - how to replicate accounting packets to another server radius
by Piero Santi 04 Sep '08

04 Sep '08

Hi all, i've installed freeradius-2.0.5 on Red-Hat 5.0 and i want to configure my radius server to replicate (i think NOT to proxy...waht is the different?) only accounting packets to another radius server based on apn name (NOT for user realm); always based on apn name attribute i want to assign different pool (defined on radippool table on mysql). Usually APN name is valorized in Called-Station-ID attribute ? The pool assignment works fine but i'm not able to replicate based on Called-Station-ID. Can you help me, please ? These are my config files: users DEFAULT Auth-Type := Accept, Called-Station-ID == 'apn1', Pool-Name := 'main_pool', Simultaneous-Use := 1 Fall-Through = Yes DEFAULT Auth-Type := Accept, Called-Station-ID == 'apn2', Pool-Name := 'second_pool', Simultaneous-Use := 1 Fall-Through = Yes radiusd.conf proxy_requests = yes Thanks in advance, Piero

2 3

Need Help Debugging
by Kirk Wallace 04 Sep '08

04 Sep '08

Hello, quite a while ago I got freeradius working with PoPToP using this link as a guide: http://poptop.sourceforge.net/dox/radius_mysql.html except I didn't use SQL, just a users list for my user account passwords. I tried to move this to a new Ubuntu install but I am having trouble getting it to work. I disabled the radius plug-in by commenting out the radius line in /etc/ppp/pptpd.options and I was able to login okay, so I suspect my problem is in radius. I don't know enough to know what in the freeradius -X output below might indicate a problem. If someone sees a problem, please let me know or where to look for more help. I am using mschap-v2. "freeradius -X" output ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:56867, id=190, length=69 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "kwallace" Calling-Station-Id = "192.168.8.103" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "kwallace", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry kwallace at line 2 modcall[authorize]: module "files" returns ok for request 2 rlm_pap: No clear-text password in the request. Not performing PAP. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 190 to 127.0.0.1 port 56867 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 190 with timestamp 48bf213b Nothing to do. Sleeping until we see a request.

2 3

eDirectory + peap + LDAP + Cisco AP1242 + Windows XP(SP3)
by Bruce_M_Richardson＠biscuits.com 04 Sep '08

04 Sep '08

Hi, having read scores of posts to this and other lists I am almost there, many of you have helped already without knowing it. I'm using FreeRADIUS Version 2.0.5, compiled with the eDir extension. I can get it to work if I un-tick the box on XP that says "Automatically use my Windows login name and password (if any)" but if I tick that box then my PC sends the user name as host\name Obviously I need to use "Stripped-User-Name" and apparently this gets filled in by the realms module. But I can't see what to change so that the Stripped-User-Name gets filled in correctly. Any ideas would be appreciated. Regards, Bruce Richardson Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

4 9

Re: Date and Time based authorization ???
by Marcelo Freitas 04 Sep '08

04 Sep '08

Thanks Kirk for the response ... I was asking because I didn't know about Login-Time and that solves my problem ... But I didn't understanding your solution ... Checking for holidays would be nice ... but how would I implement that ? how would this script be called at the arrival of the request's packet ? Thanks again, ----- Original Message ----- From: kwallace(a)wallacecompany.com Sent: Thu, September 4, 2008 2:04 Subject:Re: Date and Time based authorization ??? On Wed, 2008-09-03 at 23:47 -0500, Marcelo Freitas wrote: > Hello, > > I'm researching to switch my WISP authentication to a RADIUS style ... > > I was reading the docs and found a solution for almost all my > requirements ... besides one ... > I have an access plan that is based on nights and weekends ... So on > this plan I would just authorize based on this criteria ... I know > that some variables comes with the request, like, date and time of the > request (or I could even use the server's date and time) but I'd like > to know if it's possible to check if it's a weekend with a function or > something ... > > I couldn't find it in the docs ... > > Thanks in advance, > > > Marcelo > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hello, I'm new to this list, but would the date command help? Maybe from a script, "date +%A" and then check for a return of "Saturday" or "Sunday"? Are you going to need to check for holidays? Kirk ----- End of original message -----

3 2

No authenticate method (Auth-Type) configuration found for the request :(
by Jim Hillier 04 Sep '08

04 Sep '08

I would love some help getting freeradius to authenticate from my windows 2003 server. I am running freeradius Version 2.0.5 on a VMware instance with CentOS 5.1. I get the following error "No authenticate method (Auth-Type) configuration found for the request" when trying to authenticate a Cisco 7200 router with freeradius and active directory. I followed the instructions from: http://deployingradius.com/documents/configuration/active_directory.html after looking at http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO (it seems out dated). I have SAMBA all set up and can authenticate using "ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password". I have modules/mschap configured with: with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" I have radiusd.conf (modules) configured with: exec ntlm_auth { wait = no program = "/usr/bin/ ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } sites-enabled/default has ntlm_auth in the authenticate section. In clients I have: client 10.0.0.0/8 { secret = testing shortname = my-network } I assume there is something blatantly obvious I have missed but I have been struggling with this for 2 days and I need to this up and running. I have set the 7200 to use port 1812 and 1813 but freeradius says it is still using 1645, it still seems to want to work though? Hi Here is the debug: [root@RADIUS ~]# radiusd -X FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Sep 3 2008 at 21:25:44 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.0.0.0/8 { require_message_authenticator = no secret = "testing" shortname = "my-network" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm MYDOMAIN..LOCAL { authhost = LOCAL accthost = LOCAL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {....} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.2.0.4 port 1645, id=2, length=63 NAS-IP-Address = 10.2.0.4 NAS-Port = 0 NAS-Port-Type = Async User-Name = "admin" User-Password = "admin" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 2 to 10.2.0.4 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 2 with timestamp +34 Ready to process requests.

2 1

Problems with the authentication of users and certificates TLS
by Martin Silvero 04 Sep '08

04 Sep '08

oh ok! but the user whit i trying to run radiusd is root, why say that? is posible? thanks you!

1 0

(no subject)
by Piero Santi 04 Sep '08

04 Sep '08

1 0

Date and Time based authorization ???
by Marcelo Freitas 04 Sep '08

04 Sep '08

3 2

freeRADIUS not sending accounting responses
by Adrian Cowham 04 Sep '08

04 Sep '08

Hello All, I stumbled onto some unexpected behavior with freeRADIUS and I'm curious if it's a mis-configuration or a defect. The first thing I did was comment out all places where radutmp and sradutmp were being used. I don't use those files so I figured I'd free up some resources by commenting them out. Upon doing so, I noticed that freeRADIUS no longer sent accounting-response packets to my NAS, everything else worked fine. However, when I ran radiusd -X from the command line it sent accounting-responses, everything ran perfectly. When I went back to running radiusd as a service, it no longer sent accounting-responses. To address the issue, I commented out the "unix" line in the accounting module in radiusd.conf. My assumption is that since I commented out the "radwtmp" line in the "unix" section but not the "unix" line in the "accounting" section, radiusd is choking on processing accounting packets because it can't find the radwtmp file. Mis-configuration on my part? Below you'll find my freeRADIUS version, snippet from my radiusd.conf causing the unexpected behavior containing the "unix" and "accounting" sections, and lastly a snippet from the fixed version of radiusd.conf where the "unix" line is commented out. Any insight would be greatly appreciated. Thanks for you time. FreeRADIUS Version ProCurve NAC 800(ac-nac):~ # radiusd -version radiusd: FreeRADIUS Version 1.1.6, for host i686-redhat-linux-gnu, built on Jun 3 2008 at 10:26:23 Copyright (C) 2000-2007 The FreeRADIUS server project. Snippet of problem radiusd.conf Accounting and unix sections of my /etc/raddb/radiusd.conf unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # passwd = /etc/passwd shadow = /etc/shadow group = /etc/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # #radwtmp = ${logdir}/radwtmp } accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. $INCLUDE ${confdir}/hpidm.accounting.conf detail #daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. #radutmp #sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } Snippet from working radiusd.conf accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. $INCLUDE ${confdir}/hpidm.accounting.conf detail #daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. #unix COMMENTED OUT # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. #radutmp #sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip }

2 1

VSA byte issue with Redback attribute
by Thomas LAVIGNE 04 Sep '08

04 Sep '08

Hi all, I have a problem with a FreeRadius server. The guys at the other side says that the reply coming from my server is not correct. Have somebody any idea how to solve this : Maybe I have added the Redback subscriber attribute at the wrong place in the redback dictionary ? I checked the 'Access-Accept' packet coming from the Radius server. The byte that identifies the 'subscriber-profile-name' VSA is incorrect. Jul 8 16:29:32: [0014]: [4/3:1:63/2/2/66258]: %AAA-7-RAD_PKT: aaa_idx 10c3bdca: Received packet (55 bytes) from xx.xx.xx.xx/1812 (f111111@XXXX <mailto:1@x>): 0 02 43 00 37 57 50 fe a1 5a 29 0c 10 c0 34 83 1f 16 e7 cb 53 b8 1a 11 00 00 09 30 *98* 0b 66 6f 72 74 32 65 70 6c 75 73 06 06 00 00 00 02 07 06 00 00 00 48 01 08 06 ff ff ff fe It's sending back 'forteplus', however, the VSA byte (98) is incorrect. It should be '5b' (decimal 91). 66 6f 72 74 65 70 6c 75 73 f o r t e p l u s Have them correct the Radius server. Thank you for your help. Thomas

3 4