May 2009 - Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 49, Issue 89
by Ivan Kalik 20 May '09

20 May '09

> The problem is the following: > > The customers ask me if possible send them the packets from an > interface defined. What does that mean? IP of the original NAS packet? That's in internal attribute Packet-Src-IP-Address. > My Radius proxy listen on an IP address (i.e. 192.168.1.3) for > authentication packet and forwarding them towards two different networks > (i.e. 192.168.14.4(Customer1) and 192.168.24.4(Customer2)) Ivan Kalik Kalik Informatika ISP

1 0

(no subject)
by Mauro Iorio - Smart Soft s.r.l. 20 May '09

20 May '09

Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

1 0

Common error on sql_counter on Ver 2.1.5
by Mauro Iorio - Smart Soft s.r.l. 20 May '09

20 May '09

Hi all, I recently installed freeradius Ver. 2.1.5 and I'm trying to configure it to work as a previous installation of Ver. 1.1.x. I'm stuck at sql counter module. On 1.1.x I use the common sessioncounter counter with sql module, but with 2.1.5 I got the message "rlm_sqlcounter: Could not find Check item value pair". I believe the configurations are indentical for both versions of freeradius, but I'm obviously missing something. Can someone help me to find where can be the error? I think it's a trivial one, but I'm stuck since 3 days. Thank You for interest. Mauro Iorio

3 8

RE: Freeradius-Users Digest, Vol 49, Issue 89
by Marco De Magistris 20 May '09

20 May '09

Hi Ivan, > 4. RE: Freeradius-Users Digest, Vol 49, Issue 87 (Ivan Kalik) >And how will you know to which ISP does the user belong to? Normally they >enter names like user@ISP1 and user@ISP2. That way you know to which home >server to proxy to. The ISP is identified using @ISP1 in User-Name attribute. The problem is the following: The customers ask me if possible send them the packets from an interface defined. My Radius proxy listen on an IP address (i.e. 192.168.1.3) for authentication packet and forwarding them towards two different networks (i.e. 192.168.14.4(Customer1) and 192.168.24.4(Customer2)) Thanks Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 12.00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 89 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Dynamic clients and NAS-Identifier (Alan DeKok) 2. Re: question about windows users (Ivan Kalik) 3. Re: Is it possible to share bandwidth or maximum downloaded bytes (Ivan Kalik) 4. RE: Freeradius-Users Digest, Vol 49, Issue 87 (Ivan Kalik) 5. Freeradius LDAP weird login issue (cktan) 6. RE: Dynamic clients and NAS-Identifier (Santiago Balaguer Garc?a) 7. Re: Dynamic clients and NAS-Identifier (Ivan Kalik) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 11:04:52 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Dynamic clients and NAS-Identifier To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A13C7B4.2070803(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Johan Meiring wrote: > I realise, i've asked for the before, and it is on your todo list, but > I'd like to make a case again for maybe getting it moved up higher onto > the list. My "to do" list right now is: - consulting work (my *only* source of income is FreeRADIUS) - 3 IETF documents that I'm author / co-author - White paper for a linux conference > The current "clients" structure identify the NAS's by ip address. > While this is perfect for corporate environments, it is not so perfect > for the hotspot environment in which we operate. RADIUS was never designed to work that way. It's insecure. One of the documents I'm writing involves leveraging SSL to allow that capability. But implementations are a long ways out. > We need to somehow authenticate the nas, so someone can not send "rough" > accounting info to radius. You could always write a simple RADIUS proxy that did those checks. It likely could be done in ~200-300 lines of Perl. > I'm sure that I'm not the only one that have NAS's behind dynamic IPs, > and this would make radius traffic from such NAS's much more secure. Maybe... Alan DeKok. ------------------------------ Message: 2 Date: Wed, 20 May 2009 10:38:45 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: question about windows users To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <30072.194.176.105.43.1242812325.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > could you give me good freeradius guide for dummies - I think I need it :) > Guide: don't make any changes to the default configuration unless you know what you are doing. That's it. Server is configured by default to handle EAP-TLS. There is nothing that you need to do to make it happen. Now, about your problem: freeradius uses fake realm example.com - for examples. Of proxying, fail-over home servers, use of vitual servers etc. Why are *you* using it as well? These examples are not what you want to do. Use your own domain. For EAP-TLS - no modification needed. I have seen you going on about PEAP as well. If those users are also using format user@your_domain, then create local realm your_domain - it won't interfere with EAP-TLS and will create Stripped-User-Name that can be used for authentication. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Wed, 20 May 2009 10:43:21 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Is it possible to share bandwidth or maximum downloaded bytes To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <10246.194.176.105.43.1242812601.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > I have 3 users and I want to give them 1Mbps/256Kbps bandwidth. They must > not have this bandwidth individually but must share it. Is it possible to > do > with freeRADIUS. If so can you help me on what I have to do. No, radius can't do that. But you can fix their IPs or make them a small pool and then limit that IP range as a bundle on your router. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Wed, 20 May 2009 10:47:08 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Freeradius-Users Digest, Vol 49, Issue 87 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <47671.194.176.105.43.1242812828.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Hi Alan, > > > >> 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > >> to 192.168.1.3) > >> 2. Radius proxy listen on 192.168.1.3 for authentication packet and > >> forwarding them towards two different network (192.168.14.4 and > >> 192.168.24.4) > > > > 192.168.14.4 and 192.168.24.4 are 2 different Radius Servers. > > 192.168.14.4: Radius Server for IPS 1. > > 192.168.24.4: Radius Server for IPS 2. > > > > I need send the packets towards ISP1 using VLAN1 and towards ISP2 using > VLAN2. > And how will you know to which ISP does the user belong to? Normally they enter names like user@ISP1 and user@ISP2. That way you know to which home server to proxy to. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 5 Date: Wed, 20 May 2009 17:48:52 +0800 From: cktan <cktan(a)ocesb.com.my> Subject: Freeradius LDAP weird login issue To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A13D204.1080706(a)ocesb.com.my> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Hi all, I'm using freeradius+LDAP for the PPPoE dialup access control for a while. Lately I noticed there is weird issue whereby an user login with username as "user=5C=5C=5C=5Cuser@domain" and surprisingly freeradius allow it to login although the actual username should be "user@domain". I've run radius in -X mode and capture the log for your reference as below. In radiusd -X, we noticed server received Access-Request with username "user=5C=5C=5C=5Cuser@domain" but when reach to radius_xlat, the uid will become "user" only and when it query my LDAP the account for "user" is available and it will accept the access request. The question is why "user=5C=5C=5C=5Cuser" = "user"? We try the username with xC (i.e. 1C, 2C, 3C and so on...) and all are able to login because radius will take as user@domain. After login, the username in radacct will become "user=5C=5C=5C=5Cuser@domain" instead of "user@domain". As the consequence, the smart user may have multiple logins (by using user=1C/2C/3C....) and the records in radacct is different and therefore we will out of control for multiple login with single account. Any idea to fix this? rad_recv: Access-Request packet from host 127.0.0.1:32877, id=87, length=93 User-Name = *"user=5C=5C=5C=5Cuser@domain"* User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rlm_ldap: performing user authorization for *user=5c=5c=5c=5cuser* radius_xlat: * '(uid=user)'* Regards -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Dynamic clients and NAS-Identifier
by Johan Meiring 20 May '09

20 May '09

Hi Alan, I realise, i've asked for the before, and it is on your todo list, but I'd like to make a case again for maybe getting it moved up higher onto the list. The current "clients" structure identify the NAS's by ip address. While this is perfect for corporate environments, it is not so perfect for the hotspot environment in which we operate. We have a central radius server for many different hotspot owners. Hotspots are running chillispot. We need to somehow authenticate the nas, so someone can not send "rough" accounting info to radius. The only way to currently identify a NAS is by IP address. You can then lookup the NAS, and create a "radius secret" based on the IP address. This is done using the dynamic_clients virtual server. The problem is that the hotspots can be anywhere. They are mostly behind ADSL lines. The source ip address of the radius packet is therefore not predictable. The only other way I can thing of is identifying the nas by the NAS-Identifier. To sum up. Currently a nas is "authenticated" by ip address/radius secret. I feel that being able to "authenticate" a nas by nas identifier/radius secret is a very good enhancement. I'm sure that I'm not the only one that have NAS's behind dynamic IPs, and this would make radius traffic from such NAS's much more secure. I'm prepared to do it myself, but by c skills really suck. I can only do "copy and paste" type editing. I've spent a few hours looking at the code, and it seems that (in listen.c) you need to create the "value pairs" somehow before sending the packet to module_authorize, but I have no clue how to even attempt this. I'm fully prepared to try and contribute somehow, but this is way out of my league. Anyway, end of long story. I simply hope to get this maybe moved a bit higher up on the todo list. Thanks!!! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

4 4

RE: Freeradius-Users Digest, Vol 49, Issue 87
by Ivan Kalik 20 May '09

20 May '09

> Hi Alan, > > > >> 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > >> to 192.168.1.3) > >> 2. Radius proxy listen on 192.168.1.3 for authentication packet and > >> forwarding them towards two different network (192.168.14.4 and > >> 192.168.24.4) > > > > 192.168.14.4 and 192.168.24.4 are 2 different Radius Servers. > > 192.168.14.4: Radius Server for IPS 1. > > 192.168.24.4: Radius Server for IPS 2. > > > > I need send the packets towards ISP1 using VLAN1 and towards ISP2 using > VLAN2. > And how will you know to which ISP does the user belong to? Normally they enter names like user@ISP1 and user@ISP2. That way you know to which home server to proxy to. Ivan Kalik Kalik Informatika ISP

1 0

Is it possible to share bandwidth or maximum downloaded bytes
by ngwarai zed 20 May '09

20 May '09

I have 3 users and I want to give them 1Mbps/256Kbps bandwidth. They must not have this bandwidth individually but must share it. Is it possible to do with freeRADIUS. If so can you help me on what I have to do. Ngwarai

2 1

RE: Freeradius-Users Digest, Vol 49, Issue 87
by Marco De Magistris 20 May '09

20 May '09

Hi Alan, > 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > to 192.168.1.3) > 2. Radius proxy listen on 192.168.1.3 for authentication packet and > forwarding them towards two different network (192.168.14.4 and > 192.168.24.4) 192.168.14.4 and 192.168.24.4 are 2 different Radius Servers. 192.168.14.4: Radius Server for IPS 1. 192.168.24.4: Radius Server for IPS 2. I need send the packets towards ISP1 using VLAN1 and towards ISP2 using VLAN2. Configured FreeRadius with UDPFROMTO enable. In radius.c source file we notice the following rows : #ifdef WITH_UDPFROMTO /* * Only IPv4 is supported for udpfromto. * * And if they don't specify a source IP address, don't * use udpfromto. */ if ((dst_ipaddr->af == AF_INET) || (src_ipaddr->af != AF_UNSPEC)) { return sendfromto(sockfd, data, data_len, flags, (struct sockaddr *)&src, sizeof_src, (struct sockaddr *)&dst, sizeof_dst); } #else src_ipaddr = src_ipaddr; /* -Wunused */ #endif Can you help me? Thanks Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 10.02 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 87 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: help me: proxing towards 2 different networks (Alan DeKok) 2. Re: Freeradius 2.1.1 and SQLite database (Peter Lambrechtsen) 3. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (John Dennis) 4. Re: question about windows users (Bartosz Chodzinski) 5. Re: question about windows users (Alan DeKok) 6. Re: question about windows users (Bartosz Chodzinski) 7. Re: question about windows users (A.L.M.Buxey(a)lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Tue, 19 May 2009 20:16:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: help me: proxing towards 2 different networks To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A12F783.5080508(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Marco De Magistris wrote: > 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > to 192.168.1.3) > 2. Radius proxy listen on 192.168.1.3 for authentication packet and > forwarding them towards two different network (192.168.14.4 and > 192.168.24.4) > > Can I configure this scenario using FreeRadius? No. RADIUS doesn't work like that. Why do you want to do this? Alan DeKok. ------------------------------ Message: 2 Date: Wed, 20 May 2009 06:42:29 +1200 From: Peter Lambrechtsen <plambrechtsen(a)gmail.com> Subject: Re: Freeradius 2.1.1 and SQLite database To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <BBCD777E-E215-416D-B199-07C9C87D22BD(a)gmail.com> Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes On 20/05/2009, at 12:00 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > Peter Lambrechtsen wrote: >> Has anyone done any work with FreeRadius 2.1.1 or higher and SQLite >> as >> the backend db. > > Nope. > >> Would love to have it working with sqlite as that is the smallest DB >> footprint of all the supported databases for Free Radius. > > Write the code... submit it back. Will do > > >> Has anyone done work with the sqlite db and give me some pointers on >> the database setup for sqlite, looks like I need to create a file >> called "sqlite_radius_client_database" but not sure what the >> structure >> should be... And google isn't helping much either. > > Apple uses it for their OS X Server system. The clients go into > SQLite, so that their administration system doesn't have to deal with > MySQL, PostgreSQL, or flat-text files. > > The schema is just the normal NAS schema, as with the other SQL > drivers. > > To have it use the "radcheck", "radreply", etc. tables, you'll have > to > define the schemas, create the DB, and define the queries. It > *should* > work, so long as you use the hard-coded DB file name. Ok I will have a go and submit my results back to the users/devel lists depending upon how I get along. The final destination is a single wifi router such as asus 500p which has a usb port that can take stick for local storage to host db with captive portal and wpa for either PEAP or tls logon ssids with web admin backend. All with openwrt. Will let you know how I get along with the freeradius component. > > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Tue, 19 May 2009 19:33:58 -0400 From: John Dennis <jdennis(a)redhat.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1341E6.4070500(a)redhat.com> Content-Type: text/plain; charset=us-ascii Fajar A. Nugraha wrote: > On Sun, May 17, 2009 at 11:33 PM, John Dennis <jdennis(a)redhat.com> wrote: >> We expect to provide an official update to RHEL with a 2.x >> version of FreeRADIUS in the next update cycle which would be RHEL 5.5, > > So how do you plan to provide seamless upgrade for RHEL 5 users? > Is freeradius 1.1.3 config compatible with 2.x? Or do we have to do a > clean install? Please note what Alan said about upgrades across major versions requiring manual configuration. Also, the package will have a different name, rather than freeradius it will be named freeradius2, however (and this is critical) it will conflict at the file level, in other words the both freeradius and freeradius2 cannot be simultaneously installed. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ Message: 4 Date: Wed, 20 May 2009 08:56:25 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: Re: question about windows users To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1f06c2db0905192356k68b35d5ck73c9163d8c8ec5d9(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" >Don't strip the username. Why do you proxy this anyway? Create it as a local realm: I am using basic configuration without changes in config cause: >so..somewhere along the line you are playing with the User-Name attribute...something >which you cannot do with EAP - if you take a standard 2.1.6 install and make the basic changes >to your eap.conf and clients.conf it will work. "make the basic changes to your eap.conf and client.conf it will work" it wont. are all of you had so many troubles with radius or only me has so bad luck I tried to make my first config a year ago, only have succes with eap=md5, after month figting with peap I gave up, now I have some communicates on screen, but answers "basic changes" are really not helpful. my realm example.com was: realm example.com { auth_pool = my_auth_failover } when I changed in proxy.conf it to realm example.com { } radius wont start #freeradius -X ... radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm example.com { } realm LOCAL { } realm NULL { } /etc/freeradius/proxy.conf[498]: home_server "localhost" does not exist

1 0

Freeradius 2.1.1 and SQLite database
by Peter Lambrechtsen 19 May '09

19 May '09

Has anyone done any work with FreeRadius 2.1.1 or higher and SQLite as the backend db. Working on a single router solution with OpenWRT with FreeRadius running PEAP and EAP-TLS auth. Would love to have it working with sqlite as that is the smallest DB footprint of all the supported databases for Free Radius. Has anyone done work with the sqlite db and give me some pointers on the database setup for sqlite, looks like I need to create a file called "sqlite_radius_client_database" but not sure what the structure should be... And google isn't helping much either. Any assistance would be great. Many thanks Peter

2 2

help me: proxing towards 2 different networks
by Marco De Magistris 19 May '09

19 May '09

Hi all, Thanks in advance for your help. Here is our Scenario which is working now: 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 to 192.168.1.3) 2. Radius proxy listen on 192.168.1.3 for authentication packet and forwarding them towards two different network (192.168.14.4 and 192.168.24.4) Can I configure this scenario using FreeRadius? The current configuration is: -------------------- First configuration -------------------- Radiusd.conf listen { ipaddr = 192.168.1.2 port = 1812 type = auth interface = eth18 } proxy.conf home_server Server1 { type = auth ipaddr = 192.168.14.4 port = 1812 secret = <SECRET> require_message_authenticator = yes } home_server Server2 { type = auth ipaddr = 192.168.24.4 port = 1812 secret = <SECRET> require_message_authenticator = yes } home_server_pool Serverpool1 { type = fail-over home_server = Server1 } home_server_pool Serverpool2 { type = fail-over home_server = Server2 } realm isp1.com { auth_pool = Serverpool1 } realm isp2.com { auth_pool = Serverpool2 } Results: Expiration of the Timeout -------------------- Second configuration -------------------- Adding in radiusd.conf: listen { ipaddr = 192.168.14.3 port = 1812 type = proxy } Results: The packet is received correctly by Server1, but I can't send any packet towards Server2. -------------------- Latest configuration -------------------- Adding in radiusd.conf: listen { ipaddr = 192.168.14.3 port = 1812 type = proxy } listen { ipaddr = 192.168.24.3 port = 1812 type = proxy } Results: Expiration of the Timeout

2 1