September 2013 - Freeradius-Users - lists.freeradius.org

EAP-AKA, EAP-AKA'
by Arran Cudbard-Bell 25 Sep '13

25 Sep '13

Just out of interest is anyone using EAP-AKA with the EAP2 module in FreeRADIUS 2.x.x? If so what sorts of services are you using for? Have any telcos successfully deployed EAP-SIM/EAP-AKA['] for authenticating handsets to GSM and 802.11 networks to facilitate cross medium roaming? -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

Proxy auth should supersede local auth
by JB 25 Sep '13

25 Sep '13

Hi! Our setup utilizes custom SQL schemas and functions for authentication and authorization. We now want to add a roaming proxy for a certain realm. When a user logs in using this realm, our custom SQL authorization should be skipped because our functions and the roaming proxy are completely different use cases. Our site now looks something like this: authorize { preprocess suffix if (Realm == "NULL") { custom-sql files } } At first glance, this seems to work but I wanted to know if there's a better or more common way to achieve this. Or is this completely stupid after all? (Why?) Thanks! JB

2 2

pap always returns noop for windows dialup authentication
by paul trader 24 Sep '13

24 Sep '13

hi all - i've recently tried upgrading from v1 to v2. on a centos 6.4 box w/ all latest updates, i installed freeradius v2, added one username and password to /etc/raddb/users: test Cleartext-Password := "testing" and the radtest command-line authentication works. i then added one client for our blade server to /etc/raddb/clients.conf: client x.x.x.x { secret = xxxxx shortname = 3coms } substituting the correct ip and secret for the x's. testing from my linux box w/ a modem, authentication works. output from radiusd -X shows all is well, my linux box receives an ip address and dns servers. relavant -X debug output shows: ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok however, when trying to authenticate from a windows box, authentication fails. every time. i've tried it from a windows xp machine and 2 windows 7 machines. the debug output always says: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject i've been over and over everything a dozen times, have tried changing the windows dialup security settings to use pap only, and also have tried adding the following line to the users file: Auth-Type = PAP even though everything i've read said not to do that. still doesn't work. the only changes i've made to the default installation are to the users and clients.conf files. i have spent hours searching the internet for a similar problem/solution and come up empty. windows boxes will not authenticate, pap always returns noop, and the user is rejected. am i doing something glaringly wrong, or just going plain crazy? regards, paul

4 12

Re: Active Directory authentication question
by Alan Buxey 24 Sep '13

24 Sep '13

Or ask your distribution provider why they still provide wpa_supplicant package without eapol_test tool ;) alan

1 0

message freeradius
by María Teresa Mondragón Reyes 24 Sep '13

24 Sep '13

Hi everybody I need some help I'm new in this topic and I'm traying to configure a freeradius serve. I followed the instructions to configure freeradius plus remote mysql server and when put in debug mode freeradius -f -X i get this message. rad_recv: Accounting-Request packet from host 192.168.4.224 port 32769, id=157, length=285 Invalid packet code 4 sent to a proxy port from home server 192.168.4.224 port 32769 - ID 157 : IGNORED Ready to process requests. Im getting the connection, there is no problem, my user is reaching a ip from the private network 192.168.6.xxx and can access to internet. My freeradius server is in the same machine that shorewall, DNS and gateway... my shorewall rules . . . ACCEPT loc $FW:192.168.4.254 udp 1812,1814,18120 . . . Thanks in advanced tere mondragón

3 2

EAP-TLS Authentication
by arvind132 . 24 Sep '13

24 Sep '13

Hi, I am facing some issues with 802.1x EAP-TLS Authentication. Please suggest any document which can help in better understanding on TLS Authentication. Thanks.

2 1

Re: Freeradius-Users Digest, Vol 101, Issue 52
by Rui Ribeiro 23 Sep '13

23 Sep '13

After some version of windows (which I don't really know because I don't use it), by default what is sent is the name of the machine. You have to configure it on purpose to send the username, under 802.1X auth tab, changing machine name by default to user name. Regards ----------------------------- Message: 2 Date: Mon, 23 Sep 2013 14:14:26 -0400 (EDT) From: paul trader <fliptop(a)igolinux.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius-Users Digest, Vol 101, Issue 50 Message-ID: <alpine.DEB.2.02.1309231409260.7633(a)soundgarden.localdomain.local> Content-Type: text/plain; charset="windows-1252" On Mon, 23 Sep 2013 at 18:49, Rui Ribeiro opined: RR:Your not crazy for sure. The problem authenticating with Windows boxen RR:is that they only support MSCHAPv2? kudos to Microsoft. hi rui - thanks for that, although my family and co workers may disagree! according to this wiki faq entry: http://wiki.freeradius.org/guide/faq#How-do-I-make-Windows-XP-clients-use-o… it's possible to force ms to use pap. somehow, though, after reading another reply to my post, i'm getting the feeling ms clients are munging something in the username because it's not being found in the users file. regards, paul On 23 September 2013 21:23, <freeradius-users-request(a)lists.freeradius.org>wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: pap always returns noop for windows dialup authentication > (paul trader) > 2. Re: Freeradius-Users Digest, Vol 101, Issue 50 (paul trader) > 3. Re: pap always returns noop for windows dialup authentication > (Alan DeKok) > 4. Re: pap always returns noop for windows dialup authentication > (John Dennis) > 5. Re: EAP + SSL + Certificate chains (Trevor Jennings) > 6. Re: pap always returns noop for windows dialup authentication > (paul trader) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 23 Sep 2013 14:07:21 -0400 (EDT) > From: paul trader <fliptop(a)igolinux.com> > To: John Dennis <jdennis(a)redhat.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: pap always returns noop for windows dialup authentication > Message-ID: > <alpine.DEB.2.02.1309231357120.7633(a)soundgarden.localdomain.local> > Content-Type: TEXT/PLAIN; charset=US-ASCII > > On Mon, 23 Sep 2013 at 13:31, John Dennis opined: > > JD:You still haven't sent the full debug. > > hi john - thanks for your reply. i sent the output from running radiusd > -X, are you saying i need to run -Xxx and send that instead? > > or are you looking for the startup output as well? i only included the > output for the particular requests. > > JD:Also, you said you were moving from v1 to v2, you can't just copy v1 > JD:configs over, they're different, hope you weren't doing that. > > i used a default v2 install and only changed the users and clients.conf > files. everything else was left alone. > > regards, paul > > > ------------------------------ > > Message: 2 > Date: Mon, 23 Sep 2013 14:14:26 -0400 (EDT) > From: paul trader <fliptop(a)igolinux.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius-Users Digest, Vol 101, Issue 50 > Message-ID: > <alpine.DEB.2.02.1309231409260.7633(a)soundgarden.localdomain.local> > Content-Type: text/plain; charset="windows-1252" > > On Mon, 23 Sep 2013 at 18:49, Rui Ribeiro opined: > > RR:Your not crazy for sure. The problem authenticating with Windows boxen > RR:is that they only support MSCHAPv2? kudos to Microsoft. > > hi rui - thanks for that, although my family and co workers may disagree! > > according to this wiki faq entry: > > > http://wiki.freeradius.org/guide/faq#How-do-I-make-Windows-XP-clients-use-o… > > it's possible to force ms to use pap. somehow, though, after reading > another reply to my post, i'm getting the feeling ms clients are munging > something in the username because it's not being found in the users file. > > regards, paul > > ------------------------------ > > Message: 3 > Date: Mon, 23 Sep 2013 14:21:22 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: pap always returns noop for windows dialup authentication > Message-ID: <524086A2.9030708(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > paul trader wrote: > > i used a default v2 install and only changed the users and clients.conf > > files. everything else was left alone. > > Well, there's no magic. If the "users" file entry doesn't match, it's > because the User-Name isn't "test". > > Alan DeKok. > > > ------------------------------ > > Message: 4 > Date: Mon, 23 Sep 2013 14:42:35 -0400 > From: John Dennis <jdennis(a)redhat.com> > To: paul trader <fliptop(a)igolinux.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: pap always returns noop for windows dialup authentication > Message-ID: <52408B9B.2060701(a)redhat.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 09/23/2013 02:07 PM, paul trader wrote: > > On Mon, 23 Sep 2013 at 13:31, John Dennis opined: > > > > JD:You still haven't sent the full debug. > > > > hi john - thanks for your reply. i sent the output from running radiusd > > -X, are you saying i need to run -Xxx and send that instead? > > No. It means all the output from radiusd -X. Yes, that might seem like a > lot but it contains useful information. But before you do send it to > this list see below. > > > > or are you looking for the startup output as well? i only included the > > output for the particular requests. > > That's not the full debug is it? :-) > > > > > JD:Also, you said you were moving from v1 to v2, you can't just copy v1 > > JD:configs over, they're different, hope you weren't doing that. > > > > i used a default v2 install and only changed the users and clients.conf > > files. everything else was left alone. > > You have all the information you need to debug your problem. It does > require reading the debug output carefully. But you should really try to > do that yourself first. As a said earlier, verify you're reading the > exact same users file in both cases (the debug output will tell you what > files are being read), If they are then look at your users file and > determine why the user name is not matching, there is nothing magic > about it, it should be straight forward. Still stumped? Then come back > to the list for help. > > > -- > John > > > ------------------------------ > > Message: 5 > Date: Mon, 23 Sep 2013 16:18:55 -0400 > From: Trevor Jennings <Trevor(a)simple101.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP + SSL + Certificate chains > Message-ID: > < > CAHNBdEJUdmUCQG+uW+dfXUDnDdYKuvCdQnstWwsjusiM3+afjQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hey I wanted to say thanks for the tips! I convinced the peers that it was > not a good idea to allow auto certificate acceptance and to just have the > clients accept it when the new certificate went online. > > Cheers, > > - Trevor > > > > On Thu, Sep 12, 2013 at 3:46 PM, Brian Julin <BJulin(a)clarku.edu> wrote: > > > > Mathieu wrote: > > > At least from that side there is hope for improvements with Android 4.3 > > > onwards there > > > are API calls for enterprise wireless configuration. > > > > > > Maybe "someone" steps up by making an application that can manage > > > profiles or something like this. > > > > That is promising, but I hope this does not become a case of > > "Oh, there's an app for that basic system function" versus it being in > the > > core UI. Because nobody will have it pre-installed. > > > > -- > > Brian > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > >

1 0

Re: Freeradius-Users Digest, Vol 101, Issue 50
by Rui Ribeiro 23 Sep '13

23 Sep '13

------------------------------ Message: 5 Date: Mon, 23 Sep 2013 12:33:10 -0400 (EDT) From: paul trader <fliptop(a)igolinux.com> To: freeradius-users(a)lists.freeradius.org Subject: pap always returns noop for windows dialup authentication Message-ID: <alpine.DEB.2.02.1309231213040.7006(a)soundgarden.localdomain.local> Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII hi all - i've recently tried upgrading from v1 to v2. on a centos 6.4 box w/ all latest updates, i installed freeradius v2, added one username and password to /etc/raddb/users: test Cleartext-Password := "testing" and the radtest command-line authentication works. i then added one client for our blade server to /etc/raddb/clients.conf: client x.x.x.x { secret = xxxxx shortname = 3coms } substituting the correct ip and secret for the x's. testing from my linux box w/ a modem, authentication works. output from radiusd -X shows all is well, my linux box receives an ip address and dns servers. relavant -X debug output shows: ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok however, when trying to authenticate from a windows box, authentication fails. every time. i've tried it from a windows xp machine and 2 windows 7 machines. the debug output always says: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject i've been over and over everything a dozen times, have tried changing the windows dialup security settings to use pap only, and also have tried adding the following line to the users file: Auth-Type = PAP even though everything i've read said not to do that. still doesn't work. the only changes i've made to the default installation are to the users and clients.conf files. i have spent hours searching the internet for a similar problem/solution and come up empty. windows boxes will not authenticate, pap always returns noop, and the user is rejected. am i doing something glaringly wrong, or just going plain crazy? regards, paul ------------------------------ Hi Paul, Your not crazy for sure. The problem authenticating with Windows boxen is that they only support MSCHAPv2… kudos to Microsoft. Regards, Rui On 23 September 2013 18:17, <freeradius-users-request(a)lists.freeradius.org>wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports (Alan DeKok) > 2. FreeRadius Error " Access Rejected" Only On Some CISCO Switch > Ports (Daniel Baker) > 3. Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports (Daniel Baker) > 4. EAP-TLS Authentication (arvind132 .) > 5. pap always returns noop for windows dialup authentication > (paul trader) > 6. Re: pap always returns noop for windows dialup authentication > (Phil Mayers) > 7. Re: pap always returns noop for windows dialup authentication > (paul trader) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 23 Sep 2013 09:18:28 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports > Message-ID: <52403FA4.5090808(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Daniel Baker wrote: > > [ldap] performing search in dc=citlao,dc=local, with filter (uid=root) > > [ldap] object not found > > [ldap] search failed > > What part of that is unclear? > > > What can I try to fix the authentication issues so that all ports are > being successfully authenticated ? > > Ensure that the people logging in have accounts in ldap. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Mon, 23 Sep 2013 20:39:44 +0700 > From: Daniel Baker <info(a)collisiondetection.biz> > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius Error " Access Rejected" Only On Some CISCO Switch > Ports > Message-ID: <524044A0.8000800(a)collisiondetection.biz> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > Hi Guys, we are trying to get Free Radius to authenticate our users who > connect through a Cisco Small Business POE switch. > > > When testing authentication with a shutdown / no shutdown command on > port fa/17 which has an IP phone connected to it we receive the > following errors: > > FREE RADIUS : > > [ldap] expand: %{User-Name} -> root > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=root) > [ldap] expand: dc=citlao,dc=local -> dc=citlao,dc=local > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in dc=citlao,dc=local, with filter (uid=root) > [ldap] object not found > [ldap] search failed > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns notfound > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > ERROR: No authenticate method (Auth-Type) found for the request: > Rejecting the user > Failed to authenticate the user. > Login incorrect ( [ldap] User not found): [root/trash] (from client > LTC-ROUTER port 2) > Using Post-Auth-Type Reject > # Executing group from file /etc/freeradius/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> root > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 12 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 12 > Sending Access-Reject of id 31 to 192.168.1.1 port 1645 > Waking up in 4.9 seconds. > Cleaning up request 12 ID 31 with timestamp +10922 > Ready to process requests. > > CISCO POE SWITCH: > > > SW-BN3-PoE(config-if)#shutdown > SW-BN3-PoE(config-if)#23-Sep-2013 14:17:22 %LINK-W-Down: fa17 > > SW-BN3-PoE(config-if)# > SW-BN3-PoE(config-if)#no shutdown > SW-BN3-PoE(config-if)#23-Sep-2013 14:17:42 %STP-W-PORTSTATUS: fa17: STP > status Forwarding > 23-Sep-2013 14:17:42 %LINK-I-Up: fa17 > 23-Sep-2013 14:17:43 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC > 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or > password in Radius server > 23-Sep-2013 14:18:07 %LINK-W-Down: fa17, aggregated (3) > 23-Sep-2013 14:18:09 %STP-W-PORTSTATUS: fa17: STP status Forwarding, > aggregated (3) > 23-Sep-2013 14:18:09 %LINK-I-Up: fa17, aggregated (3) > 23-Sep-2013 14:18:18 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC > 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or > password in Radius server, aggregated (1) > > > > > However when we try the same test on a port that has a PC connected to > it we do not receive such an error. > > The CISCO switch says that we have the wrong user name and the Free > Radius log says access rejected. Why would this only be the case when > a CISCO IP phone tries to authenticate? > > The Cisco switch port configurations are exactly the same and are as > follows : > > dot1x max-req 1 > dot1x reauthentication > dot1x timeout quiet-period 30 > dot1x mac-authentication mac-only > dot1x port-control auto > storm-control broadcast enable > storm-control broadcast level 10 > storm-control include-multicast > spanning-tree portfast > macro description "no_ip_phone_desktop | ip_phone_desktop" > switchport trunk allowed vlan add 100 > macro auto smartport type ip_phone_desktop > > What can I try to fix the authentication issues so that all ports are > being successfully authenticated ? > > > Thanks for your assistance, > > Dan > > > > > > > > > > > > > > > > ------------------------------ > > Message: 3 > Date: Mon, 23 Sep 2013 21:01:49 +0700 > From: Daniel Baker <info(a)collisiondetection.biz> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports > Message-ID: <524049CD.6030303(a)collisiondetection.biz> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Thank you Alan I will pursue that line of inquiry further. > > > On 9/23/2013 8:18 PM, Alan DeKok wrote: > > Daniel Baker wrote: > >> [ldap] performing search in dc=citlao,dc=local, with filter > (uid=root) > >> [ldap] object not found > >> [ldap] search failed > > What part of that is unclear? > > > >> What can I try to fix the authentication issues so that all ports are > being successfully authenticated ? > > Ensure that the people logging in have accounts in ldap. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > Message: 4 > Date: Mon, 23 Sep 2013 20:15:14 +0530 > From: "arvind132 ." <arvindnb1(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: EAP-TLS Authentication > Message-ID: > <CABNrktRU1J02n-yAmcpYj8rxq5Sg79NtUf= > syrYXnj06ANk3UQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > I am facing some issues with 802.1x EAP-TLS Authentication. > Please suggest any document which can help in better understanding on TLS > Authentication. > Thanks. >

2 1

FreeRadius Error " Access Rejected" Only On Some CISCO Switch Ports
by Daniel Baker 23 Sep '13

23 Sep '13

Hi Guys, we are trying to get Free Radius to authenticate our users who connect through a Cisco Small Business POE switch. When testing authentication with a shutdown / no shutdown command on port fa/17 which has an IP phone connected to it we receive the following errors: FREE RADIUS : [ldap] expand: %{User-Name} -> root [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=root) [ldap] expand: dc=citlao,dc=local -> dc=citlao,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=citlao,dc=local, with filter (uid=root) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect ( [ldap] User not found): [root/trash] (from client LTC-ROUTER port 2) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> root attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 12 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 12 Sending Access-Reject of id 31 to 192.168.1.1 port 1645 Waking up in 4.9 seconds. Cleaning up request 12 ID 31 with timestamp +10922 Ready to process requests. CISCO POE SWITCH: SW-BN3-PoE(config-if)#shutdown SW-BN3-PoE(config-if)#23-Sep-2013 14:17:22 %LINK-W-Down: fa17 SW-BN3-PoE(config-if)# SW-BN3-PoE(config-if)#no shutdown SW-BN3-PoE(config-if)#23-Sep-2013 14:17:42 %STP-W-PORTSTATUS: fa17: STP status Forwarding 23-Sep-2013 14:17:42 %LINK-I-Up: fa17 23-Sep-2013 14:17:43 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or password in Radius server 23-Sep-2013 14:18:07 %LINK-W-Down: fa17, aggregated (3) 23-Sep-2013 14:18:09 %STP-W-PORTSTATUS: fa17: STP status Forwarding, aggregated (3) 23-Sep-2013 14:18:09 %LINK-I-Up: fa17, aggregated (3) 23-Sep-2013 14:18:18 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or password in Radius server, aggregated (1) However when we try the same test on a port that has a PC connected to it we do not receive such an error. The CISCO switch says that we have the wrong user name and the Free Radius log says access rejected. Why would this only be the case when a CISCO IP phone tries to authenticate? The Cisco switch port configurations are exactly the same and are as follows : dot1x max-req 1 dot1x reauthentication dot1x timeout quiet-period 30 dot1x mac-authentication mac-only dot1x port-control auto storm-control broadcast enable storm-control broadcast level 10 storm-control include-multicast spanning-tree portfast macro description "no_ip_phone_desktop | ip_phone_desktop" switchport trunk allowed vlan add 100 macro auto smartport type ip_phone_desktop What can I try to fix the authentication issues so that all ports are being successfully authenticated ? Thanks for your assistance, Dan

2 3

Authentication
by Free-Radius 23 Sep '13

23 Sep '13

Dear, I wonder if the Freeradius to authenticate a client by IP number, without using login and password, only the IP. If possible, how to do? thank you ----------------------------------------------------------- Marcelo

4 3