October 2015 - Freeradius-Users - lists.freeradius.org

Authenticated device does not receive and IP, so continuously requests IP allocation
by Sophie Loewenthal 02 Nov '15

02 Nov '15

Hi, For a few weeks some devices have had their IP allocation "lost" en route. They authenticate, and IP is allocated but not received by the device. Afterwards a device continuously asking for an IP address, being allocated, and then asking again. This has happened intermittently with some devices on Vodafone APN. I did not see devices on other APNs affected. Please see the three Radius requests in debug mode at the end of this email in attachments. They are small files of approx 10Kb and were collected with options to radiusd -xxx /etc/raddb/users ( with comments and empty lines stripped but willing to resend if empty lines and # comments are needed ) # grep -v ^# users | grep -v ^$ DEFAULT NAS-IP-Address == 172.200.100.1, Pool-Name := vodafone DEFAULT NAS-IP-Address == 10.19.255.254, Pool-Name := proximus-carli DEFAULT NAS-IP-Address == 10.17.255.254, Pool-Name := proximus-mechelen DEFAULT Framed-IP-Netmask = 255.255.255.255 O/S and packages Centos 6.2 freeradius-mysql-2.1.12-1.el6.x86_64 freeradius-utils-2.1.12-1.el6.x86_64 freeradius-2.1.12-1.el6.x86_64 Example from logs: Thu Oct 29 00:00:15 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 594301 cli 31655418538) Thu Oct 29 00:00:15 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 594301 user 000006156) Thu Oct 29 00:01:12 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 146587 cli 31655418538) Thu Oct 29 00:01:12 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 146587 user 000006156) Thu Oct 29 00:02:39 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 983132 cli 31655418538) Thu Oct 29 00:02:39 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 983132 user 000006156) Thu Oct 29 00:05:01 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 928184 cli 31655418538) Thu Oct 29 00:05:01 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 928184 user 000006156) Thu Oct 29 00:07:33 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 575003 cli 31655418538) Thu Oct 29 00:07:33 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 575003 user 000006156) Thu Oct 29 00:08:27 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 728168 cli 31655418538) Thu Oct 29 00:08:27 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 728168 user 000006156) This happens continuously amounting to 1000s of IP allocations daily. I do not see Info: Released IP entries for this device. ( there were some earlier this month. ) I have tcpdump running with : tcpdump -s0 -ni eth0 port 1812 or port 1813 or port 3799 -vw /tmp/rad.pcap Some questions, - Could my ippool run out of addresses because the device is continuously requesting IP addresses? - Would you offer any improvements on the tcpdump parameters? - How could I check if Radius really sent the packet back to the client? - (wireshark/tcpdump question: Is there an expression I could use to find the radius packet sent back for Info: Allocated IP? e.g I could radius.User_Name == "00000123" in wireshark to find User-Name we used for authentication. Is there any useful info in the attached debugs indicating problems? Like why the device did not receive an IP. If not then I can start looking into networks/vpn and vodafone. Kind regards.

3 5

Add custom ldap attribute to replies
by Angel L. Mateo 02 Nov '15

02 Nov '15

Hello, I have my freeradius connected to an LDAP server. I want now to add the CN attribute of my ldap users' entries to the freeradius reply. So I have: - Created a custom attribute (I haven't found any better, is there any?). This is the definition in the dictionary: ATTRIBUTE X-Atica-CN 3002 string - I have mapped the ldap's cn attribute to this attribute. In my ldap module configuration I have: update { ... reply:X-Atica-CN := 'cn' } - I have changed my authorized file: DEFAULT Auth-Type = LDAP, Realm != DEFAULT User-Name = "%{User-Name}", X-Atica-CN = "%{reply:X-Atica-CN}", Fall-Through = No but when I try with radtest, this custom attribute is not in the reply. In the freeradius debug file I can see that the ldap attribute is read while parsing the authorize file: 0) [ldap] = updated (0) files_aplicaciones: users: Matched entry DEFAULT at line 3 (0) files_aplicaciones: EXPAND %{User-Name} (0) files_aplicaciones: --> <my login> (0) files_aplicaciones: EXPAND %{reply:X-Atica-CN} (0) files_aplicaciones: --> <my cn in the ldap> but the attribute is not returned to radtest. I have also tried to force the inclusion in the post-auth section, with: post-auth { update reply { reply:X-Atica-CN = &reply:X-Atica-CN } ... } and with this, the debug file shows: (0) update reply { (0) reply:X-Atica-CN = &reply:X-Atica-CN -> <my cn in the ldap> (0) } # update reply = noop but it is not shown in the radtest reply. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 3

The users session was previously rejected
by Pretlove, Tim 01 Nov '15

01 Nov '15

Hi, I fairly new at Freeradius and I have been upgrading our version 2 servers to version 3.0.10 and I have what I believe is a configuration issue. The user is correctly rejected by eap/MSCHAP but it continues into eap/PEAP where I get the error Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: The users session was previously rejected: returning reject (again.) Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: This means you need to read the PREVIOUS messages in the debug output Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: to find out the reason why the user was rejected Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: what went wrong, and how to fix the problem How do I avoid dropping into the peap section if the user is rejected further up the chain? I've attached the portion of the debug log that shows this error. Many thanks Tim

5 7

Huntgroup-Name vs client:group
by Óscar Remírez de Ganuza Satrústegui 30 Oct '15

30 Oct '15

Good afternoon, We are migrating previous radius (2.1.9) authentication to a new instance of freeradius (3.0.10). We are moving two different configurations to a single radius. As we are supporting AAA from diferent services, we are using Huntgroup-Name attribute to separate the authorization. if ( Huntgroup-Name == 'Wireless' ) { if ( Ldap-Group == "unav.wireless.1" ) { update reply { ... } } ... } elsif ( Huntgroup-Name == 'Wired' ) { if ( Ldap-Group == "unav.wired.1" ) { ... } .... } We are doing it even on the inner-tunnel; using copy_request_to_tunnel, and with module preprocess on the inner-tunnel. It is working ok. But I have just found a previous suggestion on this list [1] in which it is suggested to check "client:group" instead of huntgroup-name: *"do policy checking via %{client:group} instead of Huntgroup-Name. It will do the same thing, and will be *enormously* faster."* In our particular setting, we have around 7 huntgroups for a total of 20 NAS-Clients. And we receive 20 different Access Requests per second on top moments. In our case, do you think that we are also going to experience a much better performance using client:group instead of huntgroup-name? I had been looking for information on client:group, but I could not find a lot of it. [2] Thank you very much for your help. Regards, [1] http://lists.freeradius.org/pipermail/freeradius-users/2014-February/070431… [2] https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/clients.c… *Oscar Remírez de Ganuza Satrústegui* IT Services Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.edu/web/it/

2 1

question regarding PEAP/MSCHAPv2 (ERROR: FAILED: No NT/LM-Password. Cannot perform authentication)
by Thomas Stather 30 Oct '15

30 Oct '15

Hello I am still failing with my RADIUS setup (eduroam -> PEAP/MSCHAPv2 and authentication against our LDAP server) on 3.0.10 After having sorted out lots of mistakes by myself in the RADIUS config (thanks for you help on the previous post), the server now starts. But when i try to connect with my mobile device to the test SSID, i get: ---------------------------------------------------------------------- ... (6) ldap1: User object found at DN "uid=tstather,ou=people,dc=mpimf-heidelberg,dc=mpg,dc=de" rlm_ldap (ldap1): Released connection (0) (6) [ldap1] = ok (6) } # redundant redundant_ldap = ok (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) authenticate { (6) eap: Expiring EAP session with state 0x8d973f168d3225fd (6) eap: Finished EAP session with state 0x8d973f168d3225fd (6) eap: Previous EAP request found for state 0x8d973f168d3225fd, released from the list (6) eap: Peer sent packet with method EAP MSCHAPv2 (26) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) eap_mschapv2: Auth-Type MS-CHAP { (6) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (6) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (6) mschap: Creating challenge hash with username: tstather(a)mpimf-heidelberg.mpg.de (6) mschap: Client is using MS-CHAPv2 (6) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) [mschap] = reject (6) } # Auth-Type MS-CHAP = reject (6) eap: Sending EAP Failure (code 4) ID 165 length 4 (6) eap: Freeing handler (6) [eap] = reject (6) } # authenticate = reject (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject: EXPAND %{User-Name} (6) attr_filter.access_reject: --> tstather(a)mpimf-heidelberg.mpg.de (6) attr_filter.access_reject: Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated (6) } # Post-Auth-Type REJECT = updated (6) } # server mpimf_inner-tunnel (6) Virtual server sending reply (6) MS-CHAP-Error = "\245E=691 R=1 C=d3892ab1fa88824c1ae8daf07fc80483 V=3 M=Authentication failed" (6) EAP-Message = 0x04a50004 (6) Message-Authenticator = 0x00000000000000000000000000000000 ... ---------------------------------------------------------------------- Our LDAP server has the attributes "sambaLMPassword" and "sambaNTPassword" (there is also a samba server linked to it). I read some documentation but now im confused. Am i right in the assumption that the error occurs because our LDAP server has no "clear-text password" entries for the users? Is the only option to get it to work use the "ntlm_auth" module? I wanted to implement this setup independently of our samba server, or is this simply not possible? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

5 7

Problem with config (if- statement) on 3.0.10
by Thomas Stather 30 Oct '15

30 Oct '15

Hello Now i have my up to date radius installation but i am struggeling with my configuration (i need to implement an eduroam config using PEAP-MSCHAPv2 and EAP-TTLS-MSCHAPv2 in combination with our LDAP servers). The server won't start, attached is the output: ----------------------------------- radius1:/etc/raddb # radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/inner-eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/pap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/dhcp including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/eduroam /etc/raddb/sites-enabled/mpimf_eduroam[65]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf ----------------------------------- the /sites-enabled/eduroam looks like this: ----------------------------------- authorize { preprocess auth_log mschap suffix eap { ok = return } files redundant_ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type eap { eap update control { Tmp-String-0 = "%{debug:2}" } update control { Tmp-String-0 = "%{debug:0}" } } } preacct { preprocess acct_unique suffix } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { reply_log redundant_ldap exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on update control { Tmp-String-0 = "%{debug:2}" } if (Realm == my-realm.de || Realm == NULL) { update reply { Filter-Id = "my-realm-Secure.in" } } else { update reply { Filter-Id = "gast.in" } } ### disable debug logging again update control { Tmp-String-0 = "%{debug:0}" } } pre-proxy { pre_proxy_log } post-proxy { post_proxy_log eap } ----------------------------------- What am i doing wrong? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

2 4

My Freeradius server throws errors ,please guide
by Yusuf Siddiqui 29 Oct '15

29 Oct '15

Hi I have tried to change the mod of the file to +r mode still i see this error,what could be reason behind it,please guide. ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÅ¸" Thu Oct 29 20:56:03 2015 : Debug: } Thu Oct 29 20:56:03 2015 : Debug: instantiate { Thu Oct 29 20:56:03 2015 : Debug: } Thu Oct 29 20:56:03 2015 : Debug: modules { Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd Thu Oct 29 20:56:03 2015 : Debug: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Thu Oct 29 20:56:03 2015 : Error: Couldn't open /usr/local/etc/raddb/mods-config/attr_filter/post-proxy for reading: Permission denied Thu Oct 29 20:56:03 2015 : Error: Errors reading /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Thu Oct 29 20:56:03 2015 : Error: /usr/local/etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy" Regards Yusuf Siddiqui *__________________________________________________________________________________________________________________________________________________________________* This communication & accompanying documents ("this e-mail") contains confidential and/or privileged information for exclusive use of the individual to whom it is addressed. If you are not the intended recipient, please immediately notify the company & delete this e-mail. Any unauthorized use or disclosure of this e-mail is strictly prohibited. Representations in this e-mail are subject to contract. As an e-mail user please be cautious of the technical & other vulnerabilities of the internet which may result in malicious and/or unauthorized access to / use / alteration of e-mails/e-mail IDs. Thank you. *_______________________________________________________________________________________________________________________________________________________________*

2 1

Understanding debugging logs
by David Hartburn 29 Oct '15

29 Oct '15

Hi, Is there any advised technique or tools out there to help understanding FreeRADIUS debugging output generated by radmin/raddebug? A lot of information is generated, but a method of cutting out repeated information or quickly highlighting issues in a debug session would be handy. If not, is the best method working backwards, checking for errors in each packet log? I am already filtering by MAC or User-Name to make sure I just have output from the session I want. This is not a complaint. We are currently moving from NPS so having useful debugging is brilliant and a whole new world where problems seem solvable! I'm always interested in anything that will make life easier though :) Dave Hartburn

6 7

Freeradius and VMPS MAC problem
by Daniel Pogac 29 Oct '15

29 Oct '15

Hi, I'm trying to FreeRADIUS 3.0.4 with MySQL backend and VMPS on CentOS 7.1 64bit. Everything seems to work, except one thing. When i testing VMPS with vqpcli.pl, FreeRADIUS shows in debug other MAC than i send by vqpcli.pl. This is request what i send by vqpcli.pl: [root@centos7 tmp]# ./vqpcli.pl -s localhost -v ISEPP -w 10.0.0.1 -i 2/4 -m 0010.a49f.30e3 ============================== MESSAGE SENT: 0000000 0101 0600 0000 3412 0000 010c 0400 000a 0000010 0100 0000 020c 0300 2f32 0034 0c00 0003 0000020 0000 0c00 0004 4905 4553 5050 0000 070c 0000030 0100 0000 0c00 0006 0006 a410 309f 00e3 000003f ============================== MESSAGE RECV: 0000000 0201 0200 0000 3412 0000 030c 1900 6c70 0000010 6165 6573 755f 6573 725f 6165 5f6c 6c76 0000020 6e61 685f 7265 0065 0c00 0008 0006 a410 0000030 309f 00e3 0000033 ============================== Vlan: please_use_real_vlan_here MAC Address: 0010a49f30e3 Status: ALLOW and this is from debug of FrreeRADIUS: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 10.0.0.1 VMPS-Port-Name = '2/4' VMPS-VLAN-Name = '' VMPS-Domain-Name = 'ISEPP' VMPS-Unknown = 0x00 VMPS-MAC = f0:a6:c0:15:55:7f (0) Received Access-Request packet from host 127.0.0.1 port 34832, id=4660, length=63 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 10.0.0.1 (0) VMPS-Port-Name = '2/4' (0) VMPS-VLAN-Name = '' (0) VMPS-Domain-Name = 'ISEPP' (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = f0:a6:c0:15:55:7f Doing VMPS (0) vmps { (0) [mac2vlan] = ok (0) update reply { (0) VMPS-Packet-Type = VMPS-Join-Response (0) EXPAND %{VMPS-Mac} (0) --> f0:a6:c0:15:55:7f (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' (0) } # update reply = noop (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok Done VMPS (0) vmps { (0) [mac2vlan] = ok (0) update reply { (0) VMPS-Packet-Type = VMPS-Join-Response (0) EXPAND %{VMPS-Mac} (0) --> f0:a6:c0:15:55:7f (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' (0) } # update reply = noop (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok (0) Sending Access-Accept packet to host 127.0.0.1 port 34832, id=4660, length=0 (0) VMPS-Packet-Type = VMPS-Join-Response (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' VMPS-VLAN-Name = 'please_use_real_vlan_here' VMPS-Cookie = f0:a6:c0:15:55:7f (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 4660 with timestamp +312 As you can see I'm sending MAC:00:10:a4:9f:30:e3 but in debug log is MAC: f0:a6:c0:15:55:7f. If i ran vqpcli.pl three times the MAC address in debug change to another. Can some explain to me what am I doing wrong ? Daniel

2 2

VMPS with MySQL default VLAN
by Daniel Pogac 29 Oct '15

29 Oct '15

Good afternoon. I've got problem with configuring VMPS with MySQL and default VLAN. This is relevant part of vmps config which i use: update reply { &VMPS-Packet-Type = VMPS-Join-Response &VMPS-Cookie = &VMPS-Mac &VMPS-VLAN-Name = "Public_INET" # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # &VMPS-VLAN-Name = "%{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'}" } In this configuration, VMPS always return VLAN value as Public_INET. Even if i use MAC address which is in MySQL database. In debug output i can see that VLAN is successfully returned from MySQL, but return from FreeRADIUS is Public_INET. Debug output is as follows : VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ec (1) Received Access-Request Id 4660 from 127.0.0.1:59323 to 127.0.0.1:1589 length 60 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 4660 (1) VMPS-Client-IP-Address = 127.0.0.1 (1) VMPS-Port-Name = "Fa0/1" (1) VMPS-VLAN-Name = "" (1) VMPS-Domain-Name = "" (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = 68:f7:28:e7:d8:ec Doing VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (1) &VMPS-VLAN-Name = "Public_INET" (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (2) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> OFFICE (1) VMPS-VLAN-Name = OFFICE (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (1) &VMPS-VLAN-Name = "Public_INET" (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (3) (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> OFFICE (1) VMPS-VLAN-Name = OFFICE (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok (1) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:59323 length 0 VMPS-VLAN-Name = "Public_INET" VMPS-Cookie = 68:f7:28:e7:d8:ec (1) Finished request (1) Cleaning up request packet ID 4660 with timestamp +24 Ready to process requests When i place first mysql request and then i set default VLAN, than returned VLAN from VMPS is correct when i use MAC address which is in DB, but when i use other MAC returned VLAN is empty. Config as follows: update reply { &VMPS-Packet-Type = VMPS-Join-Response &VMPS-Cookie = &VMPS-Mac # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # &VMPS-VLAN-Name = "%{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'}" &VMPS-VLAN-Name = "Public_INET" } Debug output with MAC from DB: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ec (0) Received Access-Request Id 4660 from 127.0.0.1:60360 to 127.0.0.1:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = 68:f7:28:e7:d8:ec Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (0) (0) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (0) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (0) --> OFFICE (0) VMPS-VLAN-Name = OFFICE (0) &VMPS-VLAN-Name = "Public_INET" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok Done VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (1) (0) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (1) (0) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (0) --> OFFICE (0) VMPS-VLAN-Name = OFFICE (0) &VMPS-VLAN-Name = "Public_INET" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok (0) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:60360 length 0 VMPS-VLAN-Name = "OFFICE" VMPS-Cookie = 68:f7:28:e7:d8:ec (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +5 Ready to process requests This is debug output with MAC not present in DB: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ea (1) Received Access-Request Id 4660 from 127.0.0.1:58809 to 127.0.0.1:1589 length 60 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 4660 (1) VMPS-Client-IP-Address = 127.0.0.1 (1) VMPS-Port-Name = "Fa0/1" (1) VMPS-VLAN-Name = "" (1) VMPS-Domain-Name = "" (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = 68:f7:28:e7:d8:ea Doing VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ea (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (2) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ea' (1) SQL query returned no results rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = (1) &VMPS-VLAN-Name = "Public_INET" (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ea (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ea' (1) SQL query returned no results rlm_sql (sql): Released connection (3) (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = (1) &VMPS-VLAN-Name = "Public_INET" (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok (1) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:58809 length 0 VMPS-VLAN-Name = "" VMPS-Cookie = 68:f7:28:e7:d8:ea (1) Finished request (1) Cleaning up request packet ID 4660 with timestamp +44 Ready to process requests It looks like first value set to attribute &VMPS-VLAN-Name is mandatory and it cant be overwrited. Is there any possibility to read VLANs from DB but if MAC is not in DB table to set some default VLAN? Thank You Daniel

1 0