April 2016 - Freeradius-Users - lists.freeradius.org

ldap attribute update
by Anirudh Malhotra 05 Apr '16

05 Apr '16

Hi everyone, I am trying to map an attribute from ldap to freeradius control did this update { control:wifi := 'wifi' } getting this when parsing ldap (446) ldap: Processing user attributes (446) ldap: control:wifi := '5' created this wifi attribute in dictionary as well and when I am trying to use this in post auth in default but that is giving me an error (80) elsif ((control:wifi == "1") || (control:wifi == "5")) { (80) ERROR: Failed retrieving values required to evaluate condition I am missing something, maybe something very elementary sorry for that :p I am doing PEAP-GTC using LDAP by the way, so I though may be ldap is getting pasrsed inside inner-tunnel that is why i tried update { outer.control:wifi := 'wifi' } (437) ldap: Processing user attributes (437) ldap: outer.control:wifi := '5' elsif ((outer.control:wifi == "1") || (outer.control:wifi == "5")) { (71) ERROR: Failed retrieving values required to evaluate condition but still the same problem, please help BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 7

Cisco ASR / Starent Dictionary
by Peter Lambrechtsen 05 Apr '16

05 Apr '16

Looking through the Cisco ASR (was Starent) Dictionaries and it seems SN-Rulebase is commented out. As per: http://www.cisco.com/c/dam/en/us/td/docs/wireless/asr_5000/8_x_9-0/OL-22955… SN-Rulebase When the session is active charging enabled, Rulebase name will specify one of the pre configured ECSv2 rulebases in active charging subsystem. Type 26 Vendor ID 8164 VSA Type 250 Length 1–64 Value String Any reason why it's commented out as 249, rather than 250? Had a search through the mail archives but nothing apart from http://lists.freeradius.org/pipermail/freeradius-users/2010-July/047555.html Which also lists VSAs 1001 - 1040 which is in the Cisco docs but not in the dictionary. So.. Just push a patch for this or is there a reason why it was missing? Cheers Peter

2 1

Re: I-D for a new method: EAP-Kerberos
by Rick van Rein 05 Apr '16

05 Apr '16

Hi, > for ANY method that requires a password that goes through another system, the password > is known for the server agent - thats just how things are. Sure, but it's rarely as devastating as in the case of Kerberos, where it also implies decryption capability of all private traffic. Passing the Kerberos password through a 3rd party system is highly dis-advised within the Kerberos security model. Also, I don't think we should take this undesirable situation as a fait accompli if there are straightforward manners of doing this in a way that raises less security concerns. What is acceptable to some under a pragmatic attitude is unacceptable in other situations, e.g. when spreading functions over network partners. > work is already done for EAP kerberos - along with some other reuqiremens such as > server security pinning - I would suggest that you read the ABFAB IETF stuff > - 'Project Moonshot' was its original name - there is working software and FreeRADIUS 3 > does it, for example I know ABFAB, and it is completely different from what I propose; it embeds EAP in GSS-API (making EAP an alternative to Kerberos5) while I'm proposing that EAP should carry Kerberos as one of its authentication methods (thereby following the line of thought underpinning EAP). The only relation with ABFAB is that it would be possible in theory to choose between GSS-API / Kerberos5 and GSS-API / EAP / Kerberos layerings (the latter of which would be silly). However, I did get a response from a similar piece of work by the Uni of Madrid, which does indeed implement EAP over Kerberos. I have the related I-D work on my reading list now; it is not yet clear inhowfar their method can be called a "standard" or "working code". Cheers, -Rick

5 4

AA not Accounting
by Joaquin Alzola 05 Apr '16

05 Apr '16

Hi List I wanted to use Freeradius as a AA (Authentication & Authorization) not much into Accounting. Just want it just as an "entry point" for outside engineers based on time limit. I have already test it with Freeradius and it works perfectly. Wanted to know if in your opinion it is a good strategy to use Freeradius as I want it to be or you would recommend some other tool. BR Joaquin This email is confidential and may be subject to privilege. If you are not the intended recipient, please do not copy or disclose its content but contact the sender immediately upon receipt.

1 0

Re: I-D for a new method: EAP-Kerberos
by Rick van Rein 05 Apr '16

05 Apr '16

Hi, @Alan Yes, I meant Kerberos over EAP. Arran> I think EAP-Kerberos would be useful to bootstrap kerberos SSO during network login. Arran> I've been waiting for someone to come up with standard for this for 10 years You may want to have a look at the following references, sent to me by Rafael Marín López of Uni Madrid in Spain: 1. - Rafael Marín López, Fernando Pereñiguez-Garcia, Yoshihiro Ohba, Fernando Bernal-Hidalgo, Antonio F. Gómez-Skarmeta: A Kerberized Architecture for Fast Re-authentication in Heterogeneous Wireless Networks 2. - EAP-Kerberos: Leveraging the Kerberos Credential Caching Mechanism for Faster Re-authentications in Wireless Access Networks Saber Zrelli, Nobuo Okabe, Yoichi Shinoda https://tools.ietf.org/html/draft-marin-eap-frm-fastreauth-03 https://tools.ietf.org/html/draft-zrelli-eap-frap-04 I still need to read up on these to see if what I'm proposing is really new. But it is really helpful to have seen your acknowledgement that I'm on to something useful. Thanks! -Rick

1 0

Freeradius 3.0.4 Accounting [sql-relay problem]
by Ibrahim Almahfooz 04 Apr '16

04 Apr '16

Hi Everyone, We are currently running FreeRADIUS 3.0.4 as an accounting server installed from the repository on CentOS 7 server. We have almost 25k adsl,vdsl,gpon users in the network. The BRAS [NAS] is sending the accounting data to the FreeRADIUS. Instead of writing accounting data directly to the MySQL db, we configured it to write the sql statements to the sql-relay file and set a crontab to dump it to the remote db every 15 minutes using *radsqlrelay* command: radsqlrelay -x -h x.x.x.x -d mysql -b mysqldb -u root -pdbpassword -1 /var/log/radius/radacct/sql-relay While the above command run by the crontab, we see sql-relay.work file writing the background and we assume this is normal in order to write the incoming accounting data while doing the sql-relay transfer to the remote db. After a couple of days of setting everything, our [BRAS] NAS device has reported accounting errors in its statistics like accounting start not successfully sent or accounting stop not successfully sent and statistics shows the errors are happening randomly every one, two or six hours. We start doing investigations and found that in the radius.log there are many errors happening in the same time the radsqlrelay running by the crontab, the error is below: Fri Apr 1 03:59:23 2016 : Info: rlm_sql (sql): 0 of 3 connections in use. Need more spares Fri Apr 1 03:59:23 2016 : Info: rlm_sql (sql): Opening additional connection (73115) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 4 of 4 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73116) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 5 of 5 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73117) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 6 of 6 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73118) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 7 of 7 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73119) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 7 of 7 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73120) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 9 of 9 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73121) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 10 of 10 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73122) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 11 of 11 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73123) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 12 of 12 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73124) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 13 of 13 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73125) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 14 of 14 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73126) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 15 of 15 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73127) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 16 of 16 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73128) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 17 of 17 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73129) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 18 of 18 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73130) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 19 of 19 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73131) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 20 of 20 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73132) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 21 of 21 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73133) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73134) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 23 of 23 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73135) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 24 of 24 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 24 of 24 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73136) Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73137) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 26 of 26 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73138) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 27 of 27 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73139) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 28 of 28 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73140) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 29 of 29 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73141) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 30 of 30 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73142) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 31 of 31 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73143) Fri Apr 1 04:00:09 2016 : Error: 1 requests have been waiting in the processing queue for 6 seconds. Check that all databases are running properly! >From the radius.log we see this error start happening exactly while the crontab of dumping the sql-relay happens but not on every crontab job! We are not running any db in the same FreeRADIUS since we are writing to the file. Obviously, the FR server is considering sql-relay as database and report the error "Check that all databases are running properly!" Seems like the radius stops responding (not always) when dumping the sql-relay file to the mysql db. Also we sometimes see error of more than 50 requests have been waiting in the processing… in the radius.log. And that actually what triggers the NAS device to consider the freeRadius as down status. Surprisingly, our NAS start again sending accounting packet and the server goes normally. and this error keep showing on both radius.log and the NAS from now and then. And this probably means "Loss of accounting data" Actually we have no idea why this behaviour is occurring. We start thinking if there is any size or performance limitation in the sql-relay.work file? Or may be a bug in this version and we are unaware of the fix if exists? Any ideas? Best, Ibrahim System Administrator

2 1

FreeRADIUS 3 certificate issue on some Windows clients
by Tomáš Ivánek 04 Apr '16

04 Apr '16

I'm running FreeRADIUS 3.0.11 with OpenSSL 1.0.2g. I have successfully configured EAP TLS, TTLS and PEAP methods. Now the issue...when I'm configuring clients with Windows 7, Vista or XP and certificates are not yet installed (ca.der and optionally client.p12) and try to connect to the network through the bottom right network icon a bubble popup shows up telling me that I need to installl the certificates. The connection can't be established, which is how it should behave. When i configure the connection manually, import the certs, all the methods mentioned above works well. The manual configuration also work well on Windows 10 and can't connect until at least the ca.der is present on the computer for PEAP and TTLS. However when any of theese certificates are not present on the Windows 10 machine and try to connect through the network menu in the bottom right corner the connection is successfully created after entering login credentials. It seems like it's bypassing the ca.der certificate somehow. I have the same problem with windows phone 7.X devices. Is there a way how to prevent this behaviour? The server shouldn't allow the connection, am I right? here is the output od radiusd -X with example login through windows phone 7 device. It's a .txt file on my google drive. Thank you https://drive.google.com/file/d/0B9T3_pXPBXRnZklXRjJDcmVHek0/view?usp= sharing (https://drive.google.com/file/d/0B9T3_pXPBXRnZklXRjJDcmVHek0/view?usp=shari…)

3 2

two freeradius servers - question for advice
by Marcin 04 Apr '16

04 Apr '16

Hi everyone, I'm going to start two freeradius servers to authenticate PPPoE users, both independent of the other. First as primary and second as secondary. I'm going to start PostgreSQL server also, but in case of unavailability of sql server freeradius server must have work properly. Both freeradius have to have actual data of arleady logged users to provide simultanieusly use. I'm going to check authenticate in db and if if failed get user from files (created in background). accounitng i'm going to do with linelog and afterwards put in to database. I need advice from you, more advanced users than me. How to achieve that HA and avablitity. Thanks in advance. -- Best Regards Marcin / nicraM

3 7

disconnect Error-Cause = Unsupported-Extension‏
by Syed Jahanzaib 04 Apr '16

04 Apr '16

I am using FR 2.1.10 with Mikrotik 6.34.4 COA is working fine and Bandwidth change on the fly working ok. I can disconnect client using radclient as well from cli but disconnect user via update disconnect in FR gives following error: Sending Disconnect-Request of id 7 to 101.11.11.255 port 3799 User-Name = "zaib" rad_recv: Disconnect-NAK packet from host 101.11.11.255 port 3799, id=7, length=42 Error-Cause = Unsupported-Extension NAS-Identifier = "MikroTik" Code: update disconnect { User-Name = "%{request:User-Name}" -- Regard's

2 1

rfc6929 - tlv attributes in extended attribute 246
by Vereecke, Katrien (Nokia - BE) 04 Apr '16

04 Apr '16

Hello, I see a difference in behavior for a tlv attribute in an extended attribute 246 in FreeRadius version 3.0.x and FreeRadius version 3.1.x. My dictionary contains the following attributes: BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-6 ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-1 1 integer ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-2 2 string ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3 3 tlv ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3-1 3.1 string ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3-2 3.2 tlv ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3-2-1 3.2.1 string END-VENDOR Alcatel-IPD I have the following attributes in my users file: Alcatel-IPD-Ext-6-TestAttr-2 = "test3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLenAttention", Alcatel-IPD-Ext-6-TestAttr-3-1 = "testattr_3_1", Alcatel-IPD-Ext-6-TestAttr-3-2-1 = "testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1", The output of the freeRadius server in version 3.0.x : The access-Accept message: (2) Sent Access-Accept Id 14 from 138.203.10.191:1812 to 138.203.10.123:64388 length 0 .... ..... (2) Alcatel-IPD-Ext-6-TestAttr-2 = "test3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLente" (2) Alcatel-IPD-Ext-6-TestAttr-3-1 = "testattr_3_1" (2) Alcatel-IPD-Ext-6-TestAttr-3-2-1 = "testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr" The output of the FreeRadius server in version 3.1.x: (0) Alcatel-IPD-Ext-6-TestAttr-2 = "test3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLente" (0) Alcatel-IPD-Ext-6-TestAttr-3-1 = "testattr_3_1" (0) Alcatel-IPD-Ext-6-TestAttr-3-2-1 = "testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr" Although the output of the FreeRadius server shows the same output in version 3.0.x and version 3.1.x , wiresharks shows that there is a difference in the access-accept packet sent, In version 3.0.x the packet contains all the information for the tlv attribute Alcatel-IPD-Ext-6-TestAttr-3_xx while in version 3.1.x I only see the attribute Alcatel-IPD-Ext-6-TestAttr-3-1. Wireshark for version 3.0.x: Frame 623: 1223 bytes on wire (9784 bits), 1223 bytes captured (9784 bits) on interface 0 Ethernet II, Src: SuperMic_a2:12:54 (00:25:90:a2:12:54), Dst: SuperMic_57:a0:76 (00:25:90:57:a0:76) Internet Protocol Version 4, Src: 138.203.10.191, Dst: 138.203.10.123 User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 64388 (64388) RADIUS Protocol Code: Access-Accept (2) Packet identifier: 0xe (14) Length: 2661 Authenticator: a01937c98d28165fc4c238e5cd8867cd [This is a response to a request in frame 615] [Time from request: 0.000860000 seconds] Attribute Value Pairs AVP: l=7 t=Unknown-Attribute(241): 060000003c .... AVP: l=255 t=Unknown-Attribute(246): 1a800000197f02746573743346726167576974684c6f6e67... AVP: l=147 t=Unknown-Attribute(246): 1a00726167576974684c6f6e674c656e7465737433467261... AVP: l=255 t=Unknown-Attribute(246): 1a800000197f03010e74657374617474725f335f3102ff01... AVP: l=27 t=Unknown-Attribute(246): 1a00417474725f335f325f3174657374417474725f335f32... AVP: l=7 t=Unknown-Attribute(243): 0b00000005 AVP: l=7 t=Unknown-Attribute(243): 0b00000006 .... AVP: l=11 t=Reply-Message(18): Welcome!\n Wireshark for version 3.1.x: Frame 516: 638 bytes on wire (5104 bits), 638 bytes captured (5104 bits) on interface 0 Ethernet II, Src: SuperMic_a2:12:54 (00:25:90:a2:12:54), Dst: SuperMic_57:a0:76 (00:25:90:57:a0:76) Internet Protocol Version 4, Src: 138.203.10.191, Dst: 138.203.10.123 User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 64384 (64384) RADIUS Protocol Code: Access-Accept (2) Packet identifier: 0xf (15) Length: 2076 Authenticator: 4545fca0176c445525748ced32857ae1 [This is a response to a request in frame 502] [Time from request: 0.003358000 seconds] Attribute Value Pairs AVP: l=7 t=Unknown-Attribute(241): 060000003c .... AVP: l=255 t=Unknown-Attribute(246): 1a800000197f02746573743346726167576974684c6f6e67... AVP: l=147 t=Unknown-Attribute(246): 1a00726167576974684c6f6e674c656e7465737433467261... AVP: l=23 t=Unknown-Attribute(246): 1a000000197f03010e74657374617474725f335f31 AVP: l=7 t=Unknown-Attribute(243): 0b00000005 AVP: l=7 t=Unknown-Attribute(243): 0b00000006 .... AVP: l=11 t=Reply-Message(18): Welcome!\n I think the behavior of the FreeRadius version v3.0.x is ok. The access-accept contains the attribute Alcatel-IPD-Ext-6-TestAttr-3-1 and the attribute Alcatel-IPD-Ext-6-TestAttr-3-2-1 is partially in the first fragment and in the second fragment for the max length of 255 bytes. This is not the case in FreeRadius version v3.1.x? Thanks, Kind regards, Katrien.

2 1