- Freeradius-Users - lists.freeradius.org

falling back to local auth and not ads
by Morris, Andi 27 Apr '12

27 Apr '12

My freeradius server seems to be falling back to local authentication rather than piping it out to our ADS server. If I create a local user on the radius box authentication is successful. Can anyone please help with this? All relevant info I can think of is below. Samba connection works fine, I've joined the linux box (red hat 6.2) to the domain. Kinit connection runs fine. Edited Testparm results are: Load smb config files from /etc/samba/smb.conf rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Loaded services file OK. Server role: ROLE_DOMAIN_MEMBER Press enter to see a dump of your service definitions [global] workgroup = workgroup realm = INTERNAL.DOMAIN.CO.UK server string = server01 interfaces = 10.1.3.9/24 security = ADS client NTLMv2 auth = Yes log level = 1 winbind:5 auth:3 load printers = No idmap uid = 10000-45000 idmap gid = 10000-45000 winbind use default domain = Yes cups options = raw net ads lookup dcs shows a domain controller chgrp radiusd /var/lib/samba/winbindd_privileged/ has been run ntlm_auth -username give result: NT_STATUS_OK: Success (0x0) cropped debug output: Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=50, length=152 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000c01736d3138383138 Message-Authenticator = 0xa49f7bb9beab7a89b485841f3a600993 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 00-24-54-42-86-04 rlm_perl: Added pair Called-Station-Id = 00-16-47-F7-32-41 rlm_perl: Added pair Cisco-NAS-Port = FastEthernet0/1 rlm_perl: Added pair Message-Authenticator = 0xa49f7bb9beab7a89b485841f3a600993 rlm_perl: Added pair User-Name = sm18818 rlm_perl: Added pair EAP-Message = 0x0200000c01736d3138383138 rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 10.1.1.22 rlm_perl: Added pair NAS-Port = 50001 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Auth-Type = EAP ++[packetfence] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 50 to 10.1.1.22 port 1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a17c7ddd7defb2c24478e29151 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=51, length=263 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7c7cc4a17c7ddd7defb2c24478e29151 EAP-Message = 0x0201006919800000005f160301005a0100005603014f9017be440f4cbc99f67ffe587f648545f74cc832daa9e43857f7ce7ac48e42000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0xaae583362e9a580324ffe1459a30e524 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 1 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0419], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 51 to 10.1.1.22 port 1812 EAP-Message = 0x0102040019c00000045d16030100310200002d03014f90179057e896056f57af82c6f54e60041737802441091408cb5086b96cb93500002f000005ff0100010016030104190b00041500041200040f3082040b308202f3a0030201020209008457e87e4346de7f300d06092a864886f70d010105050030819b310b30090603550406130247423110300e06035504080c07436172646966663110300e06035504070c074361726469666631283026060355040a0c1f43617264696666204d6574726f706f6c6974616e20556e697665727369747931293027060355040b0c204c69627261727920616e6420496e666f726d6174696f6e20536572766963 EAP-Message = 0x65733113301106035504030c0a68616c6c736e61633031301e170d3132303431363138303930385a170d3133303431363138303930385a30819b310b30090603550406130247423110300e06035504080c07436172646966663110300e06035504070c074361726469666631283026060355040a0c1f43617264696666204d6574726f706f6c6974616e20556e697665727369747931293027060355040b0c204c69627261727920616e6420496e666f726d6174696f6e2053657276696365733113301106035504030c0a68616c6c736e6163303130820122300d06092a864886f70d01010105000382010f003082010a0282010100be9c9265f0fd69 EAP-Message = 0x36b44a273f0b3bf8aafa36904d3dec8d392bc1bc9d52c73cd83c34fc418e4ae116847ed462411d54e7f78d586e53c05e5a59a08327cdafdebd2d06fe22a08ffabab004fefdde1b2b005a2d17c114b5b262122f8ff5d3ae89b2b3debd83a134a3c504f57c0e46cdc201d51b343a8243167b95478d92c2b2289e6516219bda5daf1b64d2599512f41a35cc1cb749cecc637e905880e7794ae637e1f52bc9d62e8a73444ffe0e164888574d9afdb7ab3ee30c09296a6d299337796d36644d00f6a5725ff2e05381d12ba1fdd37075cd56a6b7e13e51d671aaa3aacf6f0cbf7f0f90e75e22369e426c2a530ab0abb6162582d6b3ec4adeb354e53102030100 EAP-Message = 0x01a350304e301d0603551d0e041604146cb125f0ea10521b328b7ae014a2680c058ca7bc301f0603551d230418301680146cb125f0ea10521b328b7ae014a2680c058ca7bc300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010084c2453f7ee7c9659c6278e51bdcda9489b9df1721271447e78c69ea94edf9a1c90a83fd14af61ced01dfe7a931363afcd4bf2ad4c563bd5200454356c3973f8233f6ebc5a8e8fec1cdfc7a46b317ec65a5b105c644b81d435480a8386267d9975db81f918a400fe1fea57f82219834c44288970bf3b5ff40ce9089dc99e432d706e765e204fab9cbc7a6dfa88c793788441371df26d EAP-Message = 0x1966ce6ceb1e56b79c80e9ab Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a17d7edd7defb2c24478e29151 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=52, length=164 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7c7cc4a17d7edd7defb2c24478e29151 EAP-Message = 0x020200061900 Message-Authenticator = 0x7e4e96be86285da30bea39583ab60700 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 52 to 10.1.1.22 port 1812 EAP-Message = 0x0103006d1900ae27f7c48f8dcf1d47327fc08f9f1a9a004fd376c1a4c491331b2e554c6458a40bebde6444da9b525372d9c44920937aa26393222d460bc64bd1d007021531016d5d96796972e15d25eced794837a6d77d98a5d1b7b3c128d3c895de9e9e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a17e7fdd7defb2c24478e29151 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=53, length=496 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7c7cc4a17e7fdd7defb2c24478e29151 EAP-Message = 0x0203015019800000014616030101061000010201004c7788a8a2f60c69bf9dd1c9a0a777de1a7b45ffc7efaded554f9ae7daa57bed28006e3af36fb6e48e325bba393c7ed30f62ee242f8bca8584f3982bf43879642f227025425044a0061a487781d4243d9b731719172f21056fba514a7ffe85becb7d4870d2d7b00940113a9a4a47bdbc087223f615f6643f9fee1c07f4c7b8ce849b605cf2d6e945295161f02014a91b90c95ae5419079252793bf3e1578e9d4a9891a73554201221bccfcbbecf2b658344db323b32aed8c7a74057abc15d8aa5edb9c3dd6cfd20de84639ebaa5bb1e78bfbf02d19cd2ca596e0a72bf4612f9a58c681473dbee4f5 EAP-Message = 0xd6d80708035534d6f9a4a296d5f67a220426e485c4796430140301000101160301003086ff2b333a990ad6876caba4e9b6f806f8a437681f6db738596d4c80963e7941f7016f3bf845cd94fb15f5f5c5fe452f Message-Authenticator = 0x21930395cd5e71160ca4bf8c1125df8e server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 3 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 53 to 10.1.1.22 port 1812 EAP-Message = 0x01040041190014030100010116030100301a7416c5a68d27374ed4739350a51eae93d8baede52b057347c665cabff9410f7dab4d72795b54891b15e6ed2dd0d780 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a17f78dd7defb2c24478e29151 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=54, length=164 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7c7cc4a17f78dd7defb2c24478e29151 EAP-Message = 0x020400061900 Message-Authenticator = 0x7f354427c0059d1a5fc0a89e7fac88f1 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 54 to 10.1.1.22 port 1812 EAP-Message = 0x0105002b190017030100207698c92d6973a15e192ae19cecef7a29e6ccd5f32f64f713e4f5497216d6f371 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a17879dd7defb2c24478e29151 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=55, length=201 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7c7cc4a17879dd7defb2c24478e29151 EAP-Message = 0x0205002b1900170301002095f189b1ea8c30d31387e9a79add21fc2b07b4e7e86205b38772a041b99a6b00 Message-Authenticator = 0x3fa49fa72ae68063e5edc7c76c1a23c5 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 5 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - sm18818 [peap] Got inner identity 'sm18818' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0205000c01736d3138383138 server packetfence { [peap] Setting User-Name to sm18818 Sending tunneled request EAP-Message = 0x0205000c01736d3138383138 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sm18818" NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 server packetfence-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server packetfence-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010600211a0106001c10b6f046e50b7952e6e797acb2dcd7b773736d3138383138 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9920660299267c474e5f7c2e3011a1e5 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010600211a0106001c10b6f046e50b7952e6e797acb2dcd7b773736d3138383138 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9920660299267c474e5f7c2e3011a1e5 [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 55 to 10.1.1.22 port 1812 EAP-Message = 0x0106004b190017030100404ae4ff24a485244baabe8642914ae553c53877050c4ac566f444c764f938c4bbb924e13de5c7f90c50d5d89d5e0322b2f7e54eec93a9b6ef170863282b669f90 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a1797add7defb2c24478e29151 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.1.22 port 1812, id=56, length=265 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet User-Name = "sm18818" Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 State = 0x7c7cc4a1797add7defb2c24478e29151 EAP-Message = 0x0206006b1900170301006024a871b68d472e9b2fb927c48ee8eec1927e26d0c995f1d33b245e2aaedf10d0850fe337c1fbeca10935879e64a3ca65c75159b07b567d9bca49128ad5d4abe9c7069dcb9c32575274cd9e383e7c4b93dd49018d352297f3253b5831d997b660 Message-Authenticator = 0x19cf5c1dc655bdbc50918cb01e71cfd0 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 6 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020600421a0206003d31b49f7150ff84c15725200ff871377c240000000000000000b1ce20b6cca5c3e86e219ec24aef13ee2e4c12825e87e18a00736d3138383138 server packetfence { [peap] Setting User-Name to sm18818 Sending tunneled request EAP-Message = 0x020600421a0206003d31b49f7150ff84c15725200ff871377c240000000000000000b1ce20b6cca5c3e86e219ec24aef13ee2e4c12825e87e18a00736d3138383138 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sm18818" State = 0x9920660299267c474e5f7c2e3011a1e5 NAS-IP-Address = 10.1.1.22 NAS-Port = 50001 Cisco-NAS-Port = "FastEthernet0/1" NAS-Port-Type = Ethernet Called-Station-Id = "00-16-47-F7-32-41" Calling-Station-Id = "00-24-54-42-86-04" Service-Type = Framed-User Framed-MTU = 1500 server packetfence-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: sm18818 [mschap] Told to do MS-CHAPv2 for sm18818 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [sm18818] (from client 10.1.1.22 port 50001 cli 00-24-54-42-86-04 via TLS tunnel) } # server packetfence-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 56 to 10.1.1.22 port 1812 EAP-Message = 0x0107002b1900170301002083d13929a4b17d457d0978cbdf96feaf9b3d0291f181a38ab1d60377f0333d2a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c7cc4a17a7bdd7defb2c24478e29151 Finished request 6. Going to the next request Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o'r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

4 10

FreeRadius LDAP OID Numbering
by Peter Lambrechtsen 27 Apr '12

27 Apr '12

A question for Alan, or others on the list. There is the FR LDAP Schema LDIF file to import FreeRadius related schema into your LDAP directory. Searching around it seems that OID 1.3.6.1.4.1.3317.4.3.1 up to 68 is allocated. http://permalink.gmane.org/gmane.comp.freeradius.devel/6134 Who "owns" the OID and I could ask to get 69 registered formally? I would like to add the LDAP Attribute "radiusFramedPool" for Framed-Pool VSA Should I just build a DIFF and submit it to the list, or is there an owner of the OID numbering who I would need to contact? Cheers Peter

2 1

PEAP/MSCHAPv2 - Host Account Authentication Only
by Kevin Elliott 26 Apr '12

26 Apr '12

I have a working setup using FreeRadius 2.1.10 doing PEAP/MSCHAPv2 against a 2008 R2 Domain Controller via Samba 2.3.5.6 all running on Debian 6.0.4. My clients are D-Link DWL3200 and D-Link DAP-2360 access points. I am using the builtin Windows XP SP3 802.1x supplicant. Currently FreeRadius will send back Access-Accepts for *both* user and machine/host accounts (in the Active Directory context of those terms). I would like to configure FreeRadius to ignore or reject authentication requests using the user creditionals. I spent the better part of yesterday afternoon searching the mailing list but I couldn't seem to conjure up the correct search terms to find out which configuration files I need to delve into to make this setting. My goal is to implement 802.1x authentication for devices that are joined to the domain. I don't want people to be able to use their domain creditionals to authenticate non-domain devices to our wireless network. Additionally, I just want to commend the developers and other folks associated with FreeRadius for a fantastic job. The configuration files are very well documented, I just can't figure out which one I need to re-read. Thanks. Debugging Output: ----------------- FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.41.9 { require_message_authenticator = no secret = "" shortname = "cshop-dap2360-wap" nastype = "other" } client 192.168.52.0/22 { require_message_authenticator = no secret = "" shortname = "cbj-downtown" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "SECRET" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. -- Kevin Elliott Network Specialist City and Borough of Juneau, MIS (907) 586 - 0905

3 5

setup question...
by Chris Morris 26 Apr '12

26 Apr '12

Greetings All! We have set up Radius on OS X 10.6 Server running OD for use with several devices, including a Sonic Wall, and Ruckus WAPs. We have gotten everything working very nicely, but we would love to be able to include a small group of Windows users running on AD, so they can also use their network Credentials to access the WAP etc. The main question is - Is it possible for FreeRadius (the OS X 10.6 version) to authenticate against both OD and AD? And the second question is obviously... how? Thanks in advance for your time!! Please reply directly, as I am not subscribed to the list... Chris Morris Nashville, TN

2 1

Freeradius with multiple clients
by Fabricio Flores 26 Apr '12

26 Apr '12

Hi everyone... I have a lan and wireless network... The wireless network i want to use a captive portal (coovachilli) but in places that i don't have wireless i need to use access points to access to the lan network... I use freeradius with mysql... I configure 2 clients in clients.conf the coovachilli is localhost and lan network 172.16.32.0 is another client, but in coovachilli i login with my users in the database and y did, but i have problems to the ap... The didn't login... In the database u stored username with user-password attribute... Is it correct?

3 5

unique authentication per wlan
by Paolo Barbato 26 Apr '12

26 Apr '12

Is it possible configure freeradius to select a specific authentication mechanism on a wlan basis ? Considering to have a couple of wlan , say ad_wifi and sql_wifi, I would allow only Active Directory authenticated users to associate to ad_wifi , while only users defined on a mySQL db can connect to sql_wifi. Thanks for suggestions. Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 2

Incoming Packet information do not modify the Accounting Table
by yagizozen 26 Apr '12

26 Apr '12

Hello guys, I recently installed freeradius server. I am only using the accounting mechanism of the system for keeping logs. I am monitoring the server for a week now and today I face with a problem that couldnt solve. The problem is that, in the "detail" log of the client, I can see the incoming STOP packets of a specific session_id and the cause of termination is stated as "Idle-timeout". In general when these packets arrive to the server, it goes and closes the active session of a user in the accounting table stating that the connection of a user disconnected at a given time. But sometimes, some STOP packets with Idle-Timeout cause, do not run the necessary query in the radius for updating the accounting table for that session. This do not happens always. But I need to find the solution for that. I want to see that every LOG inside the "detail" log of a NAS client, should be proceed by the radius for the necessary changes. Like I said, some times, some packets inside the detail log is like ignored by the radius for updating the accounting table. What can be the reason of this situation? I can only think may be it is because of the heavy loads of traffic at that time in terms of packets arriving to the radius from NAS. I only have 1 client and the radiusd.conf is set to default values. What is the solution Guys? Thank you in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Incoming-Packet-information-do-not-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

Nas-Port-Id as username.
by Xbert_badstuber 26 Apr '12

26 Apr '12

We are using the Cisco ACS 5.3 as a RADIUS for database authentication and authorization. The purpose is to authenticate incoming users based on the NAS-PORT-ID. The problem is that we cannot find any solution for the Service Router (Alcatel 7750) to send the NAS-PORT-ID to act as USERNAME. The username field is set to the MAC address. The ACS requires a USERNAME and there is not a way to manipulate the User-Name value once it is received. We heard that it could be possible to use the freeradius to act as a proxy for the Cisco secure ACS. This is what we want: User --> [SR] --> User-Name = “MAC:xx.xx.xx.xx” Password = “secret” NAS-Port-Id = 1/1/4.1001.129 --> [FR] --> User-Name = “1/1/4.1001.129” Password = “secret” --> [ACS 5.3] Is there a solution for this option in the Freeradius? Is there a way to manipulate the User-Name sent from the service router, (MAC address), and change it to its NAS-Port-Id before it reaches the ACS RADIUS with help from the freeradius acting as a proxy? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Nas-Port-Id-as-username-tp5664812p5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Cisco WLC - Freeradius Vlan assigment problem
by Martin Silvero 25 Apr '12

25 Apr '12

We are modifying the Wireless acccess to our LAN. We are trying to use a Cisco WLC and our freeradius. We've been using this same freeradius for authenticating users against the corporate LDAP. Now we want WLC to talk to the radius server without losing any functionality like user authentication or vlan assignment. Our main problem is that the vlan assingment is not working when we use the WLC. The scenario with the APs talking to the radius directly works fine, but when we use lightweight AP and the WLC we can see that the vlan assignment part is skipped by the authentication process and all the users are sent to the same vlan. The following is the output of the two cases. One of them is a user authenticating without WLC, the AP talks directly to the Radius Server, and the other is an authentication where WLC talks to the Radius Server (the one that is not working) - 10.32.2.81 is the WLC IP address. - 10.32.2.39 is the AP IP address. WLC Soft Version: 7.0.116.0 These are the outputs: 1) AP - RADIUS (No WLC) ***************************************************** rad_recv: Access-Request packet from host 10.32.2.39 port 1645, id=205, length=184 User-Name = "fcanales" Framed-MTU = 1400 Called-Station-Id = "001d.4551.7da0" Calling-Station-Id = "5894.6b0d.e86c" Service-Type = Login-User Message-Authenticator = 0x46192e9a5e4720bd6c721e03d8e6c3b4 EAP-Message = 0x0208002b19001703010020f7e5545e9d9e05ecff5f8be2d1bc992eeddba82eb4adef509bded9dd6c132712 NAS-Port-Type = Wireless-802.11 NAS-Port = 59460 State = 0xf4160a33f11e13898255a02243c509d6 NAS-IP-Address = 10.32.2.39 NAS-Identifier = "ap-Reco32" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "fcanales", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - fcanales [peap] Got tunneled request EAP-Message = 0x0208000d016663616e616c6573 server { PEAP: Got tunneled identity of fcanales PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to fcanales Sending tunneled request EAP-Message = 0x0208000d016663616e616c6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "fcanales" Framed-MTU = 1400 Called-Station-Id = "001d.4551.7da0" Calling-Station-Id = "5894.6b0d.e86c" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 59460 NAS-IP-Address = 10.32.2.39 NAS-Identifier = "ap-Reco32" server inner-tunnel { +- entering group authorize {...} ++[preprocess] returns ok ++? if (!Huntgroup-Name) ? Evaluating !(Huntgroup-Name) -> FALSE ++? if (!Huntgroup-Name) -> FALSE ++? if (Huntgroup-Name == "list") ? Evaluating (Huntgroup-Name == "list") -> TRUE ++? if (Huntgroup-Name == "list") -> TRUE ++- entering if (Huntgroup-Name == "list") {...} +++? if (Ldap-Group == "WIFI-Direccion") rlm_ldap: Entering ldap_groupcmp() expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar expand: (uid=%u) -> (uid=fcanales) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (uid=fcanales) rlm_ldap: ldap_release_conn: Release Id: 0 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=fcanales)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (&(cn=WIFI-Direccion)(&(objectClass=posixGroup)(memberUid=fcanales))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group WIFI-Direccion not found or user is not a member. +++? if (Ldap-Group == "WIFI-MKTyCC") rlm_ldap: Entering ldap_groupcmp() expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=fcanales)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (&(cn=WIFI-Finanzas)(&(objectClass=posixGroup)(memberUid=fcanales))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group WIFI-Finanzas not found or user is not a member. +++? if (Ldap-Group == "WIFI-TyO") rlm_ldap: Entering ldap_groupcmp() expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=fcanales)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (&(cn=WIFI-TyO)(&(objectClass=posixGroup)(memberUid=fcanales))) rlm_ldap::ldap_groupcmp: User found in group WIFI-TyO rlm_ldap: ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "WIFI-TyO") -> TRUE +++? if (Ldap-Group == "WIFI-TyO") -> TRUE +++- entering if (Ldap-Group == "WIFI-TyO") {...} ++++[reply] returns ok +++- if (Ldap-Group == "WIFI-TyO") returns ok +++? if (Ldap-Group == "WIFI-ITfuncional") rlm_ldap: Entering ldap_groupcmp() expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=fcanales)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (&(cn=WIFI-Monit)(&(objectClass=posixGroup)(memberUid=fcanales))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group WIFI-Monit not found or user is not a member. ++- if (Huntgroup-Name == "list") returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "fcanales", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for fcanales [ldap] expand: (uid=%u) -> (uid=fcanales) [ldap] expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (uid=fcanales) [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3441313536383141373845384430414446424135364139373343343736374646 rlm_ldap: sambaLmPassword -> LM-Password == 0x4446323634314431373041414432333739433530313441453437313841374545 [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user fcanales authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "212" EAP-Message = 0x010900221a0109001d108279970f23460b83f1fffcc6e09626c56663616e616c6573 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x158baf111582b5a1fb3a126781117cd4 [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "212" EAP-Message = 0x010900221a0109001d108279970f23460b83f1fffcc6e09626c56663616e616c6573 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x158baf111582b5a1fb3a126781117cd4 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 205 to 10.32.2.39 port 1645 EAP-Message = 0x0109004b19001703010040640c0cb308474b42ecc083db0b3f47c66731a31c01801dde9b162f50d5bde13456412ab71e4d7d0e743b50cc42e91bba22dabeb375116f48b625e9691a3d3932 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf4160a33f21f13898255a02243c509d6 Finished request 38. ***************************************************** 2) WLC - RADIUS ***************************************************** rad_recv: Access-Request packet from host 10.32.2.81 port 32768, id=119, length=280 User-Name = "fcanales" Calling-Station-Id = "58-94-6b-0d-e8-6c" Called-Station-Id = "30-37-a6-4b-9f-90:IReconquista" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0a2002510000000f4eaaf051" NAS-IP-Address = 10.32.2.81 NAS-Identifier = "Iplan_wcs" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "60" EAP-Message = 0x0208002b190017030100200c857843d879e361aad79c8a2dccee6de8b04225d90b753a81b636a8090f0193 State = 0xcb0bb3aace03aab2864a9aacb255d323 Message-Authenticator = 0x62ca91e9e88fbba794e6e51db7aa67ec +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "fcanales", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - fcanales [peap] Got tunneled request EAP-Message = 0x0208000d016663616e616c6573 server { PEAP: Got tunneled identity of fcanales PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to fcanales Sending tunneled request EAP-Message = 0x0208000d016663616e616c6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "fcanales" Calling-Station-Id = "58-94-6b-0d-e8-6c" Called-Station-Id = "30-37-a6-4b-9f-90:IReconquista" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0a2002510000000f4eaaf051" NAS-IP-Address = 10.32.2.81 NAS-Identifier = "Iplan_wcs" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "60" server inner-tunnel { +- entering group authorize {...} ++[preprocess] returns ok ++? if (!Huntgroup-Name) ? Evaluating !(Huntgroup-Name) -> TRUE ++? if (!Huntgroup-Name) -> TRUE ++- entering if (!Huntgroup-Name) {...} +++[reply] returns ok ++- if (!Huntgroup-Name) returns ok ++? if (Huntgroup-Name == "list") (Attribute Huntgroup-Name was not found) ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "fcanales", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for fcanales [ldap] expand: (uid=%u) -> (uid=fcanales) [ldap] expand: dc=iplan,dc=com,dc=ar -> dc=iplan,dc=com,dc=ar rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iplan,dc=com,dc=ar, with filter (uid=fcanales) [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3441313536383141373845384430414446424135364139373343343736374646 rlm_ldap: sambaLmPassword -> LM-Password == 0x4446323634314431373041414432333739433530313441453437313841374545 [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user fcanales authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "249" EAP-Message = 0x010900221a0109001d10cc9cc5bb2b5812cf48051342472ad3af6663616e616c6573 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab42e29bab4bf81ef23bc50dea94c334 [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "249" EAP-Message = 0x010900221a0109001d10cc9cc5bb2b5812cf48051342472ad3af6663616e616c6573 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab42e29bab4bf81ef23bc50dea94c334 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 119 to 10.32.2.81 port 32768 EAP-Message = 0x0109004b1900170301004075cf3c75c7a8311c01bc5581aac330e49586ce6e0001e8add345d7773aeeacba61b235c462fe0966e565d9e6279f111bf94fa3d8a4bff8a4ce82ab24d65f9c31 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb0bb3aacd02aab2864a9aacb255d323 Finished request 48. Going to the next request Waking up in 4.9 seconds. ***************************************************** Thanks for all. -- -- Silvero Martin

2 1

Assign VLAN from freeradius to Cisco 3550 switch.
by Wassim Zaarour 25 Apr '12

25 Apr '12

Hi all, I know this subject have been brought up but I'm kind of stuck and I hope I can get a little help. I am trying to assign vlans from freeradius to a cisco 3550 switch but its not working. I keep getting the following in the debug in the switch: 3w6d: RADIUS: Tunnel-Medium-Type [65] 6 01:Unsupported [6] 3w6d: RADIUS: Tunnel-Type [64] 6 01:Unsupported [13] I read the mail archives and googled with no luck. Users file configuration: wassim Cleartext-Password := "wassim" Tunnel-Medium-Type:1 = IEEE-802, Tunnel-Type:1 = VLAN, Tunnel-Private-Group-Id:1 = 100 Switch debug log: 3w6d: RADIUS(00000000): Send Access-Request to 192.168.1.57:1812 id 1645/122, len 460 3w6d: RADIUS: authenticator 34 D8 18 38 24 86 99 F6 - 69 03 2C EB E2 8A F4 79 3w6d: RADIUS: NAS-IP-Address [4] 6 192.168.1.8 3w6d: RADIUS: NAS-Port [5] 6 50023 3w6d: RADIUS: NAS-Port-Type [61] 6 Eth [15] 3w6d: RADIUS: User-Name [1] 8 "wassim" 3w6d: RADIUS: Called-Station-Id [30] 19 "00-15-F9-F8-4E-97" 3w6d: RADIUS: Calling-Station-Id [31] 19 "00-1A-80-3F-F6-A1" 3w6d: RADIUS: Service-Type [6] 6 Framed [2] 3w6d: RADIUS: Framed-MTU [12] 6 1500 3w6d: RADIUS: State [24] 18 3w6d: RADIUS: DB C1 1C E7 DF C4 09 5E 75 5E 5B 0F 23 3A 54 E7 [???????^u^[?#:T?] 3w6d: RADIUS: EAP-Message [79] 255 3w6d: RADIUS: 02 05 01 44 15 00 16 03 01 01 06 10 00 01 02 01 [???D????????????] 3w6d: RADIUS: 00 A5 F6 DC 7F B9 4A 99 44 84 66 ED D5 4D CA F5 [??????J?D?f??M??] 3w6d: RADIUS: 58 95 5F 5C CC FA E7 C3 B5 54 DB 01 C1 CA E1 62 [X?_\?????T?????b] 3w6d: RADIUS: 96 BF C1 E8 26 84 7C BF 56 7E 6A 9D 41 8C 0E 5C [????&?|?V~j?A??\] 3w6d: RADIUS: E3 46 DC BE 33 38 28 7A 35 50 7D 7A 32 F8 A0 55 [?F??38(z5P}z2??U] 3w6d: RADIUS: 62 63 9B D1 15 8B C8 DC 97 D0 A3 DC 27 19 00 A0 [bc??????????'???] 3w6d: RADIUS: 61 CB C8 EC FA 02 EF 39 D8 5B CF CC 45 45 BF 08 [a??????9?[??EE??] 3w6d: RADIUS: C8 9E E5 87 70 DD 61 75 56 A5 B1 B6 B2 BA FC 3F [????p?auV???????] 3w6d: RADIUS: FD A7 AC 37 DE DC 16 43 85 E9 ED 39 59 21 E5 19 [???7???C???9Y!??] 3w6d: RADIUS: 97 58 6D BC 3E B6 2C B5 BE 58 56 89 94 0B 70 B5 [?Xm?>?,??XV???p?] 3w6d: RADIUS: 49 F8 49 36 D7 B0 A8 44 10 A8 6F 05 B9 94 19 AB [I?I6???D??o?????] 3w6d: RADIUS: 0C 52 00 4F BE D0 0D 99 56 12 B7 76 DF 07 04 C9 [?R?O????V??v????] 3w6d: RADIUS: 85 54 8D 3D E4 53 0C AF 49 15 CC D6 AD 02 62 43 [?T?=?S??I?????bC] 3w6d: RADIUS: 41 39 B8 1A 2F F0 40 09 93 BE 87 FD D9 CD AB 74 [A9??/?@????????t] 3w6d: RADIUS: F7 34 66 32 CC 87 4A 0B A7 3E 81 B1 F4 E4 EB 21 [?4f2??J??>?????!] 3w6d: RADIUS: DF 6F CD FF 9B 8A E6 87 A0 3B 3E B6 64 [?o???????;>?d] 3w6d: RADIUS: EAP-Message [79] 73 3w6d: RADIUS: E6 CB 54 03 10 69 D4 D2 7C D1 FA 89 72 F8 0C 53 [??T??i??|???r??S] 3w6d: RADIUS: 1B 78 32 E7 14 03 01 00 01 01 16 03 01 00 28 EA [?x2???????????(?] 3w6d: RADIUS: 0B 2A A9 64 DE 57 6A 65 89 EA 19 63 4B 60 67 C8 [?*?d?Wje???cK`g?] 3w6d: RADIUS: CF C9 FF A2 A7 26 33 A5 C0 D0 CB 3C 01 F2 C5 96 [?????&3????<????] 3w6d: RADIUS: 38 65 0C 1F 39 1C 6F [8e??9?o] 3w6d: RADIUS: Message-Authenticato[80] 18 3w6d: RADIUS: FD AE 24 12 A9 F3 A5 BA F3 6D 60 52 F8 E0 D3 53 [??$??????m`R???S] 3w6d: RADIUS: Received from id 1645/122 192.168.1.57:1812, Access-Challenge, len 119 3w6d: RADIUS: authenticator 57 E5 06 9F DD C4 E2 76 - E8 37 92 F1 C4 21 22 6B 3w6d: RADIUS: EAP-Message [79] 63 3w6d: RADIUS: 01 06 00 3D 15 80 00 00 00 33 14 03 01 00 01 01 [???=?????3??????] 3w6d: RADIUS: 16 03 01 00 28 87 23 7C B0 31 42 D1 B4 48 4A 89 [????(?#|?1B??HJ?] 3w6d: RADIUS: AB F3 22 51 D2 40 36 C9 45 DD 35 11 31 3C EF 59 [??"Q?@6?E?5?1<?Y] 3w6d: RADIUS: 86 B0 D3 D4 26 E3 58 DC E3 0F 76 3E 4A [????&?X???v>J] 3w6d: RADIUS: Message-Authenticato[80] 18 3w6d: RADIUS: 49 9B 71 F9 9B 0C 53 BD D2 3D 20 79 8D F1 7F 9B [I?q???S??= y????] 3w6d: RADIUS: State [24] 18 3w6d: RADIUS: DB C1 1C E7 DE C7 09 5E 75 5E 5B 0F 23 3A 54 E7 [???????^u^[?#:T?] 3w6d: RADIUS: EAP-login: length of eap packet = 61 3w6d: RADIUS: EAP-login: got challenge from radius 3w6d: RADIUS: Pick NAS IP for u=0x178E4C0 tableid=0 cfg_addr=0.0.0.0 3w6d: RADIUS: ustruct sharecount=1 3w6d: Radius: radius_port_info() success=1 radius_nas_port=1 3w6d: RADIUS: EAP-login: length of radius packet = 201 code = 1 3w6d: RADIUS(00000000): Send Access-Request to 192.168.1.57:1812 id 1645/123, len 201 3w6d: RADIUS: authenticator 99 15 53 A6 AB B7 0B 75 - 9F A7 5F 27 8F F1 2E 67 3w6d: RADIUS: NAS-IP-Address [4] 6 192.168.1.8 3w6d: RADIUS: NAS-Port [5] 6 50023 3w6d: RADIUS: NAS-Port-Type [61] 6 Eth [15] 3w6d: RADIUS: User-Name [1] 8 "wassim" 3w6d: RADIUS: Called-Station-Id [30] 19 "00-15-F9-F8-4E-97" 3w6d: RADIUS: Calling-Station-Id [31] 19 "00-1A-80-3F-F6-A1" 3w6d: RADIUS: Service-Type [6] 6 Framed [2] 3w6d: RADIUS: Framed-MTU [12] 6 1500 3w6d: RADIUS: State [24] 18 3w6d: RADIUS: DB C1 1C E7 DE C7 09 5E 75 5E 5B 0F 23 3A 54 E7 [???????^u^[?#:T?] 3w6d: RADIUS: EAP-Message [79] 69 3w6d: RADIUS: 02 06 00 43 15 00 17 03 01 00 38 BF 71 FC FA 04 [???C??????8?q???] 3w6d: RADIUS: BE DC FD CC 03 D2 7F 8B 09 63 2C B2 AE D8 AC 61 [?????????c,????a] 3w6d: RADIUS: 64 21 2B 00 ED 0E 6E E8 B0 49 50 6B 99 B8 88 A4 [d!+???n??IPk????] 3w6d: RADIUS: 36 C6 FD B9 F0 77 2D 82 28 0A 37 D1 D4 73 B4 59 [6????w-?(?7??s?Y] 3w6d: RADIUS: F9 37 E6 [?7?] 3w6d: RADIUS: Message-Authenticato[80] 18 3w6d: RADIUS: A2 59 A3 DE A6 98 5F 78 25 12 59 BB 4D B8 74 F0 [?Y????_x??Y?M?t?] 3w6d: RADIUS: Received from id 1645/123 192.168.1.57:1812, Access-Accept, len 186 3w6d: RADIUS: authenticator C0 31 7F D7 A6 D4 1F C8 - 27 AA F0 99 EA 1F 92 C3 3w6d: RADIUS: Tunnel-Medium-Type [65] 6 01:Unsupported [6] 3w6d: RADIUS: Tunnel-Type [64] 6 01:Unsupported [13] 3w6d: RADIUS: Tunnel-Private-Group[81] 6 01:"100" 3w6d: RADIUS: Vendor, Microsoft [26] 58 3w6d: RADIUS: MS-MPPE-Recv-Key [17] 52 3w6d: RADIUS: 86 8B 3E 74 76 E7 CB 9A 8F EF F5 9C 16 2E 88 1A [??>tv????????.??] 3w6d: RADIUS: 12 3B 80 A6 E9 9B B6 6F E6 63 C8 AA B0 DB 0E 76 [?;?????o?c?????v] 3w6d: RADIUS: 61 C1 6A 5D 62 BD 72 BE 78 C8 9D 4D A7 3F 54 35 [a?j]b?r?x??M??T5] 3w6d: RADIUS: 40 DC [@?] 3w6d: RADIUS: Vendor, Microsoft [26] 58 3w6d: RADIUS: MS-MPPE-Send-Key [16] 52 3w6d: RADIUS: 8A 61 97 87 78 FD CA 16 8D F0 ED 75 C0 70 93 AE [?a??x??????u?p??] 3w6d: RADIUS: 71 EF 5A 21 53 35 A4 88 F9 84 16 83 10 43 6E 9E [q?Z!S5???????Cn?] 3w6d: RADIUS: AB A7 8B 56 6C 42 0D AB 09 1D 82 D3 CB 7E 6C B8 [???VlB???????~l?] 3w6d: RADIUS: 56 58 [VX] 3w6d: RADIUS: EAP-Message [79] 6 3w6d: RADIUS: 03 06 00 04 [????] 3w6d: RADIUS: Message-Authenticato[80] 18 3w6d: RADIUS: 82 4B 64 0F 07 64 59 18 0F 27 07 95 A5 15 09 33 [?Kd??dY??'?????3] 3w6d: RADIUS: User-Name [1] 8 "wassim" 3w6d: RADIUS: EAP-login: length of eap packet = 4 3w6d: RADIUS: Tunnel-MType, [01] 00 00 06 3w6d: RADIUS: TAS(1) created and enqueued. 3w6d: RADIUS: Tunnel-Type, [01] 00 00 0D 3w6d: RADIUS: Tunnel-GID, [01] 100 3w6d: RADIUS: unrecognized Microsoft VSA type 17 3w6d: RADIUS: unrecognized Microsoft VSA type 16 3w6d: RADIUS: TAS(1) takes precedence over tagged attributes, tunnel_type=vlan 3w6d: RADIUS: free TAS(1) 3w6d: RADIUS: no appropriate authorization type for user. 3w6d: RADIUS: Tunnel-MType, [01] 00 00 06 3w6d: RADIUS: TAS(1) created and enqueued. 3w6d: RADIUS: Tunnel-Type, [01] 00 00 0D 3w6d: RADIUS: unrecognized Microsoft VSA type 17 3w6d: RADIUS: unrecognized Microsoft VSA type 16 3w6d: RADIUS: TAS(1) takes precedence over tagged attributes, tunnel_type=vlan 3w6d: RADIUS: free TAS(1) 3w6d: RADIUS: no appropriate authorization type for user. 3w6d: RADIUS: Tunnel-MType, [01] 00 00 06 3w6d: RADIUS: TAS(1) created and enqueued. 3w6d: RADIUS: Tunnel-Type, [01] 00 00 0D 3w6d: RADIUS: unrecognized Microsoft VSA type 17 3w6d: RADIUS: unrecognized Microsoft VSA type 16 3w6d: RADIUS: TAS(1) takes precedence over tagged attributes, tunnel_type=vlan 3w6d: RADIUS: free TAS(1) 3w6d: RADIUS: no appropriate authorization type for user. 3w6d: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to up

5 11