- Freeradius-Users - lists.freeradius.org

freeradius v.2.0.1 and Cisco 1200AP IOS V.12.3
by Dave Cummings 05 Feb '08

05 Feb '08

Greetings I have been working with freeradius v.2.0.1 and a Cisco 1200 Series Access Point (version 12.3 IOS) for many months now with no success to getting this working. I am doing research on freeradius product for a univeristy campus that I go to for implementation in the near future. I am out of ideas of how to configure this correctly. I still to this day do not have my Cisco 1200 AP authenticating with freeradius version 2.0.1. Does anyone have a configuration setup of this type of scheme or are willing to tell me how to start from ground up to make this work. My plan is simple at this point. I want to use freeradius, a Cisco 1200 Series Access Point, and one windows xp pro client to connect to the AP and authenticate against freeradius. I appreciate any input on this matter. Thanks again open source community. Dave _________________________________________________________________ Shed those extra pounds with MSN and The Biggest Loser! http://biggestloser.msn.com/

4 4

wiki
by Phil Mayers 05 Feb '08

05 Feb '08

I assume account creation is deliberately disabled on the wiki; could whoever runs/has access create me one?

2 1

Re: FreeRADIUS and RSA RADIUS Server
by David Mitton 05 Feb '08

05 Feb '08

1 0

Cisco 1200 AP
by John Melton 05 Feb '08

05 Feb '08

I have configured a Cisco 1200 AP for WPA2-PSK which is working with a wireless device able to connect OK. I have tried to add MAC authentication using the FreeRadius server, but have not been able to get it working. I can see from the FreeRadius log that the AP is sending the Access-Request packet and an Access-Accept response is being returned but the wireless device is unable to connect. Has anyone setup this configuration and got it working? Regards, John

3 4

Attributes sent to proxy servers ...
by Arran Cudbard-Bell 05 Feb '08

05 Feb '08

Hi, Noticed with CVS head that all attributes (including internal ones) appear to be getting proxied. Is this just a cosmetic thing ? Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221(a)loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313035 Proxying request 60 to home server 194.82.174.185 port 1812 Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221(a)loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Stripped-User-Name = "ac221(a)loopback.sussex.ac.uk" Realm = "jrs" EAP-Type = PEAP Called-Station-SSID = "" Packet-Src-Ip-Address-Oct1 = 139 Packet-Src-Ip-Address-Oct2 = 184 Packet-Src-Ip-Address-Oct3 = 8 Packet-Src-Ip-Address-Oct4 = 16 SS-Flags = "0100000000" NAS-Flags = "010010110000000" Supplicant-Flags = "0001000000" SQL-User-Name = "ac221(a)loopback.sussex.ac.uk" Realm = "jrs" Proxy-State = 0x313035 Going to the next request Thanks Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 8

Re: Quick question RE: FreeRADIUS Trusted Root CA List
by Cerney, Lawrence 05 Feb '08

05 Feb '08

Thanks Sebastian, Moving all the Trusted CA's into one file, as you suggested, fixed my problem. I still only use one server-cert. I have been testing with different sized user-certs signed by CA's of various sizes. That's the reason for the 8 different CA's. It would be the same if I wanted to authenticate user-certs signed by different commercial certificate vendors. Again thanks Larry To trust more than one CA, you simply have to copy all the root-certificates into one file: for example: CA_file = /etc/1x/trustedcas.pem I tested this with 3 CAs, and it works. Do you really need 8 different server-certificates? So, how should the server decide which certificate he must send the client? Sebastian -- Psssst! Schon vom neuen GMX MultiMessenger geh?rt? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger - This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

3 2

Error on radius
by Ackbar Joolia 05 Feb '08

05 Feb '08

Hi, I am getting this error in my radius log, do you know why this is so and how to get this resolved? 'The maximum number of threads (32) are active, cannot spawn new thread to handle request' Also, do people know what is the maximum simultaneous incoming authentication calls that the radius process can handle? Or what ways can be adopted to deal with this? Thanks Ackbar No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

7 17

Quick question RE: FreeRADIUS Trusted Root CA List
by Cerney, Lawrence 04 Feb '08

04 Feb '08

I work in a test environment and need to test with certs created with different CA's. I haven't been able to get more than one CA at a time to work. I've got 8 CA's and I need to keep 7 commented out for the certs to authenticate. The question is can FreeRADIUS support more than one CA at a time, and if so how? FreeRADIUS 1.0.0-Pre3 tls { private_key_password = password private_key_file = /etc/1x/freeradius.pem #private_key_file = /etc/1x/server512.pem #private_key_file = /etc/1x/server1024.pem #private_key_file = /etc/1x/server1024v3.pem #private_key_file = /etc/1x/server1536.pem #private_key_file = /etc/1x/server2048.pem #private_key_file = /etc/1x/server4096.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = /etc/1x/freeradius.pem #certificate_file = /etc/1x/server512.pem #certificate_file = /etc/1x/server1024.pem #certificate_file = /etc/1x/server1024v3.pem #certificate_file = /etc/1x/server1536.pem #certificate_file = /etc/1x/server2048.pem #certificate_file = /etc/1x/server4096.pem # Trusted Root CA list CA_file = /etc/1x/FlukeNetWotter.pem #CA_file = /usr/local/etc/raddb/certs/PV_512_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_768_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1024_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1280_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1536_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1792_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_2048_CA.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random thanks... Larry This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

3 2

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy(forward) request as PAP
by Joakim Lindgren 04 Feb '08

04 Feb '08

Hi again and thanks, EAP-TTLS/PAP is the defaultI tried configuring the TTLS-PAP inner and outer tunnel but it will not work. EAP-TTLS/PAP ended A. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "OTHER" (LOCAL) domain then the EAP-TTLS tunnel is ended and validated against the LDAP. PAP Tunneled (proxied) B. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "SECURSERVER" domain then the EAP-TTLS tunnel is ended and PAP is proxied to other Radius (Nr 2) Sincerely Joakim

6 16

Monitoring Tool for Freeradius
by Julian Stöver 04 Feb '08

04 Feb '08

Hello, is there any monitoring tool for freeradius or another possibility to see how many people are logged in and to do some other stuff? like the monitoring tool for openvpn? Would be nice if there's something avaible! bye! julian

7 25