- Freeradius-Users - lists.freeradius.org

Re: Proxy issue - Failing proxied request for user error
by James Wood 21 Jul '19

21 Jul '19

Found it. I checked `cat /proc/net/udp` and could see some packets being dropped in the UDP buffer queue; and whilst monitoring the dropped packets we're seeing from the clients, the numbers were going up in line with this. So I increased the `net.core.rmem` and `net.core.wmem` values a little on the server via sysctl, to increase the default UDP buffer size which has stopped the timeouts from occurring. I guess out the box the server has am appropriate value for the UDP buffer queue but when using FreeRADIUS it fills it up if there's enough traffic (and its all UDP) and then the kernel starts dropping packets. Whist I appreciate it's not FreeRADIUS related, is there any advice around the best sysctl values to use for a large FreeRADIUS server? Has anyone come across this before? Thanks J

3 5

Subject: First time run failure - magic number mismatch
by Jiuyu Sun 19 Jul '19

19 Jul '19

Hi, I am trying to install Freeradius from source on a Linux machine. When I run radiusd -X, I got the following error: $ sudo radiusd -X radiusd: Application and libfreeradius-radius magic number (version) mismatch. application: 30020c library: 30020f Thank you!

2 3

redis_ippool_tool is not supporting password authentication
by Chinnapaiyan, Nagamani 19 Jul '19

19 Jul '19

Hi, I have a redis server on AWS with auth token enabled. I am trying to add some ip pools in the db via rlm_redis_ippool_tool command. However, this command does not work for this auth enabled redis db. $ cat redis_ippool redis { server = <server_ip> port = 6379 password = <pass> } $ /usr/local/bin/rlm_redis_ippool_tool -a 10.88.112.3-10.88.112.62 -f redis_ippool TESTPOOL Error : Need pool to operate on $ /usr/local/bin/rlm_redis_ippool_tool -a 10.88.112.3-10.88.112.62 -f redis_ippool <server_ip>:6379 TESTPOOL $ echo $? 1 $ redis-cli -c -h <server_ip> -p 6379 -a <pass> Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe. localhost:6379> keys * (empty list or set) localhost:6379> exit Regards, Nagamani Chinnapaiyan

2 2

Please tell me about rewrite_called_station_id.
by Yuya Yanagi 19 Jul '19

19 Jul '19

Hi,All Please tell me about rewrite_called_station_id. The description of rewrite_called_station_id was written to the authorize section of sites-available / default and sites-available / inner-tunnel to obtain a Called-Station-SSID to control the approval process. However, although the default file side could obtain the value of Called-Station-SSID, the process of rewrite_called_station_id became FALSE in the internal tunnel file, and the value of Called-Station-SSID could not be obtained. Since I am using EAP-TTLS authentication, I want to set the inner tunnel to branch control, but I can not use it. If you have any advice, please let me know. y.y ------------Debug log--------- Fri Jul 19 15:52:16 2019 : Debug: (0) Using Post-Auth-Type Challenge Fri Jul 19 15:52:16 2019 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Fri Jul 19 15:52:16 2019 : Debug: (0) Challenge { ... } # empty sub-section is ignored Fri Jul 19 15:52:16 2019 : Debug: (0) session-state: Nothing to cache Fri Jul 19 15:52:16 2019 : Debug: (0) Sent Access-Challenge Id 68 from 133.15.18.14:1812 to 133.15.250.241:60211 length 0 Fri Jul 19 15:52:16 2019 : Debug: (0) EAP-Message = 0x010200061520 Fri Jul 19 15:52:16 2019 : Debug: (0) Message-Authenticator = 0x00000000000000000000000000000000 Fri Jul 19 15:52:16 2019 : Debug: (0) State = 0x68f31ff968f10ae77b5c26c718e1463c Fri Jul 19 15:52:16 2019 : Debug: (0) Finished request Fri Jul 19 15:52:16 2019 : Debug: Waking up in 4.9 seconds. Fri Jul 19 15:52:16 2019 : Debug: (1) Received Access-Request Id 70 from 133.15.250.241:60211 to 133.15.18.14:1812 length 279 Fri Jul 19 15:52:16 2019 : Debug: (1) User-Name = "anonymous" Fri Jul 19 15:52:16 2019 : Debug: (1) NAS-IP-Address = 10.254.0.241 Fri Jul 19 15:52:16 2019 : Debug: (1) NAS-Port = 12289 Fri Jul 19 15:52:16 2019 : Debug: (1) Called-Station-Id = "08-35-71-F2-CE-05:authtest" Fri Jul 19 15:52:16 2019 : Debug: (1) Calling-Station-Id = "50-3E-AA-6D-ED-7E" Fri Jul 19 15:52:16 2019 : Debug: (1) Framed-MTU = 1250 Fri Jul 19 15:52:16 2019 : Debug: (1) NAS-Port-Type = Wireless-802.11 Fri Jul 19 15:52:16 2019 : Debug: (1) Framed-Compression = None Fri Jul 19 15:52:16 2019 : Debug: (1) Connect-Info = "CONNECT 802.11g" Fri Jul 19 15:52:16 2019 : Debug: (1) Chargeable-User-Identity = 0x00 Fri Jul 19 15:52:16 2019 : Debug: (1) EAP-Message = 0x0202007115800000006716030100620100005e03015d31689fbadf8aadd98de6c61bd2a31c53b8b1185935160dd336d01fa44c5e86000018c014c0130035002fc00ac00900380032000a0013000500040100001d000a0006000400170018000b000201000023000000170000ff01000100 Fri Jul 19 15:52:16 2019 : Debug: (1) State = 0x68f31ff968f10ae77b5c26c718e1463c Fri Jul 19 15:52:16 2019 : Debug: (1) Message-Authenticator = 0x9047a006c6a06a8e05c854228e8a472e Fri Jul 19 15:52:16 2019 : Debug: (1) session-state: No cached attributes Fri Jul 19 15:52:16 2019 : Debug: (1) # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jul 19 15:52:16 2019 : Debug: (1) authorize { Fri Jul 19 15:52:16 2019 : Debug: (1) policy rewrite_called_station_id { Fri Jul 19 15:52:16 2019 : Debug: (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { Fri Jul 19 15:52:16 2019 : Debug: No matches Fri Jul 19 15:52:16 2019 : Debug: Adding 9 matches Fri Jul 19 15:52:16 2019 : Debug: (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> TRUE Fri Jul 19 15:52:16 2019 : Debug: (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { Fri Jul 19 15:52:16 2019 : Debug: (1) update request { Fri Jul 19 15:52:16 2019 : Debug: (1) 1/9 Found: 08 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 2/9 Found: 35 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 3/9 Found: 71 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 4/9 Found: F2 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 5/9 Found: CE (3) Fri Jul 19 15:52:16 2019 : Debug: (1) 6/9 Found: 05 (3) Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} Fri Jul 19 15:52:16 2019 : Debug: (1) --> 08-35-71-F2-CE-05 Fri Jul 19 15:52:16 2019 : Debug: (1) &Called-Station-Id := 08-35-71-F2-CE-05 Fri Jul 19 15:52:16 2019 : Debug: (1) Overwriting value "08-35-71-F2-CE-05:authtest" with "08-35-71-F2-CE-05" Fri Jul 19 15:52:16 2019 : Debug: (1) } # update request = noop Fri Jul 19 15:52:16 2019 : Debug: (1) if ("%{8}") { Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND TMPL XLAT STRUCT Fri Jul 19 15:52:16 2019 : Debug: (1) 8/9 Found: authtest (9) Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND %{8} Fri Jul 19 15:52:16 2019 : Debug: (1) --> authtest Fri Jul 19 15:52:16 2019 : Debug: (1) if ("%{8}") -> TRUE Fri Jul 19 15:52:16 2019 : Debug: (1) if ("%{8}") { Fri Jul 19 15:52:16 2019 : Debug: (1) update request { Fri Jul 19 15:52:16 2019 : Debug: (1) 8/9 Found: authtest (9) Fri Jul 19 15:52:16 2019 : Debug: (1) EXPAND %{8} Fri Jul 19 15:52:16 2019 : Debug: (1) --> authtest Fri Jul 19 15:52:16 2019 : Debug: (1) &Called-Station-SSID := authtest Fri Jul 19 15:52:16 2019 : Debug: (1) } # update request = noop Fri Jul 19 15:52:16 2019 : Debug: (1) } # if ("%{8}") = noop Fri Jul 19 15:52:16 2019 : Debug: (1) modsingle[authorize]: calling updated (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (1) modsingle[authorize]: returned from updated (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (1) [updated] = updated Fri Jul 19 15:52:16 2019 : Debug: (1) } # if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) = updated Fri Jul 19 15:52:16 2019 : Debug: (1) ... skipping else: Preceding "if" was taken Fri Jul 19 15:52:16 2019 : Debug: (1) } # policy rewrite_called_station_id = updated ...... Fri Jul 19 15:52:16 2019 : Debug: (5) session-state: No State attribute Fri Jul 19 15:52:16 2019 : Debug: (5) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Fri Jul 19 15:52:16 2019 : Debug: (5) authorize { Fri Jul 19 15:52:16 2019 : Debug: (5) policy rewrite_called_station_id { Fri Jul 19 15:52:16 2019 : Debug: (5) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { Fri Jul 19 15:52:16 2019 : Debug: (5) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE Fri Jul 19 15:52:16 2019 : Debug: (5) else { Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling noop (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from noop (rlm_always) Fri Jul 19 15:52:16 2019 : Debug: (5) [noop] = noop Fri Jul 19 15:52:16 2019 : Debug: (5) } # else = noop Fri Jul 19 15:52:16 2019 : Debug: (5) } # policy rewrite_called_station_id = noop Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling mschap (rlm_mschap) Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from mschap (rlm_mschap) Fri Jul 19 15:52:16 2019 : Debug: (5) [mschap] = noop Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling suffix (rlm_realm) Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Checking for suffix after "@" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: No '@' in User-Name = "rt015", looking up realm NULL Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Found realm "NULL" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Adding Stripped-User-Name = "rt015" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Adding Realm = "NULL" Fri Jul 19 15:52:16 2019 : Debug: (5) suffix: Authentication realm is LOCAL Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from suffix (rlm_realm) Fri Jul 19 15:52:16 2019 : Debug: (5) [suffix] = ok Fri Jul 19 15:52:16 2019 : Debug: (5) update control { Fri Jul 19 15:52:16 2019 : Debug: (5) &Proxy-To-Realm := LOCAL Fri Jul 19 15:52:16 2019 : Debug: (5) } # update control = noop Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: calling eap (rlm_eap) Fri Jul 19 15:52:16 2019 : Debug: (5) eap: No EAP-Message, not doing EAP Fri Jul 19 15:52:16 2019 : Debug: (5) modsingle[authorize]: returned from eap (rlm_eap) Fri Jul 19 15:52:16 2019 : Debug: (5) [eap] = noop

2 1

FreeRadius replaces characters in '%{User-Password}' after upgrade 3.0.16->3.0.19
by belyj＠belyj.eu 18 Jul '19

18 Jul '19

Hello. After upgrade from 3.0.16 to 3.0.19 freeradius is replacing characters in mysql queries. (76475085) Tue Jul 16 16:16:06 2019: Debug: Received Access-Request Id 54 from length 126 (76475085) Tue Jul 16 16:16:06 2019: Debug: NAS-Identifier = "XXXX" (76475085) Tue Jul 16 16:16:06 2019: Debug: User-Password = "p6suf+FyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=" query ... xxx.value = '%{User-Password}' AND ... (76475085) Tue Jul 16 16:16:06 2019: Debug: sql3: Executing select query: SELECT ... xxx.value = 'p6suf=2BFyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=3D' AND ... \+ is replaced and =3D added at the end. `p6suf+FyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=` `p6suf=2BFyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=3D` radiusd: FreeRADIUS Version 3.0.19 (git #1156b5361), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.19 On 3.0.16 same config, same query, password is not changed. Any help would be appreciated. Andrzej

5 9

linelog
by Bassem Mettichi 18 Jul '19

18 Jul '19

Hello, please could you tell me how to use linelog module to log accounting requets instead of detail module? i have enabled the module linelog on default file section accounting and disabled detail module but after sending packets i didn't see any log : accounting { # Update accounting packet by adding the CUI attribute # recorded from the corresponding Access-Accept # use it only if your NAS boxes do not support CUI themselves # cui # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. # detail # daily linelog Thanks Bassem

1 0

Error while trying to just accept user in inner tunnel
by Alberto Martínez Setién 18 Jul '19

18 Jul '19

Hi all, While doing EAP-TTLS-PAP I am trying to have an unknown user get accepted anyway in order to get him into a captive portal. Relevant config is: if (&User-Name && &User-Password) { > update control { > Tmp-String-0 := "%{sql_oracle_dscorp:SELECT > swi_wi.pkg_wifi.f_get_username_code('%{User-Name}') FROM DUAL}" > } > > if (&control:Tmp-String-0 != '') { > update control { > Password-With-Header := > &control:Tmp-String-0 > } > } > else { > update reply { > Filter-Id := 'rol-invitado-logon' > } > > accept > } > } > Unfortunately, I can't apparently accept the user in the authorize section. (7) Virtual server sending reply > (7) Filter-Id := "rol-invitado-logon" > (7) eap_ttls: Tunneled authentication will be proxied to LOCAL > (7) eap: WARNING: Tunneled session will be proxied. Not doing EAP > (7) [eap] = handled > (7) } # authenticate = handled > (7) WARNING: Cancelling proxy as no home pool exists > (7) There was no response configured: rejecting request > (7) Using Post-Auth-Type Reject > What I might be missing? Regards, Alberto

3 3

Confused about ssl caching
by Sven Hartge 18 Jul '19

18 Jul '19

Hello all! I am using freeradius 3.0.17 (waiting on .19 is on the testbed right now) and I am a bit confused about the ssl cache. I am authentication users in WiFi against LDAP (as a database, i.e. the correct way) and also assigning VLANs based on the UserClass, all working fine: if ( "%{toupper:%{control:GIFB-UserClass[*]}}" =~ /(M|P|A|R)/ ) { update reply { &Tunnel-Type = "VLAN" &Tunnel-Medium-Type = "IEEE-802" &Tunnel-Private-Group-id = "701" &Aruba-User-Vlan = 701 } updated } else { update reply { &Tunnel-Type = "VLAN" &Tunnel-Medium-Type = "IEEE-802" &Tunnel-Private-Group-id = "700" &Aruba-User-Vlan = 700 } updated } GIFB-UserClass is a local attribute pulled from LDAP. This works fine, no problems here. Now: in tls-common it says: # The "Cached-Session-Policy" is the name of a # policy which should be applied to the cached # session. This policy can be used to assign # VLANs, IP addresses, etc. It serves as a useful # way to re-apply the policy from the original # Access-Accept to the subsequent Access-Accept # for the cached session. Here is where my confusion starts and searching the web and the list archive only increased it. Do *I* need to do anything here to get the correct VLAN to the user on session resumption or is it just *magic* and will work automagically? Or do I need to add the Xeap.authenticate and Xeap.authorize policies somewhere? I'd like to understand the mechanism before playing with it. Grüße, Sven.

3 6

RE: Proxy issue - Failing proxied request for user error
by James Wood 17 Jul '19

17 Jul '19

There is no firewall on the box itself (all UDP to 1812/1813 open publicly) and the strange thing is that the majority of packets are handled fine by FreeRADIUS (the ones that reach the daemon). So, it appears although tcdump and radsniff shows the packet arriving, it never gets to FreeRADIUS for some reason. radsniff log (filtered for `norsp`) norsp,7798,2019-07-16 23:08:43.462979,,Accounting-Request,ens4,1.2.3.4,41060,10.11.12.13,1813,125,"2a19172c7fc7" norsp,7799,2019-07-16 23:08:43.463001,,Accounting-Request,ens4,1.2.3.4,36239,10.11.12.13,1813,13,"63b8136755ec" norsp,7800,2019-07-16 23:08:43.463112,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,125,"033c1a03cbdd" norsp,7801,2019-07-16 23:08:43.463159,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,241,"b9790286e557" norsp,7802,2019-07-16 23:08:43.463331,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,66,"710250b69ee0" norsp,7803,2019-07-16 23:08:43.463454,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,208,"b940c9c76e96" norsp,7804,2019-07-16 23:08:43.463632,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,187,"5ca284fb563e" norsp,9042,2019-07-16 23:08:45.972261,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,218,"2f5a67f71993" norsp,9043,2019-07-16 23:08:45.972353,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,13,"5e26718c4442" norsp,9044,2019-07-16 23:08:45.972406,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,15,"273bcbb553c8" norsp,9045,2019-07-16 23:08:45.972514,,Accounting-Request,ens4,1.2.3.4,36239,10.11.12.13,1813,113,"b84e7246b3e3" norsp,12595,2019-07-16 23:08:49.990914,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,51,"51683f17d039" So they DO reach the server, but DONT get processed for some reason. Server is a Google Cloud compute VM instance utilising an Intel Xeon E5 v4 (Broadwell) @ 2.8GHz with 16GB RAM Thanks J

2 1

Proxy issue - Failing proxied request for user error
by James Wood 17 Jul '19

17 Jul '19

Dear Group, We have a proxy-based setup but need advice on dropped proxy requests. We were running on 3.0.12 and upgraded to 3.0.19 but not change in behaviour. It's a simple one to one proxy, so packets come in to an external RADIUS server (public IP) and traffic is proxied to an internal one. We are seeing random errors for accounting packets but I can't figure out why. I ran a tcpdump on both sides and can see the traffic is being sent from the master and received on the internal server. But, the internal server must not be handling it nicely it as the master server says: Fri Jul 12 07:38:01 2019 : ERROR: (259008189) ERROR: Failing proxied request for user "689c3148b5a04d73a931534f0dd46f35", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008191) ERROR: Failing proxied request for user "f1680ea08fff4773b415a4a4a34b9365", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008193) ERROR: Failing proxied request for user "3b710ab2b4b0497baadd543582b7afc6", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008194) ERROR: Failing proxied request for user "0f2eec41a0b7488a88d6dc131913538d", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008195) ERROR: Failing proxied request for user "0c02bd6c5fb2426ea981fa62c51099eb", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008196) ERROR: Failing proxied request for user "6d6749a71aaf49ec97c472f85af18158", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008197) ERROR: Failing proxied request for user "39fd72831dbd4236abc055f01bea0d5b", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008198) ERROR: Failing proxied request for user "1c4c86da12054a099af44d4f0780b666", due to lack of any response from home server 10.0.0.1 port 1813 Notes: 1) The server handles around 50-100 auths/acct packets per second, so nothing major. The majority of requests are proxied without error and the failed ones are not from the same NAS client, spread out across many. 2) This only happens on accounting packets, never auths 3) It happens on Start, Stop and Interim packets 4) It seems to happen in chunks, i.e. i'll get a big block of 30 or so of these errors appear in the lock Any help on how to debug would be much appreciated. Thanks J

4 6