- Freeradius-Users - lists.freeradius.org

Using the rest module
by Francis Augusto Medeiros-Logeay 17 Nov '24

17 Nov '24

Hi, I’m fairly new to Freeradius, and today I took the time to read the documentation and to search what’s a best practice to implement some polling-based (blocking) authentication with FreeRADIUS towards a rest api server. I tried with Python first, but since I’m having trouble with concurrency, so I’m exploring other alternatives. The rest module seems like a fit, but I didn’t find much about other possibilities rather than interpreting the response code and having a json as a response that match existing attributes. In my case, I need simply to evaluate a value of a nested json key that doesn’t really match any existing attributes. Is there a way to do it? For example: { ‘detail’ : { ‘ result’ : { ‘value’ :’true’}}} I need to authenticate that user based on the value of ‘value’. Is the rest module a good tool for this? I saw that there is a json module that might be used with the rest, but it doesn’t seem to be available for the version I am using (3.0.21 on RHEL 9). I have three api calls, to three different url’s, so I figured out how to create multiple instances of the rest module, which is great. It’s just the response logic that I’m failing to understand. Could anyone point me to the right direction? Best, Francis

2 2

Using the authenticate function on rlm_python
by Francis Augusto Medeiros-Logeay 16 Nov '24

16 Nov '24

Hi there, I am trying to write a python script to be used by the python module of Freeradius. My main goal is to send an Access-Challenge to the user so that he would reply to that challenge. On perl, usually this «Response-Packet-Type» is configured on RAD_CHECK. But how do we send this in Python? I tried this: def authenticate(p): print("*** authenticate ***") print("") radiusd.radlog(radiusd.L_INFO, "*** log call in authenticate ***") print("") print(p) print(radiusd.config) print("") reply = ( ('Reply-Message', 'Hello from rlm_python'), ('State', 'test'), ('Response-Packet-Type', 'Access-Challenge') ) # config = ( ('Response-Packet-Type' , 'Acccess-Challenge'), ) config = ( ('Cleartext-Password' , '123'), ) return (radiusd.RLM_MODULE_HANDLED, reply,None) But without any success. Any clues of what to do here? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 11

Re: Add TLS version to logs with linelog in FreeRADIUS 3.2.4
by Dominic Stalder 15 Nov '24

15 Nov '24

Hi guys * another try, after failing to reach the mailing list for this topic with my email address * Coming back to this topic of TLS logging in FreeRADIUS 3.2.4, are there any news on this topic? I recently updated to FreeRADIUS 3.2.6, but TLS version is still missing. In the debug output (freeradius -X) I was missing the follwing attributes since 2.3.4: (10) update { (10) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 1014 ... (10) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (10) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' Thanks and regards Dominic

2 1

Reject certificate in use
by Rodrigo Prieto 13 Nov '24

13 Nov '24

Hello, I need to configure that if a client's certificate is in use, it cannot be used by another. I was looking at some examples on the web but it didn't work for me. If you can guide me, I appreciate it. Thank you.

3 9

logging auth failures with inner identity
by James Potter 12 Nov '24

12 Nov '24

Hi list, I'm working on setting up FreeRad logging and I'm stuck on how to capture the EAP inner identity when an authentication fails. * I can capture auth requests coming in (in authorize section of outer site) * I can capture auth successes and failures (in outer site:post-auth) * I can capture successful auths in the EAP:TLS inner site But - when an EAP-TLS auth fails (eg on cert expired, not trusted, revoked) then it appears that the inner site is not called at all. I've put relevant log lines in TLS-inner:post-auth (and authenticate and authorize) but it appears that none of these are called. Any idea how I can access the inner username (in the case of TLS I'm after the SAN UPN of the client certificate) in a failed auth attempt? Thanks, Jim Potter Jisc Config snippets FWIW: server home { authorize { log_auth_req eap } post-auth { log_auth_accept Post-Auth-Type REJECT { log_auth_reject } } } eap { tls { virtual_server = eap-inner } } server eap-inner { authorize { log_inner } authenticate { log_inner } post-auth { log_inner Post-Auth-Type REJECT { log_inner } } }

2 1

FreeRADIUS 4: DHCP v4: ERROR: Expansion "network" needs to be resolved before it is used
by Dima Ermakov 11 Nov '24

11 Nov '24

Hi, I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now). I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files: """ files files_dhcp_network { # # moddir:: Search for files in a subdirectory of mods-config which # matches this instance of the files module. # moddir = ${modconfdir}/files_dhcp # # key:: The default key attribute to use for matches. # # The content of this attribute is used to match the `name` of the entry. # key = 'network' # # filename:: The old `users` style file is now located here. # filename = ${moddir}/dhcp_config } """ with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used. Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/prot… ): """ network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """ Could you, please, if possible point me to what should be corrected? Here is the debug output of a test request: [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -v Info : radiusd - FreeRADIUS version 4.0.65535 (git #), for host x86_64-redhat-linux-gnu, built on Sep 25 2013 at 00:00:00 Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -X Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf Including files in directory "/etc/raddb/template.d/" including configuration file /etc/raddb/template.d/default including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/global.d/" including configuration file /etc/raddb/global.d/ldap including configuration file /etc/raddb/global.d/python Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/files_dhcp Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalisation including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor /etc/raddb/policy.d/vendor[8]: Using deprecated syntax. Please use new the new 'foreach' syntax. Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module process_dhcpv4 Parsing initial logging configuration. main { prefix = /usr log { destination = file syslog_facility = daemon local_state_dir = "/usr/var" logdir = "/usr/var/log" file = /var/log/radius/radius.log suppress_secrets = no } } Parsing security rules to bootstrap UID / GID / chroot / etc. main { log { } security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/var" run_dir = /var/run/radiusd } Parsing main configuration main { server dhcp { namespace = dhcpv4 Loaded module proto_dhcpv4 listen { type = Discover type = Request type = Inform type = Release type = Decline transport = udp Loaded module proto_dhcpv4_udp udp { ipaddr = 0.0.0.0 interface = ens224 port = 67 client_port = 68 broadcast = yes networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 priority { Discover = normal Request = normal Decline = normal Release = normal Inform = normal Lease-Query = low Bulk-Lease-Query = low } } } } log { colourise = yes } security { } sbin_dir = "/usr/sbin" logdir = /var/log/radius radacctdir = /var/log/radius/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = /var/run/radiusd/radiusd.pid debug_level = 0 max_requests = 16384 resources { } thread pool { num_networks = 1 Dynamically determined thread.workers = 2 num_workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { rewrite_update = false forbid_update = false } } Switching to configured log settings log debug { destination = null timestamp = yes colourise = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = auto limit_proxy_state = auto proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> require_message_authenticator = no limit_proxy_state = auto limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached Configuration version: A2E989E4-D5C6-4963-A1D1-083575FFAC4D systemd watchdog is disabled pre-suid-down capabilities: =ep trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### #### Bootstrapping protocol modules #### #### Instantiating libraries #### #### Bootstrapping static modules #### modules { static { Loaded module rlm_always always reject { rcode = reject } always fail { rcode = fail } always ok { rcode = ok } always handled { rcode = handled } always invalid { rcode = invalid } always disallow { rcode = disallow } always notfound { rcode = notfound } always noop { rcode = noop } always updated { rcode = updated } Loaded module rlm_files files files_dhcp_network { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } files files_dhcp_host { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } } # static #### Bootstrapping rlm modules #### Bootstrapping rlm_always "disallow" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_always "invalid" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_always "updated" Including dictionary file "/etc/raddb/dictionary" #### Instantiating listeners #### Compiling policies in server dhcp { ... } Compiling policies in - recv Discover {...} Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Compiling policies in - recv Request {...} Compiling policies in - recv Decline {...} Compiling policies in - recv Release {...} Compiling policies in - recv Inform {...} Compiling policies in - recv Lease-Query {...} /etc/raddb/sites-enabled/dhcp[307]: Skipping remaining instructions due to 'return' /etc/raddb/sites-enabled/dhcp[319]: Skipping remaining instructions due to 'return' dhcpv4 { ... } section is unused #### Instantiating process modules #### #### Instantiating protocol modules #### Instantiating proto_dhcpv4 "dhcp.dhcpv4" Instantiating proto_dhcpv4_udp "dhcp.dhcpv4.udp" #### Instantiating rlm modules #### Instantiating rlm_always "disallow" Instantiating rlm_always "fail" Instantiating rlm_always "handled" Instantiating rlm_always "invalid" Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_always "ok" Instantiating rlm_always "reject" Instantiating rlm_always "updated" Scheduler created in single-threaded mode #### Opening listener interfaces #### Listening on dhcpv4_udp server * port 67 on interface ens224 bound to virtual server dhcp post-suid-down capabilities: =ep Ready to process requests proto_dhcpv4_udp - Received Discover XID f252956f length 300 dhcpv4_udp server * port 67 on interface ens224 Worker - Resetting cleanup timer to +30 (0) dhcp { (0) Received Discover XID f252956f from 0.0.0.0:68 to 255.255.255.255:67 via ens224 (0) Opcode = Client-Message (0) Hardware-Type = Ethernet (0) Hardware-Address-Length = 6 (0) Hop-Count = 0 (0) Transaction-Id = 4065498479 (0) Number-of-Seconds = 0 (0) Flags = 0 (0) Client-IP-Address = 0.0.0.0 (0) Your-IP-Address = 0.0.0.0 (0) Server-IP-Address = 0.0.0.0 (0) Gateway-IP-Address = 0.0.0.0 (0) Client-Hardware-Address = 02:01:aa:bb:cc:dd (0) Message-Type = Discover (0) Client-Identifier = 0x616263313233 (0) Network-Subnet = 0.0.0.0/32 (0) Net { (0) Src { (0) IP = 0.0.0.0 (0) Port = 68 (0) } (0) Dst { (0) IP = 255.255.255.255 (0) Port = 67 (0) } (0) Timestamp = "2024-11-08T10:16:53Z" (0) } (0) Packet-Type = Discover (0) Running 'recv Discover' from file /etc/raddb/sites-enabled/dhcp (0) recv Discover { (0) files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used (0) files_dhcp_network (fail) (0) } # recv Discover (fail) (0) Not sending reply to client (0) dhcp (fail) (0) } # dhcp (fail) (0) Done request (0) Finished request proto_dhcpv4_udp - cleaning up request in 5.000000s ^CSignalled to terminate Exiting normally Thank you in advance, // Dmitrii.

2 7

Mailing List test
by dominic.stalder＠unibe.ch 11 Nov '24

11 Nov '24

Sorry guys, but I just wanted to check why my emails / questions don’t get to the list anymore; am I blocked or have been thrown off the list?

4 9

Google LDAP Authentication for WIFI Setup issues
by Joseph Allen 10 Nov '24

10 Nov '24

Hello, I have been working on this for several days and am tired of asking an AI for help. I have freeRadius installed on a RPI4 through apt, so its a 3.0 version. First I tried following google workspace instructions, it connects and looks up users fine, but it keeps trying to verify passwords in clear texts...no good. Next I noticed there is a mod named ldap_google in the mods-available, which says it will bind users and void the clear text issue. I configured that to connect to my workspace, fairly simple. Next I moved that file to the enabled mods folder as well as moving the google-ldap-auth file to the sites-enable folder. (I say move, I did a symbolic link). After lots of troubleshooting, I removed the default from the sites-enabled just to try and simplify everything. First I ran into issues with the filter_inner_identity, I don't quite understand why that is failing, but I saw somewhere else that is not needed, so I commented it out. Now I keep seeing this: (0) Received Access-Request Id 26 from 192.168.52.1:59099 to 192.168.52.155:1812 length 249 (0) User-Name = "test(a)test.com" (0) NAS-IP-Address = 192.168.1.89 (0) Called-Station-Id = "9A-7F-54-27-FD-35:***WIFI SSID****" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "BE-35-1A-04-D3-70" (0) Connect-Info = "CONNECT 24Mbps 802.11a" (0) Acct-Session-Id = "C349A45BB76F8134" (0) Acct-Multi-Session-Id = "9A4E5DCFE2DA284C" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027077 (0) WLAN-Group-Mgmt-Cipher = 1027078 (0) Framed-MTU = 1400 (0) EAP-Message = 0x027b0012017465737440746573742e636f6d (0) Message-Authenticator = 0xf88e64c655b98a2aa22e62a2844fe21d (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy split_username_nai { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) update request { (0) EXPAND %{1} (0) --> test (0) &Stripped-User-Name := test (0) } # update request = noop (0) if ("%{3}" != '') { (0) EXPAND %{3} (0) --> test.com (0) if ("%{3}" != '') -> TRUE (0) if ("%{3}" != '') { (0) update request { (0) EXPAND %{3} (0) --> test.com (0) &Stripped-User-Domain = test.com (0) } # update request = noop (0) } # if ("%{3}" != '') = noop (0) [updated] = updated (0) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (0) ... skipping else: Preceding "if" was taken (0) } # policy split_username_nai = updated (0) update control { (0) &Cache-Status-Only := yes (0) } # update control = noop (0) cache_auth_accept: EXPAND %{md5:%{%{Stripped-User-Name}:-%{User-Name}}%{User-Password}} (0) cache_auth_accept: --> 098f6bcd4621d373cade4e832627b4f6 (0) cache_auth_accept: No cache entry found for "098f6bcd4621d373cade4e832627b4f6" (0) [cache_auth_accept] = notfound (0) if (ok) { (0) if (ok) -> FALSE (0) update control { (0) &Cache-Status-Only := yes (0) } # update control = noop (0) cache_auth_reject: EXPAND %{md5:%{Calling-Station-Id}%{Stripped-User-Name}%{User-Password}} (0) cache_auth_reject: --> c12fe59cbee87c80dea47e15189a1410 (0) cache_auth_reject: No cache entry found for "c12fe59cbee87c80dea47e15189a1410" (0) [cache_auth_reject] = notfound (0) if (ok) { (0) if (ok) -> FALSE (0) if (&User-Password && !control:Auth-Type) { (0) if (&User-Password && !control:Auth-Type) -> FALSE (0) } # authorize = updated (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test(a)test.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) if (&control:Auth-Type == ldap) { (0) ERROR: Failed retrieving values required to evaluate condition (0) update control { (0) &Cache-TTL := 0 (0) } # update control = noop (0) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (0) cache_ldap_user_dn: --> test (0) cache_ldap_user_dn: No cache entry found for "test" (0) cache_ldap_user_dn: Creating new cache entry (0) cache_ldap_user_dn: Merging cache entry into request (0) cache_ldap_user_dn: Committed entry, TTL 86400 seconds (0) [cache_ldap_user_dn] = updated (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test(a)test.com/<no User-Password attribute>] (from client 192.168.52.1 port 0 cli BE-35-1A-04-D3-70) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 26 from 192.168.52.155:1812 to 192.168.52.1:59099 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 26 with timestamp +19 due to cleanup_delay was reached There is an IF condition in the site config to check for the User-Password before it sets the Auth-Type, however it appears there is no user password, so the condition fails and it never even attempts to connect to LDAP. So the big question, is why is there no password? I am testing with my iPad, and I am typing in a password when connecting to the Wifi. The wifi config is set to WPA Enterprise. Thanks in advance for any help

4 6

Certificate chain - 1 intermediate CA cert(s) untrusted
by Rodrigo Prieto 09 Nov '24

09 Nov '24

Hello, I have the following problem. I configured freeradius to use EAP-TLS and it works. Create the certificates with the script inside the certificates folder. The problem is that when a client connects the following error appears: Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [1] subject name /C=AR/ST=Buenos Aires/L=Virreyes/O=Lotech/emailAddress=22(a)gmail.com/CN=CA-FREERADIUS (TLS) untrusted certificate with depth [0] subject name /C=AR/ST=Buenos Aires/O=Lotech/CN=11@gmail.com/emailAddress=11@gmail.com I don't use intermediate AC. I ran c_rehash inside the certs folder. The certificates correctly point to the CA file. rivate_key_password = loli private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = /etc/freeradius/certs/ca.pem ca_path = ${cadir} I run openssl verify with the client and server certificates and it says OK. Freeradius is installed on Ununtu 24.04. The version of openssl is: OpenSSL 3.0.13 Jan 30, 2024 (Library: OpenSSL 3.0.13 Jan 30, 2024) If anyone can help me, I appreciate it. Greetings and thanks.

2 3

openssl FIPS mode
by Timothy J. Ebben 08 Nov '24

08 Nov '24

I have set up a FreeRADIUS server to interface with a Cisco managed switch. I am able to authenticate supplicants using the EAP-TLS protocol. When I activate FIPS mode in openssl (v3.1.5), I get the following debug output: Ready to process requests (5) Received Access-Request Id 62 from 192.168.5.132:49205 to 192.168.5.83:1812 length 131 Dropping packet without response because of error: Received packet from 192.168.5.132 with invalid Message-Authenticator! (Shared secret is incorrect.) (from client cisco) I know the shared secret is correct, because it works when not in FIPS mode. The shared secret is 15 characters long and includes uppercase and lowercase letters, numbers, and special characters. Do I need additional configuration?

2 5