- Freeradius-Users - lists.freeradius.org

Problems with eap certificate and MacOS
by Marco Scholl 15 Feb '17

15 Feb '17

Hi, i have a problem EAP. I have a root ca for our company with an intermediate ca. Now i have generate an certificate for the radius server with EAP OIDs (1.3.6.1.5.5.7.3.13, 1.3.6.1.5.5.7.3.14) Then i have installed our root ca as trusted for all type (eap, smime, webserver ....). When i now connect by wlan or cable to the freeradius, i got an server certificate error. But when i open the dialog for confirmation, i see our root ca als trusted, i see the intermediate as trustend and i see the radius certificate as trust! every connect i must accept the certificate for new. anybody an idea? when i use an normal webserver certificate from a public ca the problem not exists, after i confirm the certificate on first try. greets marco

4 4

Removing unused SQL drivers
by Arran Cudbard-Bell 15 Feb '17

15 Feb '17

We’re starting to investigate moving rlm_sql to the new async I/O model. The main benefits being: - Significant increase in TPS where DB benefits from increased parallelism, or RTT to the database is high. - FreeRADIUS no longer appears to “hang” when databases go away (it doesn’t actually hang, but all the worker threads get tied up until they time out). - In the hanging (not hanging) scenario, we can drain the incoming packet queue to detail files without “hiccups” (where the inbound packet queue fills) waiting for stale connections to close or queries to time out. Ongoing discussion on GitHub is here: https://github.com/FreeRADIUS/freeradius-server/issues/1913 Questions for users are: - Does anyone still use DB2? It’s virtually undocumented and it’s not clear if it has an async interface. - Does anyone still use Firebird? Is there any disadvantage in using it via ODBC. - Is there still value in maintaining IODBC compatibility? It seems to lack many features of UnixODBC. Previously IODBC was included in OSX Lion, so it was useful to keep around. It’s since been removed however, and UnixODBC can be installed with hombrew. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Unresponsive server when debugging
by Lucas Diaz 14 Feb '17

14 Feb '17

I'm running a 3.0.11 server with Firebird as the backend database. It works very well. I have an issue though when debugging (output to STDOUT): if an authentication query hangs or becomes very slow to respond, during that period of time, the server becomes unresponsive and it can be seen on the log of the nases "Radius server is not responding". Until this happens, it works just fine. If I launch the server without debug, it authorizes all users super fast (except the ones that are very slow), but it don't "hang" the server. It's like in debug mode threads are not used. Is that right? Thanks.

3 3

Multiple shared secret per IP?
by Chris Taylor (chtaylo2) 13 Feb '17

13 Feb '17

On FreeRadius v.3.0.12. I have a requirement where I need to send test authentications to the F.R. server, which are then proxy’ed. i.e: user: monitor source IP: 64.0.0.1 secret: MonitorAgent ^ - That’s easy. To complicate, I need to also authenticate real users from the same source server, using a different shared secret. (anyone can view the one above, so not secure) Ideally, I’d like to also lockdown the above secret key, to the single user. i.e: user: userA, etc, etc source IP: 64.0.0.1 secret: SD%^GHJ Is it possible to have multiple secret strings per IP or maybe different domains per IP? If not, any recommendations? Thanks!!

4 4

3.0.12 ignoring HUP (No files changed), albeit changes in passwd-file?
by macservo 13 Feb '17

13 Feb '17

Hello, I´m running 3.0.12 and use the passwd-module of 3.0.13 (because of "notfound") After changes in the passwd-file, the server receives a HUP. This worked in 2.0.2 3.0.12 will give me > Info: HUP - No files changed. Ignoring I can confirm, that the passwd-file has changed, since the server has started. What am I doing wrong? (Found some entries in the mailing list, that this was a problem in older versions but should have been fixed since 3.0.10?) Is it better to change to 3.0.13 completely? Is it stable? Thank you very much.

3 2

rlm_rest with Freeradius
by Thomas Massip 13 Feb '17

13 Feb '17

Hi all, I actually use FreeRADIUS Version 3.0.13 with PacketFence and I have an issue when i try the rlm_rest. If somoene Know why i have this issue : rest: ERROR: Server returned: (0) rest: ERROR: {"Reply-Message":"PacketFence does not support this switch for read/write access login","reply:PacketFence-Authorization-Status":"allow"} This is my output radius -x : 0) Received Access-Request Id 10 from 192.168.10.14:1812 to 192.168.10.22:1812 length 122 (0) User-Name = "UserTest" (0) User-Password = "p@55word" (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Identifier = "las1.albari" (0) NAS-Port-Type = Ethernet (0) Acct-Session-Id = "las1.al00000000000000da6bb650001055" (0) NAS-IP-Address = 192.168.10.14 (0) # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence (0) authorize { (0) update { (0) EXPAND %{Packet-Src-IP-Address} (0) --> 192.168.10.14 (0) &request:FreeRADIUS-Client-IP-Address := 192.168.10.14 (0) &control:PacketFence-RPC-Server = 127.0.0.1 (0) &control:PacketFence-RPC-Port = 7070 (0) &control:PacketFence-RPC-User = (0) &control:PacketFence-RPC-Pass = (0) &control:PacketFence-RPC-Proto = http (0) EXPAND %l (0) --> 1486992205 (0) &control:Tmp-Integer-0 := 1486992205 (0) &control:PacketFence-Request-Time := 0 (0) } # update = noop (0) policy rewrite_calling_station_id { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_calling_station_id = noop (0) policy rewrite_called_station_id { (0) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) { (0) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_called_station_id = noop (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = noop (0) } # policy filter_username = noop (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) EXPAND %{string:User-Password} (0) --> p@55word (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (0) } # policy filter_password = noop (0) [preprocess] = ok (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "UserTest", skipping NULL due to config. (0) [suffix] = noop (0) ntdomain: Checking for prefix before "\" (0) ntdomain: No '\' in User-Name = "UserTest", looking up realm NULL (0) ntdomain: Found realm "null" (0) ntdomain: Adding Stripped-User-Name = "UserTest" (0) ntdomain: Adding Realm = "null" (0) ntdomain: Authentication realm is LOCAL (0) [ntdomain] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) if ( !EAP-Message ) { (0) if ( !EAP-Message ) -> TRUE (0) if ( !EAP-Message ) { (0) update { (0) &control:Auth-Type := Accept (0) } # update = noop (0) } # if ( !EAP-Message ) = noop (0) policy packetfence-eap-mac-policy { (0) if ( &EAP-Type ) { (0) if ( &EAP-Type ) -> FALSE (0) [noop] = noop (0) } # policy packetfence-eap-mac-policy = noop (0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (0) pap: WARNING: !!! configuration so that the "known good" clear text !!! (0) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (0) pap: WARNING: !!! User-Password. !!! (0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /usr/local/pf/raddb/sites-enabled/packetfence (0) post-auth { (0) update { (0) EXPAND %{Packet-Src-IP-Address} (0) --> 192.168.10.14 (0) &request:FreeRADIUS-Client-IP-Address := 192.168.10.14 (0) &control:PacketFence-RPC-Server = 127.0.0.1 (0) &control:PacketFence-RPC-Port = 7070 (0) &control:PacketFence-RPC-User = (0) &control:PacketFence-RPC-Pass = (0) &control:PacketFence-RPC-Proto = http (0) } # update = noop (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> TRUE (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { rlm_rest (rest): Closing connection (0): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): Closing connection (1): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): Closing connection (2): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (3): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (4): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (5), 1 of 64 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:7070/" rlm_rest (rest): Reserved connection (5) (0) rest: Expanding URI components (0) rest: EXPAND http://127.0.0.1:7070 (0) rest: --> http://127.0.0.1:7070 (0) rest: EXPAND //radius/rest/authorize (0) rest: --> //radius/rest/authorize (0) rest: Sending HTTP POST to "http://127.0.0.1:7070//radius/rest/authorize" (0) rest: Encoding attribute "User-Name" (0) rest: Encoding attribute "User-Password" (0) rest: Encoding attribute "NAS-IP-Address" (0) rest: Encoding attribute "Service-Type" (0) rest: Encoding attribute "Framed-Protocol" (0) rest: Encoding attribute "NAS-Identifier" (0) rest: Encoding attribute "NAS-Port-Type" (0) rest: Encoding attribute "Acct-Session-Id" (0) rest: Encoding attribute "Event-Timestamp" (0) rest: Encoding attribute "Stripped-User-Name" (0) rest: Encoding attribute "Realm" (0) rest: Encoding attribute "FreeRADIUS-Client-IP-Address" (0) rest: Processing response header (0) rest: Status : 401 (Unauthorized) (0) rest: Type : json (application/json) (0) rest: ERROR: Server returned: (0) rest: ERROR: {"Reply-Message":"PacketFence does not support this switch for read/write access login","reply:PacketFence-Authorization-Status":"allow"} rlm_rest (rest): Released connection (5) rlm_rest (rest): Need 2 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (6), 1 of 63 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:7070/" (0) [rest] = invalid (0) } # if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) = invalid (0) } # post-auth = invalid (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence (0) Post-Auth-Type REJECT { (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> TRUE (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (0) policy packetfence-audit-log-reject { (0) if (&User-Name != "dummy") { (0) if (&User-Name != "dummy") -> TRUE (0) if (&User-Name != "dummy") { (0) policy request-timing { (0) if (control:PacketFence-Request-Time != 0) { (0) if (control:PacketFence-Request-Time != 0) -> FALSE (0) } # policy request-timing = noop (0) sql_reject: EXPAND type.reject.query (0) sql_reject: --> type.reject.query (0) sql_reject: Using query template 'query' rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 282 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 282 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 282 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 282 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 282 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 282 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (6), 1 of 64 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 rlm_sql (sql): Reserved connection (6) (0) sql_reject: EXPAND %{User-Name} (0) sql_reject: --> UserTest (0) sql_reject: SQL-User-Name set to 'UserTest' (0) sql_reject: EXPAND INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}', '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request', '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}', '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}', '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}', '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject', '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}', '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}', '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-N/A}', '%{%{control:PacketFence-IsPhone}:-N/A}', '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-N/A}') (0) sql_reject: --> INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '', '', 'N/A', 'UserTest', 'UserTest', 'null', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.10.14', '', '', 'Ethernet', '', '', 'N/A', '', 'N/A', '192.168.10.14', 'las1.albari', 'Reject', 'rest: Server returned:', 'Accept', '', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'User-Name =3D =22UserTest=22=2C User-Password =3D =22p@55word=22=2C NAS-IP-Address =3D 192.168.10.14=2C Service-Type =3D Framed-User=2C Framed-Protocol =3D PPP=2C NAS-Identifier =3D =22las1.albari=22=2C NAS-Port-Type =3D Ethernet=2C Acct-Session-Id =3D =22las1.al00000000000000da6bb650001055=22=2C Event-Timestamp =3D =22févr. 13 2017 14:23:25 CET=22=2C Stripped-User-Name =3D =22UserTest=22=2C Realm =3D =22null=22=2C FreeRADIUS-Client-IP-Address =3D 192.168.10.14=2C Module-Failure-Message =3D =22rest: Server returned:=22=2C Module-Failure-Message =3D =22rest: =7B=5C=22Reply-Message=5C=22:=5C=22PacketFence does not support this switch for read/write access login=5C=22=2C=5C=22reply:PacketFence-Authorization-Status=5C=22:=5C=22allow=5C=22=7D=22=2C SQL-User-Name =3D =22UserTest=22','', '0') (0) sql_reject: Executing query: INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '', '', 'N/A', 'UserTest', 'UserTest', 'null', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.10.14', '', '', 'Ethernet', '', '', 'N/A', '', 'N/A', '192.168.10.14', 'las1.albari', 'Reject', 'rest: Server returned:', 'Accept', '', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'User-Name =3D =22UserTest=22=2C User-Password =3D =22p@55word=22=2C NAS-IP-Address =3D 192.168.10.14=2C Service-Type =3D Framed-User=2C Framed-Protocol =3D PPP=2C NAS-Identifier =3D =22las1.albari=22=2C NAS-Port-Type =3D Ethernet=2C Acct-Session-Id =3D =22las1.al00000000000000da6bb650001055=22=2C Event-Timestamp =3D =22févr. 13 2017 14:23:25 CET=22=2C Stripped-User-Name =3D =22UserTest=22=2C Realm =3D =22null=22=2C FreeRADIUS-Client-IP-Address =3D 192.168.10.14=2C Module-Failure-Message =3D =22rest: Server returned:=22=2C Module-Failure-Message =3D =22rest: =7B=5C=22Reply-Message=5C=22:=5C=22PacketFence does not support this switch for read/write access login=5C=22=2C=5C=22reply:PacketFence-Authorization-Status=5C=22:=5C=22allow=5C=22=7D=22=2C SQL-User-Name =3D =22UserTest=22','', '0') (0) sql_reject: SQL query returned: success (0) sql_reject: 1 record(s) updated rlm_sql (sql): Released connection (6) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 63 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 (0) [sql_reject] = ok (0) } # if (&User-Name != "dummy") = ok (0) } # policy packetfence-audit-log-reject = ok (0) } # if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> UserTest (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) attr_filter.packetfence_post_auth: EXPAND %{User-Name} (0) attr_filter.packetfence_post_auth: --> UserTest (0) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10 (0) [attr_filter.packetfence_post_auth] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (0) linelog: --> messages.Access-Accept (0) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Accepted user: %{reply:User-Name} and returned VLAN %{reply:Tunnel-Private-Group-ID} (0) linelog: --> Mon Feb 13 14:23:25 2017 : [mac:] Accepted user: and returned VLAN (0) linelog: EXPAND /usr/local/pf/logs/radius.log (0) linelog: --> /usr/local/pf/logs/radius.log (0) [linelog] = ok (0) } # Post-Auth-Type REJECT = updated (0) Rejected in post-auth: [UserTest] (from client 192.168.10.0/24 port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.8 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 10 from 192.168.10.22:1812 to 192.168.10.14:1812 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 10 with timestamp +282 Ready to process requests Thanks for ur help Best regards

2 2

passwd and unlang
by macservo 13 Feb '17

13 Feb '17

Am I missing something here or have there been changes to the behavior of passwd and unlang since 2.0.2? If you could please have a look at the configuration (migrated from 2.0.2, where it was working) and output below. The username for the request is Mac284-1. This username is NOT in the passwd-file, which explains the "Failed retrieving values required to evaluate condition" part. But then why is notfound -> FALSE? Should´nt notfound be true and the request thus be rejected? /etc/raddb/sites-enabled/default: authorize { ... maclist if (notfound) { reject } if ( mac-add !~ /%{Calling-Station-ID}/i) { reject } ... } /etc/raddb/mods-available/passwd: passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:~mac-add" } /etc/raddb/maclist: Macxxx:00236C94ED49 And the output: Fri Feb 10 19:10:31 2017 : Debug: (5) suffix: No '@' in User-Name = "Mac284-1", looking up realm NULL Fri Feb 10 19:10:31 2017 : Debug: (5) suffix: No such realm "NULL" Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from suffix (rlm_realm) Fri Feb 10 19:10:31 2017 : Debug: (5) [suffix] = noop Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) { Fri Feb 10 19:10:31 2017 : Debug: No matches Fri Feb 10 19:10:31 2017 : Debug: Adding 1 matches Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) -> TRUE Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) { Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling eap (rlm_eap) Fri Feb 10 19:10:31 2017 : Debug: (5) eap: Peer sent EAP Response (code 2) ID 6 length 1276 Fri Feb 10 19:10:31 2017 : Debug: (5) eap: No EAP Start, assuming it's an on-going EAP conversation Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from eap (rlm_eap) Fri Feb 10 19:10:31 2017 : Debug: (5) [eap] = updated Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling files (rlm_files) Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from files (rlm_files) Fri Feb 10 19:10:31 2017 : Debug: (5) [files] = noop Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling maclist (rlm_passwd) Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from maclist (rlm_passwd) Fri Feb 10 19:10:31 2017 : Debug: (5) [maclist] = ok Fri Feb 10 19:10:31 2017 : Debug: (5) if (notfound) { Fri Feb 10 19:10:31 2017 : Debug: (5) if (notfound) -> FALSE Fri Feb 10 19:10:31 2017 : Debug: (5) if ( mac-add !~ /%{Calling-Station-ID}/i) { Fri Feb 10 19:10:31 2017 : ERROR: (5) Failed retrieving values required to evaluate condition

2 3

freeRadius dynamic vlan unifi AP
by Jan-Christoph Fuchs 12 Feb '17

12 Feb '17

Hi Forum, i have setup a freeradius server with MySQL for Dynamic VLAN assignment. Everything works fine with TP-Link AP running openWRT. Now I have changed to Unifi AP (Unifi Security Gateway Pro, Unifi Switch US-24 POE Unifi AP Pro) and the dynamic VLAN assignment will not work anymore. When I try to connect to the WPA2 Enterprise WLAN, credentials are accepted but I always been put to default VLAN. I googled around and found the Link, but I had no success anyway. http://freeradius.1045715.n5.nabble.com/Freeradius-and-Unifi-Vlan-td5743402… <http://freeradius.1045715.n5.nabble.com/Freeradius-and-Unifi-Vlan-td5743402…> Anyone has any ideas to help me please? Which further information do you need? I have a full freeradius -X Thanks Foxy freeradius debug: rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=0, length=162 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0267000a01766c616e32 Message-Authenticator = 0x06d999db3a89921c59829a06fc6a668c # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 103 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> vlan2 [sql] sql_set_user escaped user --> 'vlan2' rlm_sql (sql): Reserving sql socket id: 31 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'vlan2' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'vlan2' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'vlan2' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan2' ORDER BY id [sql] User found in group vlan2 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vlan2' ORDER BY id rlm_sql (sql): Released sql socket id: 31 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 0 to 10.4.0.3 port 58475 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x016800160410d4aaf5baf1249b0b9757e28baaeaaa5f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd05bd62b4f6758a6e7768e6c4f Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=1, length=178 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026800080319152b State = 0x5bbe2fd05bd62b4f6758a6e7768e6c4f Message-Authenticator = 0x832e2a49ed7f71a89ddd64c031384e96 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 104 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> vlan2 [sql] sql_set_user escaped user --> 'vlan2' rlm_sql (sql): Reserving sql socket id: 30 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'vlan2' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'vlan2' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'vlan2' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan2' ORDER BY id [sql] User found in group vlan2 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vlan2' ORDER BY id rlm_sql (sql): Released sql socket id: 30 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 1 to 10.4.0.3 port 58475 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x016900061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd05ad7364f6758a6e7768e6c4f Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=2, length=297 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0269007f19800000007516030100700100006c0301589ed44589c48a46cf539f29ccb55919d495885606f29ed44e2a6c29bd86d9eb00002000ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000a01000023000a00080006001700180019000b000201000005000501000000000012000000170000 State = 0x5bbe2fd05ad7364f6758a6e7768e6c4f Message-Authenticator = 0x36c578d87de859f5bb186da5d12f866d # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 105 length 127 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 117 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0070], ClientHello [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 02ca], Certificate [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 2 to 10.4.0.3 port 58475 EAP-Message = 0x016a040019c0000004661603010039020000350301ca88fca516ec799abd1ac079f7dcde1a67301926aae2707dc648d90fad15555400c01400000dff01000100000b00040300010216030102ca0b0002c60002c30002c0308202bc308201a4a003020102020900a5fffa2bd980f52f300d06092a864886f70d01010b050030163114301206035504030c0b7261737062657272797069301e170d3136303531363039353930305a170d3236303531343039353930305a30163114301206035504030c0b726173706265727279706930820122300d06092a864886f70d01010105000382010f003082010a0282010100c3d09a5c1cf391c424a9db1c9546 EAP-Message = 0xe2d0d56ef0c7992e58cc9fddfcca2e1e792de870f1b44732e39760c9be69d00bee75ebb6544ef6e7552cd6071cf42a0314dfcf5f6588403e82906d1bdc76e22d83d897f5822cc3ad4e8688b26a7e51272de8f12178c18eeef3736db12c082c610cf4ed064ca669a8502cd0b304f9b347e9b6e792d22b7477447b724fc1a5b8feaa5bc2dab89c47f61083f2ad2a713346a45779f64738f78e6c6b50dd9fba57b8c429d9130ffe2852ae300f0da67338d241c7f9ed1a3edfd9e60e4a204888db9e7c2b2c4b2720cac0bb75955fdc8dededdcd3005b33e3c3665cb56f8fea647fe98b100ac37981f6664b06baf77672578b49510203010001a30d300b3009 EAP-Message = 0x0603551d1304023000300d06092a864886f70d01010b0500038201010059f5ccb527a5c95bd585d481cf2c0d940a2100bfe19c781f8fc6c9fe6ecf9581cc11899915a4a4a76f93ce5d9a27a1377e9f5b595d0c91b85158b46264b6bbf53d663f5972a29bb9ee27f94fa19c0e10cb315bbfff1a0b9dada6af7b44055bde3a97fce3d03d0e3d9dd2ca98d02899654c38e978067be45716b8095b7eec985ed5766a840d768fde1384f8d70c2b2b62f3bf1ce577e8c7e55870217ef8101973e33c417108d7645823438b1b637bf66d11755e23ccceabf7256480a3ce55f410d5479aa862e7cd048a3661213131c38bdcfae6a8223dbc92e680e4e8feee2c86 EAP-Message = 0xf60edf462d78a0cd61d0be2a807c82feddfb62a74cd23265bc34cf55c8de1296160301014b0c00014703001741049b8ce76c18bbad24703b1770055b370369335679cf94ea52ffcf0fb82725e6e4180acdba12d45dc91ce19392b2aeeb8af3081f8475a36236ad67689782d72840010035cfee51ff337f1eb937b5a66c75b726e96a2c585d4987a1cbda13df17060e3ae4791a5b09b611fab6be846494ba450248e1da4d1e693940510d3dd879dbe65927e90cd4d325b64514f1af880c2b8b6bd2b702f3315084069dadfde74e622f29654c3ba1862ec885bbf541858571ab5e12c1b9baf903ade005a27da49e31b4f80697c4901e100f61f6c093f751 EAP-Message = 0xc33825db86cc5193821c21c0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd059d4364f6758a6e7768e6c4f Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=3, length=176 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026a00061900 State = 0x5bbe2fd059d4364f6758a6e7768e6c4f Message-Authenticator = 0x99a1d9d626da9befea61798a088dcaa5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 106 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 3 to 10.4.0.3 port 58475 EAP-Message = 0x016b0076190084b8ddc47f9ae932aad390c476d83be799f4a0573ba9ffc44bb7ab4acd2aee1bf8c481909e6fb235ad5904953e0da13f76cab712d08f270272699821617e7c9bbbf02fe16724e3e118fb1544a1425a42b33d7627f1ac1a3ab6b40de72becd841b631813edf992c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd058d5364f6758a6e7768e6c4f Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=4, length=314 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026b0090198000000086160301004610000042410492699d0b4133e01f3077df1dd32450bb838549add65693b94f1403cc929899231cbad80effab16998dbc60b8de0238ddbe8fefdbbe3e770c3f662d37b37371771403010001011603010030164a6ac78696439e80a7b6e06d205e5a2a6b9a90d8531892b0a24de189284588156554a2a15cbbcb8cc0e9e8f87810c8 State = 0x5bbe2fd058d5364f6758a6e7768e6c4f Message-Authenticator = 0xbd183035d6eb70e1cf4df33759a104a0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 107 length 144 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 4 to 10.4.0.3 port 58475 EAP-Message = 0x016c0041190014030100010116030100302db38c5a4a30e8a20e40e33ea5c90ffc4390aa26733fa055d9e44df2df3fe2efec91ee64752fbaa81952491f4de66b73 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd05fd2364f6758a6e7768e6c4f Finished request 4. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=5, length=176 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026c00061900 State = 0x5bbe2fd05fd2364f6758a6e7768e6c4f Message-Authenticator = 0xfe48702c915ce42bd6857c1c98c2ad33 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 108 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 5 to 10.4.0.3 port 58475 EAP-Message = 0x016d002b19001703010020720525055a03208c8942699fac52371c34564e69c8ad2dca9670eb2ad7d7990b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd05ed3364f6758a6e7768e6c4f Finished request 5. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=6, length=213 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026d002b1900170301002047bc3b02b2b161c69c407fcc9499570fc44846071487cddd3238a74a6f1b5486 State = 0x5bbe2fd05ed3364f6758a6e7768e6c4f Message-Authenticator = 0x3043fa8c67010675ab157c9b041ec8e0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 109 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - vlan2 [peap] Got inner identity 'vlan2' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x026d000a01766c616e32 server { [peap] Setting User-Name to vlan2 Sending tunneled request EAP-Message = 0x026d000a01766c616e32 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" NAS-IP-Address = 10.4.0.3 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 109 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> vlan2 [sql] sql_set_user escaped user --> 'vlan2' rlm_sql (sql): Reserving sql socket id: 29 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'vlan2' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'vlan2' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'vlan2' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan2' ORDER BY id [sql] User found in group vlan2 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vlan2' ORDER BY id rlm_sql (sql): Released sql socket id: 29 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x016e001f1a016e001a10e77e02f329ceda823151bee45600a691766c616e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf69de36bf07c49c7fdd6a5522e854fb [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x016e001f1a016e001a10e77e02f329ceda823151bee45600a691766c616e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf69de36bf07c49c7fdd6a5522e854fb [peap] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 6 to 10.4.0.3 port 58475 EAP-Message = 0x016e003b19001703010030273a2344da33da6bd4f07a68939b2d6fe8f074d5c8fc5d3bd995b603066ecf0ebadaa7b9c6bb0857de06eb1732da1372 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd05dd0364f6758a6e7768e6c4f Finished request 6. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=7, length=277 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026e006b190017030100609d599b8771f229409a0c80966b2d47df23ee2d458e0aa22554971c8dcbff5c8d6fd24841ac1f33f77b523ad33f435410bd3b5061388f389cf35852f2bbe989d6e79c80c01fa06efa1ac48960c28057604e2d52eaf27fcb9592b15bd81b9d9352 State = 0x5bbe2fd05dd0364f6758a6e7768e6c4f Message-Authenticator = 0x49a65641575dbc71665aa3a24ed858d4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 110 length 107 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x026e00401a026e003b315e0f62a689f025e1df998ee87babf9de00000000000000007564685ceec9262c6ebfe53b4108d24ae06e720a0fe08a6c00766c616e32 server { [peap] Setting User-Name to vlan2 Sending tunneled request EAP-Message = 0x026e00401a026e003b315e0f62a689f025e1df998ee87babf9de00000000000000007564685ceec9262c6ebfe53b4108d24ae06e720a0fe08a6c00766c616e32 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "vlan2" State = 0xbf69de36bf07c49c7fdd6a5522e854fb NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" NAS-IP-Address = 10.4.0.3 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 110 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> vlan2 [sql] sql_set_user escaped user --> 'vlan2' rlm_sql (sql): Reserving sql socket id: 28 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'vlan2' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'vlan2' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'vlan2' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan2' ORDER BY id [sql] User found in group vlan2 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vlan2' ORDER BY id rlm_sql (sql): Released sql socket id: 28 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] Creating challenge hash with username: vlan2 [mschap] Client is using MS-CHAPv2 for vlan2, we need NT-Password ++[mschap] = ok +} # group MS-CHAP = ok MSCHAP Success ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x016f00331a036e002e533d41463237344142313833423934363930354534383236463136343338333230333744323432413432 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf69de36be06c49c7fdd6a5522e854fb [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x016f00331a036e002e533d41463237344142313833423934363930354534383236463136343338333230333744323432413432 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf69de36be06c49c7fdd6a5522e854fb [peap] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 7 to 10.4.0.3 port 58475 EAP-Message = 0x016f005b19001703010050379671a1652397822077c4939f603c0697b5ad4acda69af23684b69747b835bc2eee51061ba9de8736ee1a212c16986b4976389fe0080d8f0d71a892795b124f8bcb4cf473180414321ba05012d9c804 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd05cd1364f6758a6e7768e6c4f Finished request 7. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=8, length=213 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x026f002b190017030100204e389e032c31ad1db1e6708b6e4b9d959b44e97a2133228df869f8852f589e6b State = 0x5bbe2fd05cd1364f6758a6e7768e6c4f Message-Authenticator = 0x931630aa75d0a3402894d50d928802c2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 111 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x026f00061a03 server { [peap] Setting User-Name to vlan2 Sending tunneled request EAP-Message = 0x026f00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "vlan2" State = 0xbf69de36be06c49c7fdd6a5522e854fb NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" NAS-IP-Address = 10.4.0.3 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 111 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> vlan2 [sql] sql_set_user escaped user --> 'vlan2' rlm_sql (sql): Reserving sql socket id: 27 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'vlan2' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'vlan2' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'vlan2' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan2' ORDER BY id [sql] User found in group vlan2 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vlan2' ORDER BY id rlm_sql (sql): Released sql socket id: 27 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel } # server inner-tunnel [peap] Got tunneled reply code 2 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x036f0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "vlan2" [peap] Got tunneled reply RADIUS code 2 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x036f0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "vlan2" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 8 to 10.4.0.3 port 58475 EAP-Message = 0x0170002b1900170301002016ca7fa553aa22f428b1cc092d8c0edce568f4304d792dc1e4f3ee96aee7dbf4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5bbe2fd053ce364f6758a6e7768e6c4f Finished request 8. Going to the next request Waking up in 2.0 seconds. rad_recv: Access-Request packet from host 10.4.0.3 port 58475, id=9, length=213 User-Name = "vlan2" NAS-Identifier = "802aa8c9b930" NAS-Port = 0 Called-Station-Id = "80-2A-A8-CA-B9-30:test-radius" Calling-Station-Id = "44-00-10-57-E4-82" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0270002b19001703010020f1fad92ca1690eeab1fd596f4e05814f52fe6ca28544b4fa55eee6ea9709ba21 State = 0x5bbe2fd053ce364f6758a6e7768e6c4f Message-Authenticator = 0xdb9f0883a110094183004dd28a6f5261 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "vlan2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 112 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" User-Name = "vlan2" [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { [sql] expand: %{User-Name} -> vlan2 [sql] sql_set_user escaped user --> 'vlan2' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'vlan2', '', 'Access-Accept', '2017-02-11 09:54:40') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'vlan2', '', 'Access-Accept', '2017-02-11 09:54:40') rlm_sql (sql): Reserving sql socket id: 26 rlm_sql (sql): Released sql socket id: 26 ++[sql] = ok ++[exec] = noop +} # group post-auth = ok Sending Access-Accept of id 9 to 10.4.0.3 port 58475 Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "2" User-Name = "vlan2" MS-MPPE-Recv-Key = 0xc42271ac1c9ce5bd6fd9be65a9eaf0b2c9512de5a0561888d8c4443a42a3ea0e MS-MPPE-Send-Key = 0xe57e91b287bd2e2d536e08176c9a61fdaa9ae60687e59db5310af032b8c3e430 EAP-Message = 0x03700004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 9. Going to the next request Waking up in 2.0 seconds. Cleaning up request 0 ID 0 with timestamp +47 Cleaning up request 1 ID 1 with timestamp +47 Cleaning up request 2 ID 2 with timestamp +47 Cleaning up request 3 ID 3 with timestamp +47 Waking up in 2.6 seconds. Cleaning up request 4 ID 4 with timestamp +49 Cleaning up request 5 ID 5 with timestamp +49 Cleaning up request 6 ID 6 with timestamp +49 Cleaning up request 7 ID 7 with timestamp +49 Cleaning up request 8 ID 8 with timestamp +50 Cleaning up request 9 ID 9 with timestamp +50 Ready to process requests.

2 4

The "simul_check" Query
by Selahattin Cilek 10 Feb '17

10 Feb '17

Hello. At what stage of AAA does FreeRADIUS send the SQL server the 'simul_check' and the 'simul_verify' queries? What other information than the "Username" can I send to a custom query at this stage? Best regards. Selahattin CILEK

5 7

framed-ipv6-address aware queries.conf file for FR 3.0.13
by Alex Sharaz 10 Feb '17

10 Feb '17

I've just set up a test wireless network that assigns users IPv6 addresses. From an Airheads page I found the following re IPv6 accounting :- ============== Pre 6.5, we can only perform authentication/authorization of IPv6 clients. Starting Aruba OS 6.5, we have the capability to monitor the bandwidth usage of the clients with IPv6 addresses. * We are following RFC 6911 which defines the attributes to be used for IPv6 access networks. * The *Framed-IPv6-Address* is the key attribute and will be used in accounting start, stop and interim packets. * With IPv6 implementation, it is possible for a single host to have multiple IPv6 addresses. * We now have ability to track the usage of each and every IPv6 entry. A host can have both IPv4 andIPv6 addresses. Following behavior is expected in the mentioned scenarios- *With one IPv6 address:* Start, stop and interim update messages are sent for the only IPv6 address. *With one each IPv4 and IPv6 address:* Start, stop and interim update messages are sent for both IPv4 and IPv6 address. *With multiple IPv6 address:* Start, stop and interim update messages are sent for each of the IPv6 addresses. *With multiple IPv6 and multiple IPv4 address:* Start, stop and interim update messages are sent for each of the IPv6 addresses. Start message is sent only for the first IPv4 address. Interim updates are sent for all the IPv4 addresses. •Stop message is sent only for the last IPv4 entry. ======= however looking at both queries.conf and schema.conf , there doesn't seem to be any reference to supporting IPv6 addresses via the Framd-ipv6-address attribute. Tried looking at the FR v4 source for queries.conf and schema.conf on github and there's no reference to Framed-IPv6-Adddress there either. Is this something I've got to roll out myself? Rgds Alex

2 1