Did you try changing default peap version to gtc? BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 2 Feb 2016, 21:37 +0530, Greg Mischel Smith<gregms@gmail.com>, wrote:
Comment out mschap in your EAP config to disallow negotiation of mschap, they'll try something else...
That's what I would have thought, but when I try that, I get the following: (6) eap : Peer sent method Identity (1) (6) ERROR: eap : Tried to start unsupported method (26) (6) eap : Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Login incorrect (eap: Tried to start unsupported method (26)): [testuser<via Auth-Type = EAP>] (from client WLC port 0 via TLS tunnel)
Happens on Android and Mac. I found that even if I set Android to use GTC, when I comment out the mschapv2 { } section in the eap config file, it fails.
Looking at the debug on when it suceeds (without eapchapv2 commented out), it still uses eapchapv2 which makes me think that's why it fails. (6) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6) authenticate { (6) eap : Peer sent method Identity (1) (6) eap : Calling eap_mschapv2 to process EAP data (6) eap_mschapv2 : Issuing Challenge ... (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Expiring EAP session with state 0xb11fa2d2b117b849 (7) eap : Finished EAP session with state 0xb11fa2d2b117b849 (7) eap : Previous EAP request found for state 0xb11fa2d2b117b849, released from the list (7) eap : Peer sent method NAK (3) (7) eap : Found mutually acceptable type GTC (6) (7) eap : Calling eap_gtc to process EAP data (7) eap_gtc : EXPAND Password: (7) eap_gtc : -->Password: (7) eap : New EAP session, adding 'State' attribute to reply 0xb11fa2d2b016a449 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html