Hi, We are running freeradius 2.2.7 and decided it is time to move to a latest version. The person who built the existing server is no longer with us. Knowing that configuration from version 2 cannot be ported to version 3, we had learn it. So we are able to get a working version 3.13 up and able to proxy the request into an rsa server. Authenticating from a juniper network and linux host works. But when we authenticate from a cisco device it fails. Below is the snippet of the log: ... (0) Converting control list to client fields (0) ipv4addr = 10.8.4.36 (0) secret = xxxxx (0) shortname = evtlmdt-chnp11 (0) nas_type = other (0) virtual_server = default Adding client 10.8.4.36/32 with shared secret "xxxxx" (0) Received Access-Request Id 20 from 10.8.4.36:1812 to 10.8.2.16:1812 length 75 (0) User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" (0) NAS-IP-Address = 10.8.4.36 (0) NAS-Port-Type = Virtual (0) NAS-Port = 1 (0) Calling-Station-Id = "10.2.2.31" (0) User-Name = "ec2624" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radius/radacct/10.8.4.36/auth-detail-20181207 (0) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/auth-detail-20181207 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Dec 7 18:31:40 2018 (0) [auth_log] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ec2624", looking up realm NULL (0) suffix: Found realm "NULL" (0) suffix: Adding Stripped-User-Name = "ec2624" (0) suffix: Adding Realm = "NULL" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) files: users: Matched entry DEFAULT at line 1 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> ec2624 (0) sql: SQL-User-Name set to 'ec2624' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'ec2624' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'ec2624' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='ec2624' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='ec2624' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (0) sql: User found in the group table (0) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TIER-4_RW' ORDER BY id (0) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TIER-4_RW' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: Group "TIER-4_RW": Conditional check items matched (0) sql: Group "TIER-4_RW": Merging assignment check items (0) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TIER-4_RW' ORDER BY id (0) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TIER-4_RW' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: Group "TIER-4_RW": Merging reply items rlm_sql (sql): Released connection (0) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = ok (0) Starting proxy to home server 135.37.245.6 port 1812 (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) pre_proxy_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d (0) pre_proxy_log: --> /var/log/radius/radacct/10.8.4.36/pre-proxy-detail-20181207 (0) pre_proxy_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/pre-proxy-detail-20181207 (0) pre_proxy_log: EXPAND %t (0) pre_proxy_log: --> Fri Dec 7 18:31:40 2018 (0) [pre_proxy_log] = ok (0) } # pre-proxy = ok (0) Proxying request to home server 135.37.245.6 port 1812 timeout 30.000000 (0) Sent Access-Request Id 216 from 0.0.0.0:44743 to 135.37.245.6:1812 length 103 (0) User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" (0) NAS-IP-Address = 10.8.4.36 (0) NAS-Port-Type = Virtual (0) NAS-Port = 1 (0) Calling-Station-Id = "10.2.2.31" (0) User-Name = "ec2624" (0) Event-Timestamp = "Dec 7 2018 18:31:40 GMT" (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3230 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 29.668236 seconds from now Waking up in 29.6 seconds. (0) Marking home server 135.37.245.6 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 216 from 135.37.245.6:1812 to 10.8.2.16:44743 length 24 (0) Proxy-State = 0x3230 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) post_proxy_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d (0) post_proxy_log: --> /var/log/radius/radacct/10.8.4.36/post-proxy-detail-20181207 (0) post_proxy_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.8.4.36/post-proxy-detail-20181207 (0) post_proxy_log: EXPAND %t (0) post_proxy_log: --> Fri Dec 7 18:31:40 2018 (0) [post_proxy_log] = ok (0) eap: No pre-existing handler found (0) [eap] = noop (0) update proxy-reply { (0) Filter-Id !* ANY (0) Fortinet-Access-Profile !* ANY (0) Juniper-Local-User-Name !* ANY (0) Cisco-AVPair !* ANY (0) PaloAlto-Admin-Role !* ANY (0) PaloAlto-Panorama-Admin-Role !* ANY (0) F5-LTM-User-Info-1 !* ANY (0) } # update proxy-reply = noop (0) if ("%{proxy-reply:Packet-Type}" == Access-Accept) { (0) EXPAND %{proxy-reply:Packet-Type} (0) --> Access-Reject (0) if ("%{proxy-reply:Packet-Type}" == Access-Accept) -> FALSE (0) } # post-proxy = ok (0) EXPAND %{User-Name} failed authentication for %{Packet-Src-IP-Address} (0) --> ec2624 failed authentication for 10.8.4.36 (0) Login incorrect (Home Server says so): [ec2624] (from client evtlmdt-chnp11 port 1 cli 10.2.2.31) ec2624 failed authentication for 10.8.4.36 (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> ec2624 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 20 from 10.8.2.16:1812 to 10.8.4.36:1812 length 20 Waking up in 3.9 seconds. Waking up in 5.3 seconds. I noticed that this field User-Password = "\346)!M\367\341\233\305F\342\344\227\350\245\327\313" seems to be the issue but i am not certain. I think this data is being sent to the rsa server instead of clear text. The clear text value of that password is 16752550. This is an OTP. But when we are authenticating to a linux host, the password field is clear text. In our version 2.0, we are able to authenticate to the cisco gear. I am still learning freeradius and would like if you can point me how to fix this. mds