Hi, i'm implementing authentication for 802.1X using Freeradius (version 2.1.6 ) in Fedora10. The supplicant is windows XP wiht Service pack 3. The NAS is Switch cisco and the network is wire. My problem is what the connection works good when the autentication is for user and password, but if changing the configuration for authenticate using certified the authentication the connection fails. In this case to use user and password, validating the certificate server works good, is fact windows xp requires the confirm the server certificate. The certificate server and certificate client have been generated by the same CA( this is own) y with the OID's required for Windows. The problem is when the server ask for the certified client the connection seems to cut, the question is: (considering what the configuration is the recommended por varios documents and tutorials, at least is what I mean) which could be the problem??? The final in radius -X say: rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=124 Cleaning up request 81 ID 0 with timestamp +1769 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" State = 0xe985bf0fef95a607b34238093b97add2 EAP-Message = 0x021000251900170301001a11c6b5cf6d88c21a6758d861aa6d49e3a4686ffa5cb4a4380d20 Message-Authenticator = 0x46f742c7927f46d42c9708a756a03bfd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 16 length 37 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - mz254.mtm [peap] Got tunneled request EAP-Message = 0x0210000e016d7a3235342e6d746d server { PEAP: Got tunneled identity of mz254.mtm PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to mz254.mtm Sending tunneled request EAP-Message = 0x0210000e016d7a3235342e6d746d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mz254.mtm" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 16 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x011100231a0111001e10a7a80a0d95340caaef928a607b6afaec6d7a3235342e6d746d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40820cb8cd5b8829097e99997 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011100231a0111001e10a7a80a0d95340caaef928a607b6afaec6d7a3235342e6d746d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40820cb8cd5b8829097e99997 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x0111003a1900170301002fe48c43420e254b8de5958f35506d01a8077e703876321c1aac403281cf905c26fe5e4e8d17c412c32d2f6db08d876b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe985bf0fee94a607b34238093b97add2 Finished request 82. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=116 Cleaning up request 82 ID 0 with timestamp +1769 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" State = 0xe985bf0fee94a607b34238093b97add2 EAP-Message = 0x0211001d19001703010012d4f65388faa55d96da4c39fd25a2781ab64d Message-Authenticator = 0x0ddd687b9218a2e5cb52ae4e06735fc8 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 17 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type nak [peap] Got tunneled request EAP-Message = 0x02110006030d server { PEAP: Setting User-Name to mz254.mtm Sending tunneled request EAP-Message = 0x02110006030d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mz254.mtm" State = 0x0831d1c40820cb8cd5b8829097e99997 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 17 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x011200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40923dc8cd5b8829097e99997 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40923dc8cd5b8829097e99997 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x0112001d19001703010012cae867eb763daa542fc65b9c67ab94c4fe21 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe985bf0fe197a607b34238093b97add2 Finished request 83. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=190 Cleaning up request 83 ID 0 with timestamp +1769 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" State = 0xe985bf0fe197a607b34238093b97add2 EAP-Message = 0x021200671900170301005ce0549b2a1b945c71e5696bd5b46950b5958ac040274a4217e3ff26d685a74594049fea12d4bae4e09c7119bad31cea81699dd953c79b536dd53dfead7281499ace37ff9cdbf342a5c7803673b2f09883b16fabbe5b3ca8fc81e6ac81 Message-Authenticator = 0xe50342f509c7d70a7a40b733653658fd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 18 length 103 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type tls [peap] Got tunneled request EAP-Message = 0x021200500d800000004616030100410100003d03014dc01a18f6c3d3a9524dc7896df274307ebd918011714be32204ce96e3108ff600001600040005000a000900640062000300060013001200630100 server { PEAP: Setting User-Name to mz254.mtm Sending tunneled request EAP-Message = 0x021200500d800000004616030100410100003d03014dc01a18f6c3d3a9524dc7896df274307ebd918011714be32204ce96e3108ff600001600040005000a000900640062000300060013001200630100 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mz254.mtm" State = 0x0831d1c40923dc8cd5b8829097e99997 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 18 length 80 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 081a], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 007c], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x011304000dc0000008cf160301002a0200002603014dc014ba69a4e4904b4864f80ed6cf43eea65370906c43feb609f3234613502000000400160301081a0b0008160008130003ef308203eb308202d3a00302010202010b300d06092a864886f70d0101050500306b310b30090603550406130241523110300e060355040813074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c4720507275656261311b3019060355040313124341204d6f6e74656d617220507275656261301e170d3131303432373136333734375a170d3133303432363136333734375a3073310b3009060355 EAP-Message = 0x0406130241523110300e060355040813074d656e646f7a613110300e060355040713074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c47205072756562613111300f060355040313086665646f7261303130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6deee09048786218bf3e874398aa662c6f61b9298eddf33d3663a8d85e51b3031a70046ba1c15695976ff4dc78498f6e27f432d6df5c42349a29241a955d07c813a6ef8690ddf16eefb5fa414f3e2ecc29eacf9224660361dd7839431f85106bc5e8f890e236705f4afb860bc7d22fd EAP-Message = 0x146f9aeffc1404a8f961a297ecca08d38554f3e0ac75940614a7765893f0da2bbd0a4382b76a742d97be8fb014e6c397668877a140bf69537fe526af59194c876b008b5187bb56d5a8b30abbd2d746b029d1b528eb844db590fcb48da7a186c9faf0e691a25b233434e2713afde902236a3393c16b22c756ff1ba0ee75036f8cca897cce5edd7166f6644d5dda79e3ab0203010001a3819130818e30130603551d25040c300a06082b0601050507030130090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604148929112c325ec9491b EAP-Message = 0xda7461f9df24f3a0d26cc8301f0603551d23041830168014e6a44a4b3671560188d79e38de3e6c523ec2979a300d06092a864886f70d01010505000382010100272aaa1e38409b4ccee282d77457651dae1d93892fea8d4e0d5617e84637870806c313c3fc1c625beb7b4d00276dbfaddaae0ccc8958c968dda5ac507b2b9aa08821fdbe6275f928ca9dfdb36ade702778b65800947aabba3921d7d3fda04d2565cd41835cbc243435bdd012c62d59ee3dfeec2a39a6aef03668620a1657e4617264abbc72073a8a093012f40c61735d118bcf66596df8943f2f7c448d89423fda29e43ed1983cdfe07a2f435a4ff406a716ab22f67ba400f653b2b74b EAP-Message = 0xacd7d2074a502468df7e7963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40a22dc8cd5b8829097e99997 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011304000dc0000008cf160301002a0200002603014dc014ba69a4e4904b4864f80ed6cf43eea65370906c43feb609f3234613502000000400160301081a0b0008160008130003ef308203eb308202d3a00302010202010b300d06092a864886f70d0101050500306b310b30090603550406130241523110300e060355040813074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c4720507275656261311b3019060355040313124341204d6f6e74656d617220507275656261301e170d3131303432373136333734375a170d3133303432363136333734375a3073310b3009060355 EAP-Message = 0x0406130241523110300e060355040813074d656e646f7a613110300e060355040713074d656e646f7a6131183016060355040a130f4d6f6e74656d61722050727565626131133011060355040b130a534c47205072756562613111300f060355040313086665646f7261303130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6deee09048786218bf3e874398aa662c6f61b9298eddf33d3663a8d85e51b3031a70046ba1c15695976ff4dc78498f6e27f432d6df5c42349a29241a955d07c813a6ef8690ddf16eefb5fa414f3e2ecc29eacf9224660361dd7839431f85106bc5e8f890e236705f4afb860bc7d22fd EAP-Message = 0x146f9aeffc1404a8f961a297ecca08d38554f3e0ac75940614a7765893f0da2bbd0a4382b76a742d97be8fb014e6c397668877a140bf69537fe526af59194c876b008b5187bb56d5a8b30abbd2d746b029d1b528eb844db590fcb48da7a186c9faf0e691a25b233434e2713afde902236a3393c16b22c756ff1ba0ee75036f8cca897cce5edd7166f6644d5dda79e3ab0203010001a3819130818e30130603551d25040c300a06082b0601050507030130090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604148929112c325ec9491b EAP-Message = 0xda7461f9df24f3a0d26cc8301f0603551d23041830168014e6a44a4b3671560188d79e38de3e6c523ec2979a300d06092a864886f70d01010505000382010100272aaa1e38409b4ccee282d77457651dae1d93892fea8d4e0d5617e84637870806c313c3fc1c625beb7b4d00276dbfaddaae0ccc8958c968dda5ac507b2b9aa08821fdbe6275f928ca9dfdb36ade702778b65800947aabba3921d7d3fda04d2565cd41835cbc243435bdd012c62d59ee3dfeec2a39a6aef03668620a1657e4617264abbc72073a8a093012f40c61735d118bcf66596df8943f2f7c448d89423fda29e43ed1983cdfe07a2f435a4ff406a716ab22f67ba400f653b2b74b EAP-Message = 0xacd7d2074a502468df7e7963 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0831d1c40a22dc8cd5b8829097e99997 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x0113040019c000000411170301040c0a26e6079ff37415887c6e864dbd7b3b93a29852b3a0143f07a8409f3f94620de9084bb6aafda166ef99945d4f51acf414b02543a15a55f60e418d7624b73f431f5fd023c8986bc0a889304bc68a0e333b8d431b0e6a84c06e8b9fdb782e175e03e6c9d8107ae3f4d1df94e2df4b719f67d0406304a53e8041e9ba18cee4c91521c57846e3327b4a2c73f4c787efc359a15d6ed82fa319c0aa724c9c521712231365e20a1e8d4b041494fd0193fd2c015a7091a0fb5ff693a4dfb94ff8c75ad7260300ee2619364f2e0db579a6ce831bb3dd816113b547a79f173c3dc5a01336704d9a63af0e290cd9518c27b682 EAP-Message = 0x71df0c5e2d1e95ef2f49647a42369c8be08448f5c5c8de03eaabfd4db90ca1dfacbd497f191fa1e6799b06dbb3f560fe7ef7e5d8c76581a09c860f9127c1dbfff4286db4af3bb405d3c20d7846828136ef1f164784786cb44933add06fff29457d058b7785683d39e41965ecb1b96ee6fd5d908cc5c62142858b958ad641304b74fd5d272633f7ce4dd61a01383ce6db3e0f80d06b00668a925038cec0c638efadc27f01aa50c4f3d17ef7204da74ddf17096e347f1d4f511895b58ccf7e4d2e7a09de3a36f19e1ff345e9e784620c13f2cdbd0cff512bf77f8c28878b5074c7cbbe43647dc45cbfb681950dc6e9a0502202c044276683359662e6b0ca EAP-Message = 0x330b19a685b14bddafcc997a81e82534c5a69f2b5c498b01fda904ce743d8c7c523906aed3b76cee8b0fe1bcede93aef85aa0adbc4b6657710f0e7a2a72a285abc13a2d9b5ffb8bc99d28235e1db82373bd8660b015aa504b7a2c0db198b4f8dcd6fc42c73af72854125d18f8cb03ccd96979982db76c4b4752a5aa5f83782e570806d882a3c7d01f633ad8b733650709304ee76a146c75ef2344dc701f974ef882a7939aa0662814637db4798c8d471a9332656dacff4aa05930e2919c50ffc317e094986e557f5247860d227607676a99252b53d08e4364a81f85deb3d9fb7deb93fb1eda64c9fbd1811828eb11e82b3d27d032664d6ca8f5fe818d2 EAP-Message = 0xcdc91b24b32d3cb7941a25a4fe03ff434755f898bb5fa1c1d695c9ddeda1cb008573525bd6b46b134138672c0afde2337d5c282de83ac2c08795319a7fc6e07b92736796bec8749aa4082dfa7cf66f706102c334f6773dd0ca9ebf759f565bafe4c4292261ffedf19bec22aa1eced2d6ed61a6c28b6ef5cdc37ac18a523071d9e9e23475d36cb4cfbe034b72ecccb17b0bfaecd7839b96baba4ba4be20b02eda7ca728d016eaa5e4098bed3bd0c3bfdd9c393170e0c1799062670ca8cda12a904bdfb4974c248d696f577754da2057f9167eaca632bc4e73c79e58db0d69a7ea8ac9a8942aaf6e6a5f086eeb7dbeca84a2cc9d63c5e9fe4d26fd87ecd4 EAP-Message = 0x21fadae229d18ab0506ef141 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe985bf0fe096a607b34238093b97add2 Finished request 84. Going to the next request Waking up in 4.9 seconds. Cleaning up request 84 ID 0 with timestamp +1769 Ready to process requests. rad_recv: Access-Request packet from host 192.168.101.254 port 49154, id=0, length=83 NAS-IP-Address = 192.168.101.254 NAS-Port-Type = Ethernet NAS-Port = 5 User-Name = "mz254.mtm" EAP-Message = 0x0214000e016d7a3235342e6d746d Message-Authenticator = 0x78f7a34500a508c5078c6c93779f7575 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mz254.mtm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 20 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.101.254 port 49154 EAP-Message = 0x011500060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ff1a38a0fe4ae700e5cfd450ee7a44f Finished request 85. Going to the next request Waking up in 4.9 seconds. Cleaning up request 85 ID 0 with timestamp +1787 Ready to process requests. Thanks.