On 9/20/06, Florian Prester <Florian.Prester@rrze.uni-erlangen.de> wrote:
Also I have some questions about eap at all. How should it work correctly. because I see up to 10 Authentication-Requests until the client is authenticated correctly. For example the client wants to do EAP-PEAP (Windows-client), but the radius says EAP-NAK: rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 231 modcall: leaving group authenticate (returns handled) for request 231 Sending Access-Challenge ... Finished request 231
What does it mean? Can I tune the process?
My guess would be, that your default_eap_type in eap.conf is not set to peap. So your supplicant (XP) is sending the NAK (not the server, it just logs that it got the NAK) to get the server to use peap. Depending on your needs you could change it. That's a normal part of EAP. As is the sending back and forth of Access-Requests and Access-Challenges to negotiate the details inherent to EAP.
Log: rad_recv: Access-Request packet from host 131.188.4.190:20000, id=35, length=202 NAS-Port-Id = "2059/1" Calling-Station-Id = "00-15-00-01-C0-D1" Called-Station-Id = "00-0B-0E-15-3D-80:FAU-STAFF" Service-Type = Framed-User User-Name = "unrz06" State = 0x... EAP-Message = 0x... NAS-Port-Type = Wireless-802.11 NAS-Identifier = "Trapeze" NAS-IP-Address = 131.188.4.190 Message-Authenticator = 0x...
The username looks like a machine name for .uni-erlangen.de. Do you intend to use machine authentication? If so, what does a succesful request look like? Note, that it seems to only find matching DEFAULT entries, so peap would be impossible, as no User-Password is known to freeradius. Otherwise, you should check your XP setup to use the intended username/password credentials combo. regards K. Hoercher