No Connection Windows 8 and 10 in wpa2-enterprise

1 Jul 2022

      Hi Guys!

I have a freeradius with Google LDAP and it works fine on Windows 11
and Chromebooks, but clients in Windows 10 and Windows 8 can't login
to the network. It just says "You can't connect to this network". I
tried a lot of different stuff on the Windows side but it didn't work
at all.

 I adjusted my tls_min_version to 1.0 and tls_max_version to 1.2 and
commented disable_tlsv1_1 and disable_tlsv1 on my eap config file on
my server, but with no effect. Did you have a similar problem before?

This is a debug from a login attempt from a windows 8 user:

FreeRADIUS Version 3.0.21
Copyright (C) 1999-2019 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/3.0/dictionary
including configuration file /etc/freeradius/3.0/radiusd.conf
including configuration file /etc/freeradius/3.0/proxy.conf
including configuration file /etc/freeradius/3.0/clients.conf
including files in directory /etc/freeradius/3.0/mods-enabled/
including configuration file /etc/freeradius/3.0/mods-enabled/unix
including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients
including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter
including configuration file /etc/freeradius/3.0/mods-enabled/sqlcounter
including configuration file
/etc/freeradius/3.0/mods-config/sql/counter/mysql/dailycounter.conf
including configuration file
/etc/freeradius/3.0/mods-config/sql/counter/mysql/monthlycounter.conf
including configuration file
/etc/freeradius/3.0/mods-config/sql/counter/mysql/noresetcounter.conf
including configuration file
/etc/freeradius/3.0/mods-config/sql/counter/mysql/expire_on_login.conf
including configuration file
/etc/freeradius/3.0/mods-config/sql/counter/mysql/accessperiod.conf
including configuration file
/etc/freeradius/3.0/mods-config/sql/counter/mysql/quotalimit.conf
including configuration file /etc/freeradius/3.0/mods-enabled/linelog
including configuration file /etc/freeradius/3.0/mods-enabled/expr
including configuration file /etc/freeradius/3.0/mods-enabled/always
including configuration file /etc/freeradius/3.0/mods-enabled/replicate
including configuration file /etc/freeradius/3.0/mods-enabled/echo
including configuration file /etc/freeradius/3.0/mods-enabled/pap
including configuration file /etc/freeradius/3.0/mods-enabled/eap
including configuration file /etc/freeradius/3.0/mods-enabled/logintime
including configuration file /etc/freeradius/3.0/mods-enabled/mschap
including configuration file /etc/freeradius/3.0/mods-enabled/files
including configuration file /etc/freeradius/3.0/mods-enabled/exec
including configuration file /etc/freeradius/3.0/mods-enabled/preprocess
including configuration file /etc/freeradius/3.0/mods-enabled/utf8
including configuration file /etc/freeradius/3.0/mods-enabled/soh
including configuration file /etc/freeradius/3.0/mods-enabled/expiration
including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp
including configuration file /etc/freeradius/3.0/mods-enabled/passwd
including configuration file /etc/freeradius/3.0/mods-enabled/chap
including configuration file /etc/freeradius/3.0/mods-enabled/ldap
including configuration file /etc/freeradius/3.0/mods-enabled/realm
including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth
including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap
including configuration file /etc/freeradius/3.0/mods-enabled/radutmp
including configuration file /etc/freeradius/3.0/mods-enabled/sql
including configuration file
/etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf
including configuration file /etc/freeradius/3.0/mods-enabled/detail
including configuration file /etc/freeradius/3.0/mods-enabled/unpack
including configuration file /etc/freeradius/3.0/mods-enabled/digest
including configuration file /etc/freeradius/3.0/mods-enabled/detail.log
including files in directory /etc/freeradius/3.0/policy.d/
including configuration file /etc/freeradius/3.0/policy.d/canonicalization
including configuration file /etc/freeradius/3.0/policy.d/filter
including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids
including configuration file /etc/freeradius/3.0/policy.d/eap
including configuration file /etc/freeradius/3.0/policy.d/dhcp
including configuration file /etc/freeradius/3.0/policy.d/operator-name
including configuration file /etc/freeradius/3.0/policy.d/accounting
including configuration file /etc/freeradius/3.0/policy.d/control
including configuration file /etc/freeradius/3.0/policy.d/cui
including configuration file /etc/freeradius/3.0/policy.d/rfc7542
including configuration file /etc/freeradius/3.0/policy.d/debug
including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
including files in directory /etc/freeradius/3.0/sites-enabled/
including configuration file /etc/freeradius/3.0/sites-enabled/default
including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel
main {
 security {
        user = "freerad"
        group = "freerad"
        allow_core_dumps = no
 }
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
}
main {
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        sbindir = "/usr/sbin"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
        libdir = "/usr/lib/freeradius"
        radacctdir = "/var/log/freeradius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 16384
        pidfile = "/var/run/freeradius/freeradius.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
        stripped_names = no
        auth = no
        auth_badpass = no
        auth_goodpass = no
        colourise = yes
        msg_denied = "You are already logged in - access denied"
 }
 resources {
 }
 security {
        max_attributes = 200
        reject_delay = 1.000000
        status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
 }
 home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 20.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 120
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
 realm company.com {
 }
radiusd: #### Loading Clients ####
 client localhost {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = <<< secret >>>
        nas_type = "other"
        proto = "*"
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
 client localhost_ipv6 {
        ipv6addr = ::1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
Debugger not attached
systemd watchdog is disabled
 # Creating Auth-Type = mschap
 # Creating Auth-Type = digest
 # Creating Auth-Type = ldap
 # Creating Auth-Type = eap
 # Creating Auth-Type = PAP
 # Creating Auth-Type = CHAP
 # Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
 modules {
  # Loaded module rlm_unix
  # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix
  unix {
        radwtmp = "/var/log/freeradius/radwtmp"
  }
Creating attribute Unix-Group
  # Loaded module rlm_dynamic_clients
  # Loading module "dynamic_clients" from file
/etc/freeradius/3.0/mods-enabled/dynamic_clients
  # Loaded module rlm_attr_filter
  # Loading module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
        filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy"
        key = "%{Realm}"
        relaxed = no
  }
  # Loading module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
        filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy"
        key = "%{Realm}"
        relaxed = no
  }
  # Loading module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
        filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loading module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
        filename =
"/etc/freeradius/3.0/mods-config/attr_filter/access_challenge"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loading module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
        filename =
"/etc/freeradius/3.0/mods-config/attr_filter/accounting_response"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loaded module rlm_sqlcounter
  # Loading module "dailycounter" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
  sqlcounter dailycounter {
        sql_module_instance = "sql"
        key = "User-Name"
        query = "SELECT SUM(acctsessiontime - GREATEST((%%b -
UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username =
'%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime >
'%%b'"
        reset = "daily"
        counter_name = "Daily-Session-Time"
        check_name = "Max-Daily-Session"
        reply_name = "Session-Timeout"
  }
  # Loading module "monthlycounter" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
  sqlcounter monthlycounter {
        sql_module_instance = "sql"
        key = "User-Name"
        query = "SELECT SUM(acctsessiontime - GREATEST((%%b -
UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE
username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) +
acctsessiontime > '%%b'"
        reset = "monthly"
        counter_name = "Monthly-Session-Time"
        check_name = "Max-Monthly-Session"
        reply_name = "Session-Timeout"
  }
  # Loading module "noresetcounter" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
  sqlcounter noresetcounter {
        sql_module_instance = "sql"
        key = "User-Name"
        query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct
WHERE UserName='%{User-Name}'"
        reset = "never"
        counter_name = "Max-All-Session-Time"
        check_name = "Max-All-Session"
        reply_name = "Session-Timeout"
  }
  # Loading module "expire_on_login" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
  sqlcounter expire_on_login {
        sql_module_instance = "sql"
        key = "User-Name"
        query = "SELECT IFNULL( MAX(TIME_TO_SEC(TIMEDIFF(NOW(),
acctstarttime))),0) FROM radacct WHERE UserName='%{User-Name}' ORDER
BY acctstarttime LIMIT 1;"
        reset = "never"
        counter_name = "Expire-After-Initial-Login"
        check_name = "Expire-After"
        reply_name = "Session-Timeout"
  }
  # Loading module "accessperiod" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
  sqlcounter accessperiod {
        sql_module_instance = "sql"
        key = "User-Name"
        query = "SELECT UNIX_TIMESTAMP() -
UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE
UserName='%{User-Name}' ORDER BY AcctStartTime LIMIT 1"
        reset = "never"
        counter_name = "Max-Access-Period-Time"
        check_name = "Access-Period"
        reply_name = "Session-Timeout"
  }
  # Loading module "quotalimit" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
  sqlcounter quotalimit {
        sql_module_instance = "sql"
        key = "User-Name"
        query = "SELECT (SUM(acctinputoctets) + SUM(acctoutputoctets))
FROM radacct WHERE UserName='%{User-Name}'"
        reset = "never"
        counter_name = "Max-Volume"
        check_name = "Max-Data"
        reply_name = "Mikrotik-Total-Limit"
  }
  # Loaded module rlm_linelog
  # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog
  linelog {
        filename = "/var/log/freeradius/linelog"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = "This is a log message for %{User-Name}"
        reference = "messages.%{%{reply:Packet-Type}:-default}"
  }
  # Loading module "log_accounting" from file
/etc/freeradius/3.0/mods-enabled/linelog
  linelog log_accounting {
        filename = "/var/log/freeradius/linelog-accounting"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  }
  # Loaded module rlm_expr
  # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr
  expr {
        safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Loaded module rlm_always
  # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always
  always reject {
        rcode = "reject"
        simulcount = 0
        mpp = no
  }
  # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always
  always fail {
        rcode = "fail"
        simulcount = 0
        mpp = no
  }
  # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  always ok {
        rcode = "ok"
        simulcount = 0
        mpp = no
  }
  # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always
  always handled {
        rcode = "handled"
        simulcount = 0
        mpp = no
  }
  # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always
  always invalid {
        rcode = "invalid"
        simulcount = 0
        mpp = no
  }
  # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always
  always userlock {
        rcode = "userlock"
        simulcount = 0
        mpp = no
  }
  # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always
  always notfound {
        rcode = "notfound"
        simulcount = 0
        mpp = no
  }
  # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always
  always noop {
        rcode = "noop"
        simulcount = 0
        mpp = no
  }
  # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always
  always updated {
        rcode = "updated"
        simulcount = 0
        mpp = no
  }
  # Loaded module rlm_replicate
  # Loading module "replicate" from file
/etc/freeradius/3.0/mods-enabled/replicate
  # Loaded module rlm_exec
  # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo
  exec echo {
        wait = yes
        program = "/bin/echo %{User-Name}"
        input_pairs = "request"
        output_pairs = "reply"
        shell_escape = yes
  }
  # Loaded module rlm_pap
  # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  pap {
        normalise = yes
  }
  # Loaded module rlm_eap
  # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  eap {
        default_eap_type = "ttls"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 16384
  }
  # Loaded module rlm_logintime
  # Loading module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
  logintime {
        minimum_timeout = 60
  }
  # Loaded module rlm_mschap
  # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = yes
   passchange {
   }
        allow_retry = yes
        winbind_retry_with_normalised_username = no
  }
  # Loaded module rlm_files
  # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files
  files {
        filename = "/etc/freeradius/3.0/mods-config/files/authorize"
        acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting"
        preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy"
  }
  # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
        timeout = 10
  }
  # Loaded module rlm_preprocess
  # Loading module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
  preprocess {
        huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups"
        hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
  # Loaded module rlm_utf8
  # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8
  # Loaded module rlm_soh
  # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh
  soh {
        dhcp = yes
  }
  # Loaded module rlm_expiration
  # Loading module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
  # Loaded module rlm_radutmp
  # Loading module "sradutmp" from file
/etc/freeradius/3.0/mods-enabled/sradutmp
  radutmp sradutmp {
        filename = "/var/log/freeradius/sradutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 420
        caller_id = no
  }
  # Loaded module rlm_passwd
  # Loading module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
  passwd etc_passwd {
        filename = "/etc/passwd"
        format = "*User-Name:Crypt-Password:"
        delimiter = ":"
        ignore_nislike = no
        ignore_empty = yes
        allow_multiple_keys = no
        hash_size = 100
  }
  # Loaded module rlm_chap
  # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap
  # Loaded module rlm_ldap
  # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap
  ldap {
        server = "ldaps://ldap.google.com"
        port = 636
        identity = "PracticalG"
        password = <<< secret >>>
   sasl {
   }
        user_dn = "LDAP-UserDn"
   user {
        scope = "sub"
        access_positive = yes
    sasl {
    }
   }
   group {
        filter = "(objectClass=posixGroup)"
        scope = "sub"
        name_attribute = "cn"
        membership_attribute = "memberOf"
        cacheable_name = no
        cacheable_dn = no
        allow_dangling_group_ref = no
   }
   client {
        filter = "(objectClass=radiusClient)"
        scope = "sub"
        base_dn = "dc=company,dc=com"
   }
   profile {
   }
   options {
        ldap_debug = 40
        chase_referrals = yes
        rebind = yes
        net_timeout = 1
        res_timeout = 10
        srv_timelimit = 3
        idle = 60
        probes = 3
        interval = 3
   }
   tls {
        certificate_file = "/etc/freeradius/3.0/certs/freeradius_2025_06_02.crt"
        private_key_file = "/etc/freeradius/3.0/certs/freeradius_2025_06_02.key"
        start_tls = no
        require_cert = "allow"
   }
  }
Creating attribute LDAP-Group
  # Loaded module rlm_realm
  # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
  realm IPASS {
        format = "prefix"
        delimiter = "/"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm
  realm bangpath {
        format = "prefix"
        delimiter = "!"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
  realm realmpercent {
        format = "suffix"
        delimiter = "%"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm
  realm ntdomain {
        format = "prefix"
        delimiter = "\\"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "ntlm_auth" from file
/etc/freeradius/3.0/mods-enabled/ntlm_auth
  exec ntlm_auth {
        wait = yes
        program = "/path/to/ntlm_auth --request-nt-key
--domain=MYDOMAIN --username=%{mschap:User-Name}
--password=%{User-Password}"
        shell_escape = yes
  }
  # Loaded module rlm_cache
  # Loading module "cache_eap" from file
/etc/freeradius/3.0/mods-enabled/cache_eap
  cache cache_eap {
        driver = "rlm_cache_rbtree"
        key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
        ttl = 15
        max_entries = 0
        epoch = 0
        add_stats = no
  }
  # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp
  radutmp {
        filename = "/var/log/freeradius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 384
        caller_id = yes
  }
  # Loaded module rlm_sql
  # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql
  sql {
        driver = "rlm_sql_mysql"
        server = "localhost"
        port = 3306
        login = "radius"
        password = <<< secret >>>
        radius_db = "radius"
        read_groups = yes
        read_profiles = yes
        read_clients = yes
        delete_stale_sessions = yes
        sql_user_name = "%{User-Name}"
        default_user_profile = ""
        client_query = "SELECT id, nasname, shortname, type, secret,
server FROM nas"
        authorize_check_query = "SELECT id, username, attribute,
value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY
id"
        authorize_reply_query = "SELECT id, username, attribute,
value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY
id"
        authorize_group_check_query = "SELECT id, groupname,
attribute, Value, op FROM radgroupcheck WHERE groupname =
'%{SQL-Group}' ORDER BY id"
        authorize_group_reply_query = "SELECT id, groupname,
attribute, value, op FROM radgroupreply WHERE groupname =
'%{SQL-Group}' ORDER BY id"
        group_membership_query = "SELECT groupname FROM radusergroup
WHERE username = '%{SQL-User-Name}' ORDER BY priority"
        simul_count_query = "SELECT COUNT(*) FROM radacct WHERE
username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
        safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/"
        auto_escape = no
   accounting {
        reference =
"%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}"
    type {
     accounting-on {
        query = "UPDATE radacct SET acctstoptime =
FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime   =
'%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime),
acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE
acctstoptime IS NULL AND nasipaddress   = '%{NAS-IP-Address}' AND
acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})"
     }
     accounting-off {
        query = "UPDATE radacct SET acctstoptime =
FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime   =
'%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime),
acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE
acctstoptime IS NULL AND nasipaddress   = '%{NAS-IP-Address}' AND
acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})"
     }
     start {
        query = "INSERT INTO radacct (acctsessionid,
acctuniqueid,           username, realm,      nasipaddress,
nasportid, nasporttype,         acctstarttime,
acctupdatetime, acctstoptime, acctsessiontime,         acctauthentic,
connectinfo_start,       connectinfo_stop,       acctinputoctets,
acctoutputoctets,     calledstationid,        callingstationid,
acctterminatecause,   servicetype,            framedprotocol,
framedipaddress,       framedipv6address,      framedipv6prefix,
framedinterfaceid,    delegatedipv6prefix) VALUES
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',
'%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}',
'%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}',
FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}),
FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), NULL, '0',
'%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0',
'%{Called-Station-Id}', '%{Calling-Station-Id}', '',
'%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',
'%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}',
'%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}')"
     }
     interim-update {
        query = "UPDATE radacct SET acctupdatetime  =
(@acctupdatetime_old:=acctupdatetime), acctupdatetime  =
FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctinterval    =
%{%{integer:Event-Timestamp}:-%l} -
UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress =
'%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}',
framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid =
'%{Framed-Interface-Id}', delegatedipv6prefix =
'%{Delegated-IPv6-Prefix}', acctsessiontime =
%{%{Acct-Session-Time}:-NULL}, acctinputoctets =
'%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}',
acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 |
'%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId =
'%{Acct-Unique-Session-Id}'"
     }
     stop {
        query = "UPDATE radacct SET acctstoptime        =
FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime    =
%{%{Acct-Session-Time}:-NULL}, acctinputoctets        =
'%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}',
acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 |
'%{%{Acct-Output-Octets}:-0}', acctterminatecause =
'%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE
AcctUniqueId = '%{Acct-Unique-Session-Id}'"
     }
    }
   }
   post-auth {
        reference = ".query"
        query = "INSERT INTO radpostauth (username, pass, reply,
authdate) VALUES ( '%{SQL-User-Name}',
'%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}',
'%S.%M')"
   }
  }
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
Creating attribute SQL-Group
  # Loaded module rlm_detail
  # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail
  detail {
        filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loaded module rlm_unpack
  # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack
  # Loaded module rlm_digest
  # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest
  # Loading module "auth_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail auth_log {
        filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail reply_log {
        filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail pre_proxy_log {
        filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail post_proxy_log {
        filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  instantiate {
  }
  # Instantiating module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy
  # Instantiating module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy
  # Instantiating module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject
  # Instantiating module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/accounting_response
  # Instantiating module "dailycounter" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
rlm_sqlcounter: Current Time: 1656679812 [2022-07-01 09:50:12], Prev
reset 1656644400 [2022-07-01 00:00:00]
  # Instantiating module "monthlycounter" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
rlm_sqlcounter: Current Time: 1656679812 [2022-07-01 09:50:12], Prev
reset 1656644400 [2022-07-01 00:00:00]
  # Instantiating module "noresetcounter" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
rlm_sqlcounter: Current Time: 1656679812 [2022-07-01 09:50:12], Prev
reset 0 [2022-07-01 09:00:00]
  # Instantiating module "expire_on_login" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
rlm_sqlcounter: Current Time: 1656679812 [2022-07-01 09:50:12], Prev
reset 0 [2022-07-01 09:00:00]
  # Instantiating module "accessperiod" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
rlm_sqlcounter: Current Time: 1656679812 [2022-07-01 09:50:12], Prev
reset 0 [2022-07-01 09:00:00]
  # Instantiating module "quotalimit" from file
/etc/freeradius/3.0/mods-enabled/sqlcounter
rlm_sqlcounter: Current Time: 1656679812 [2022-07-01 09:50:12], Prev
reset 0 [2022-07-01 09:00:00]
  # Instantiating module "linelog" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "log_accounting" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "reject" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "fail" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "handled" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "invalid" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "userlock" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "notfound" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "noop" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "updated" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
   # Linked to sub-module rlm_eap_md5
   # Linked to sub-module rlm_eap_leap
   # Linked to sub-module rlm_eap_gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
   # Linked to sub-module rlm_eap_tls
   tls {
        tls = "tls-common"
   }
   tls-config tls-common {
        verify_depth = 0
        ca_path = "/etc/freeradius/3.0/certs"
        pem_file_type = yes
        private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key"
        certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
        ca_file = "/etc/ssl/certs/ca-certificates.crt"
        private_key_password = <<< secret >>>
        dh_file = "/etc/freeradius/3.0/certs/dh"
        fragment_size = 1024
        include_length = yes
        auto_chain = yes
        check_crl = no
        check_all_crl = no
        cipher_list = "DEFAULT"
        cipher_server_preference = no
        ecdh_curve = "prime256v1"
        tls_max_version = "1.2"
        tls_min_version = "1.0"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
        skip_if_ocsp_ok = no
    }
    ocsp {
        enable = no
        override_cert_url = yes
        url = "http://127.0.0.1/ocsp/"
        use_nonce = yes
        timeout = 0
        softfail = no
    }
   }
The configuration allows TLS 1.0 and/or TLS 1.1.  We STRONGLY
recommned using only TLS 1.2 for security
Please set: tls_min_version = "1.2"
   # Linked to sub-module rlm_eap_ttls
   ttls {
        tls = "tls-common"
        default_eap_type = "gtc"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        virtual_server = "inner-tunnel"
        include_length = yes
        require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_peap
   peap {
        tls = "tls-common"
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        soh = no
        require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
        with_ntdomain_hack = no
        send_error = no
   }
  # Instantiating module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
  # Instantiating module "mschap" from file
/etc/freeradius/3.0/mods-enabled/mschap
rlm_mschap (mschap): using internal authentication
  # Instantiating module "files" from file
/etc/freeradius/3.0/mods-enabled/files
reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting
reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy
  # Instantiating module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints
  # Instantiating module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
  # Instantiating module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20457
   accounting {
        reference = "%{tolower:type.%{Acct-Status-Type}}"
   }
   post-auth {
        reference = "."
   }
rlm_ldap (ldap): Initialising connection pool
   pool {
        start = 5
        min = 3
        max = 32
        spare = 10
        uses = 0
        lifetime = 0
        cleanup_interval = 30
        idle_timeout = 60
        retry_delay = 30
        spread = no
   }
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used
rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used
rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used
rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
  # Instantiating module "IPASS" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "suffix" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "bangpath" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "ntdomain" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "cache_eap" from file
/etc/freeradius/3.0/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
rlm_cache_rbtree) loaded and linked
  # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql
rlm_sql_mysql: libmysql version: 10.5.15
   mysql {
    tls {
        tls_required = no
        check_cert = no
        check_cert_cn = no
    }
        warnings = "auto"
   }
rlm_sql (sql): Attempting to connect to database "radius"
rlm_sql (sql): Initialising connection pool
   pool {
        start = 5
        min = 3
        max = 32
        spare = 10
        uses = 0
        lifetime = 0
        cleanup_interval = 30
        idle_timeout = 60
        retry_delay = 30
        spread = no
   }
rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX
socket, server version 10.5.15-MariaDB-0+deb11u1, protocol version 10
rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX
socket, server version 10.5.15-MariaDB-0+deb11u1, protocol version 10
rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX
socket, server version 10.5.15-MariaDB-0+deb11u1, protocol version 10
rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX
socket, server version 10.5.15-MariaDB-0+deb11u1, protocol version 10
rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX
socket, server version 10.5.15-MariaDB-0+deb11u1, protocol version 10
rlm_sql (sql): Processing generate_sql_clients
rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname,
shortname, type, secret, server FROM nas
rlm_sql (sql): Reserved connection (0)
rlm_sql (sql): Executing select query: SELECT id, nasname, shortname,
type, secret, server FROM nas
rlm_sql (sql): Adding client 168.232.85.222 (MTR | TEXNET) to global
clients list
rlm_sql (168.232.85.222): Client "MTR | TEXNET" (sql) added
rlm_sql (sql): Adding client 191.7.100.3 (RAM | GRV) to global clients list
rlm_sql (191.7.100.3): Client "RAM | GRV" (sql) added
rlm_sql (sql): Adding client 186.26.99.143 (RAM | AMPARO ONLINE) to
global clients list
rlm_sql (186.26.99.143): Client "RAM | AMPARO ONLINE" (sql) added
rlm_sql (sql): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX
socket, server version 10.5.15-MariaDB-0+deb11u1, protocol version 10
  # Instantiating module "detail" from file
/etc/freeradius/3.0/mods-enabled/detail
  # Instantiating module "auth_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
  # Instantiating module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
 } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/3.0/radiusd.conf
} # server
server default { # from file /etc/freeradius/3.0/sites-enabled/default
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading preacct {...}
 # Loading accounting {...}
 # Loading session {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
} # server default
server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading session {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
 # Skipping contents of 'if' as it is always 'false' --
/etc/freeradius/3.0/sites-enabled/inner-tunnel:341
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipaddr = 127.0.0.1
        port = 18120
}
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 49405
Listening on proxy address :: port 53898
Ready to process requests
(0) Received Access-Request Id 86 from 168.232.85.222:40820 to
10.158.0.4:1812 length 255
(0)   User-Name = "gabrielmorais@company.com"
(0)   NAS-IP-Address = 172.11.11.11
(0)   NAS-Identifier = "e66666666662"
(0)   Called-Station-Id = "E6-AA-AA-AA-AA-E2:company_corporativa"
(0)   NAS-Port-Type = Wireless-802.11
(0)   Service-Type = Framed-User
(0)   Calling-Station-Id = "60-BB-BB-BB-BB-14"
(0)   Connect-Info = "CONNECT 0Mbps 802.11b"
(0)   Acct-Session-Id = "A9E98852467976C3"
(0)   WLAN-Pairwise-Cipher = 1027076
(0)   WLAN-Group-Cipher = 1027076
(0)   WLAN-AKM-Suite = 1027073
(0)   Framed-MTU = 1400
(0)   EAP-Message =
0x022d001f016761627269656c6d6f726169734069746175656972612e636f6d
(0)   Message-Authenticator = 0x3e0cbebb91ca478ad6568ddde0874813
(0) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "company.com" for User-Name =
"gabrielmorais@company.com"
(0) suffix: Found realm "company.com"
(0) suffix: Adding Stripped-User-Name = "gabrielmorais"
(0) suffix: Adding Realm = "company.com"
(0) suffix: Authentication realm is LOCAL
(0)     [suffix] = ok
(0) eap: Peer sent EAP Response (code 2) ID 45 length 31
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_ttls to process data
(0) eap_ttls: Initiating new TLS session
(0) eap_ttls: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 46 length 6
(0) eap: EAP session adding &reply:State = 0xee611a14ee4f0f5c
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 86 from 10.158.0.4:1812 to
168.232.85.222:40820 length 0
(0)   EAP-Message = 0x012e00061520
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0xee611a14ee4f0f5c58acb681d72cb94b
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 87 from 168.232.85.222:40820 to
10.158.0.4:1812 length 351
(1)   User-Name = "gabrielmorais@company.com"
(1)   NAS-IP-Address = 172.11.11.11
(1)   NAS-Identifier = "e66666666662"
(1)   Called-Station-Id = "E6-AA-AA-AA-AA-E2:company_corporativa"
(1)   NAS-Port-Type = Wireless-802.11
(1)   Service-Type = Framed-User
(1)   Calling-Station-Id = "60-BB-BB-BB-BB-14"
(1)   Connect-Info = "CONNECT 0Mbps 802.11b"
(1)   Acct-Session-Id = "A9E98852467976C3"
(1)   WLAN-Pairwise-Cipher = 1027076
(1)   WLAN-Group-Cipher = 1027076
(1)   WLAN-AKM-Suite = 1027073
(1)   Framed-MTU = 1400
(1)   EAP-Message =
0x022e006d158000000063160301005e0100005a030162beeda7b3f29c4487c8dba0a8e5226330f6c10b9de29c32b161c8dcfda90e71000018c014c0130035002fc00ac00900380032000a00130005000401000019ff01000100000a0006000400170018000b0002010000230000
(1)   State = 0xee611a14ee4f0f5c58acb681d72cb94b
(1)   Message-Authenticator = 0x1d33947aa686dfec9524212b11bd233b
(1) session-state: No cached attributes
(1) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if (&User-Name =~ /\.\./ ) {
(1)         if (&User-Name =~ /\.\./ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> FALSE
(1)         if (&User-Name =~ /@\./)  {
(1)         if (&User-Name =~ /@\./)   -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "company.com" for User-Name =
"gabrielmorais@company.com"
(1) suffix: Found realm "company.com"
(1) suffix: Adding Stripped-User-Name = "gabrielmorais"
(1) suffix: Adding Realm = "company.com"
(1) suffix: Authentication realm is LOCAL
(1)     [suffix] = ok
(1) eap: Peer sent EAP Response (code 2) ID 46 length 109
(1) eap: Continuing tunnel setup
(1)     [eap] = ok
(1)   } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0xee611a14ee4f0f5c
(1) eap: Finished EAP session with state 0xee611a14ee4f0f5c
(1) eap: Previous EAP request found for state 0xee611a14ee4f0f5c,
released from the list
(1) eap: Peer sent packet with method EAP TTLS (21)
(1) eap: Calling submodule eap_ttls to process data
(1) eap_ttls: Authenticate
(1) eap_ttls: Continuing EAP-TLS
(1) eap_ttls: Peer indicated complete TLS record size will be 99 bytes
(1) eap_ttls: Got complete TLS record (99 bytes)
(1) eap_ttls: [eaptls verify] = length included
(1) eap_ttls: (other): before SSL initialization
(1) eap_ttls: TLS_accept: before SSL initialization
(1) eap_ttls: TLS_accept: before SSL initialization
(1) eap_ttls: <<< recv TLS 1.3  [length 005e]
(1) eap_ttls: TLS_accept: SSLv3/TLS read client hello
(1) eap_ttls: >>> send TLS 1.0 Handshake [length 0039], ServerHello
(1) eap_ttls: TLS_accept: SSLv3/TLS write server hello
(1) eap_ttls: >>> send TLS 1.0 Handshake [length 0341], Certificate
(1) eap_ttls: TLS_accept: SSLv3/TLS write certificate
(1) eap_ttls: >>> send TLS 1.0 Handshake [length 014b], ServerKeyExchange
(1) eap_ttls: TLS_accept: SSLv3/TLS write key exchange
(1) eap_ttls: >>> send TLS 1.0 Handshake [length 0004], ServerHelloDone
(1) eap_ttls: TLS_accept: SSLv3/TLS write server done
(1) eap_ttls: TLS_accept: Need to read more data: SSLv3/TLS write server done
(1) eap_ttls: TLS - In Handshake Phase
(1) eap_ttls: TLS - got 1245 bytes of data
(1) eap_ttls: [eaptls process] = handled
(1) eap: Sending EAP Request (code 1) ID 47 length 1004
(1) eap: EAP session adding &reply:State = 0xee611a14ef4e0f5c
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1)   Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 87 from 10.158.0.4:1812 to
168.232.85.222:40820 length 0
(1)   EAP-Message =
0x012f03ec15c0000004dd160301003902000035030171a3fb575d464991bc4ef3146665d1a8a003cb6aeb0aa079444f574e4752440000c01400000dff01000100000b00040300010216030103410b00033d00033a000337308203333082021ba003020102021403e3d88b2dce9e2306d621355057d3439d9ba29c300d06092a864886f70d01010b050030323130302e06035504030c277261646975732d7365727665722e632e74696e2d6974722d3335303631302e696e7465726e616c301e170d3232303531383131343130395a170d3332303531353131343130395a30323130302e06035504030c277261646975732d7365727665722e632e74696e2d6974722d3335303631302e696e7465726e616c30820122300d06092a864886f70d01010105000382010f003082010a0282010100c5244b7000d09124d98a58d06e79e1940311304aba5c8c260b9e4c3c3f7122fac47a90fd3501b92102089d60fa8c310299ae6547448a86a4b6bc6916be393f496e35d80fa7
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0xee611a14ef4e0f5c58acb681d72cb94b
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 88 from 168.232.85.222:40820 to
10.158.0.4:1812 length 248
(2)   User-Name = "gabrielmorais@company.com"
(2)   NAS-IP-Address = 172.11.11.11
(2)   NAS-Identifier = "e66666666662"
(2)   Called-Station-Id = "E6-AA-AA-AA-AA-E2:company_corporativa"
(2)   NAS-Port-Type = Wireless-802.11
(2)   Service-Type = Framed-User
(2)   Calling-Station-Id = "60-BB-BB-BB-BB-14"
(2)   Connect-Info = "CONNECT 0Mbps 802.11b"
(2)   Acct-Session-Id = "A9E98852467976C3"
(2)   WLAN-Pairwise-Cipher = 1027076
(2)   WLAN-Group-Cipher = 1027076
(2)   WLAN-AKM-Suite = 1027073
(2)   Framed-MTU = 1400
(2)   EAP-Message = 0x022f00061500
(2)   State = 0xee611a14ef4e0f5c58acb681d72cb94b
(2)   Message-Authenticator = 0x8090e0537ea45065200b47550b645dcd
(2) session-state: No cached attributes
(2) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "company.com" for User-Name =
"gabrielmorais@company.com"
(2) suffix: Found realm "company.com"
(2) suffix: Adding Stripped-User-Name = "gabrielmorais"
(2) suffix: Adding Realm = "company.com"
(2) suffix: Authentication realm is LOCAL
(2)     [suffix] = ok
(2) eap: Peer sent EAP Response (code 2) ID 47 length 6
(2) eap: Continuing tunnel setup
(2)     [eap] = ok
(2)   } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0xee611a14ef4e0f5c
(2) eap: Finished EAP session with state 0xee611a14ef4e0f5c
(2) eap: Previous EAP request found for state 0xee611a14ef4e0f5c,
released from the list
(2) eap: Peer sent packet with method EAP TTLS (21)
(2) eap: Calling submodule eap_ttls to process data
(2) eap_ttls: Authenticate
(2) eap_ttls: Continuing EAP-TLS
(2) eap_ttls: Peer ACKed our handshake fragment
(2) eap_ttls: [eaptls verify] = request
(2) eap_ttls: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 48 length 261
(2) eap: EAP session adding &reply:State = 0xee611a14ec510f5c
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2)   Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 88 from 10.158.0.4:1812 to
168.232.85.222:40820 length 0
(2)   EAP-Message =
0x013001051580000004ddc241ba5f47fc0a3767a1536e3072120bd691d524168bec5d6813339d9f19af6a03d644049cc50792ed16ae3a04c764b0d63a7bb322d46ffcea7384f1e1fabc0acf4163a39822c5350f79c794a7341f7d053ca805405ebf97333c67504df354b44407369349642d011cfbb6c64a911ffdf102564955f290ce245bbc789af5a80996727d1e7a428c133f1ae1731206fa19caad66f579d71108d76278a776380d67519f28f608a89db93cbaadf24b0cfa6298171d0e7f5b7874a90db5b9a9bb5adbed38c616d05536eaa959ecdd0d8118931d1a886f2701e34dc2a003ff25192a9f0d984bb462db47c3a26e0d28c046464a67b516030100040e000000
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0xee611a14ec510f5c58acb681d72cb94b
(2) Finished request
Waking up in 4.8 seconds.
(3) Received Access-Request Id 89 from 168.232.85.222:40820 to
10.158.0.4:1812 length 386
(3)   User-Name = "gabrielmorais@company.com"
(3)   NAS-IP-Address = 172.11.11.11
(3)   NAS-Identifier = "e66666666662"
(3)   Called-Station-Id = "E6-AA-AA-AA-AA-E2:company_corporativa"
(3)   NAS-Port-Type = Wireless-802.11
(3)   Service-Type = Framed-User
(3)   Calling-Station-Id = "60-BB-BB-BB-BB-14"
(3)   Connect-Info = "CONNECT 0Mbps 802.11b"
(3)   Acct-Session-Id = "A9E98852467976C3"
(3)   WLAN-Pairwise-Cipher = 1027076
(3)   WLAN-Group-Cipher = 1027076
(3)   WLAN-AKM-Suite = 1027073
(3)   Framed-MTU = 1400
(3)   EAP-Message =
0x023000901580000000861603010046100000424104ff892d50396709b9eee1c7c37163947ff4231b8aeb318f5e39e97788d90cbb99432fd74c56f64df99357f99fb2b7558c96bf9c7c1abe926c2ad99ed643c42f451403010001011603010030d4ec0178a5db9322674d1f975c8852b636768a805f44488ae0a92536b0e64882b44c17d80f90f6c986e890e537acbbc1
(3)   State = 0xee611a14ec510f5c58acb681d72cb94b
(3)   Message-Authenticator = 0xdfacedbaef802a759a390ce10589610b
(3) session-state: No cached attributes
(3) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (&User-Name) {
(3)       if (&User-Name)  -> TRUE
(3)       if (&User-Name)  {
(3)         if (&User-Name =~ / /) {
(3)         if (&User-Name =~ / /)  -> FALSE
(3)         if (&User-Name =~ /@[^@]*@/ ) {
(3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(3)         if (&User-Name =~ /\.\./ ) {
(3)         if (&User-Name =~ /\.\./ )  -> FALSE
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
  -> FALSE
(3)         if (&User-Name =~ /\.$/)  {
(3)         if (&User-Name =~ /\.$/)   -> FALSE
(3)         if (&User-Name =~ /@\./)  {
(3)         if (&User-Name =~ /@\./)   -> FALSE
(3)       } # if (&User-Name)  = notfound
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "company.com" for User-Name =
"gabrielmorais@company.com"
(3) suffix: Found realm "company.com"
(3) suffix: Adding Stripped-User-Name = "gabrielmorais"
(3) suffix: Adding Realm = "company.com"
(3) suffix: Authentication realm is LOCAL
(3)     [suffix] = ok
(3) eap: Peer sent EAP Response (code 2) ID 48 length 144
(3) eap: Continuing tunnel setup
(3)     [eap] = ok
(3)   } # authorize = ok
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0xee611a14ec510f5c
(3) eap: Finished EAP session with state 0xee611a14ec510f5c
(3) eap: Previous EAP request found for state 0xee611a14ec510f5c,
released from the list
(3) eap: Peer sent packet with method EAP TTLS (21)
(3) eap: Calling submodule eap_ttls to process data
(3) eap_ttls: Authenticate
(3) eap_ttls: Continuing EAP-TLS
(3) eap_ttls: Peer indicated complete TLS record size will be 134 bytes
(3) eap_ttls: Got complete TLS record (134 bytes)
(3) eap_ttls: [eaptls verify] = length included
(3) eap_ttls: TLS_accept: SSLv3/TLS write server done
(3) eap_ttls: <<< recv TLS 1.0 Handshake [length 0046], ClientKeyExchange
(3) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange
(3) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec
(3) eap_ttls: <<< recv TLS 1.0 Handshake [length 0010], Finished
(3) eap_ttls: TLS_accept: SSLv3/TLS read finished
(3) eap_ttls: >>> send TLS 1.0 ChangeCipherSpec [length 0001]
(3) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec
(3) eap_ttls: >>> send TLS 1.0 Handshake [length 0010], Finished
(3) eap_ttls: TLS_accept: SSLv3/TLS write finished
(3) eap_ttls: (other): SSL negotiation finished successfully
(3) eap_ttls: TLS - Connection Established
(3) eap_ttls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-SHA"
(3) eap_ttls: TLS-Session-Version = "TLS 1.0"
(3) eap_ttls: TLS - got 59 bytes of data
(3) eap_ttls: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 49 length 69
(3) eap: EAP session adding &reply:State = 0xee611a14ed500f5c
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3)   Challenge { ... } # empty sub-section is ignored
(3) session-state: Saving cached attributes
(3)   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-SHA"
(3)   TLS-Session-Version = "TLS 1.0"
(3) Sent Access-Challenge Id 89 from 10.000.0.4:1812 to
168.000.000.002:40820 length 0
(3)   EAP-Message =
0x0131004515800000003b1403010001011603010030ccc9effc78ba3c36b383f16f4c0fc37819789c5a52e887b9a6e32a55a7fa093a56dfeea8423835a323dbe4f5fa501a2d
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0xee611a14ed500f5c58acb681d72cb94b
(3) Finished request
Waking up in 4.7 seconds.
(0) Cleaning up request packet ID 86 with timestamp +30
(1) Cleaning up request packet ID 87 with timestamp +30
(2) Cleaning up request packet ID 88 with timestamp +30
(3) Cleaning up request packet ID 89 with timestamp +30
Ready to process requests

--

Thiago M

-- 
www.itaueira.com 
<http://www.google.com/url?q=http%3A%2F%2Fwww.itaueira.com.br&sa=D&sntz=1&usg=AFQjCNH42Xq5lpseB4cAh2qH7npCQfuT4A>

facebook/melaoRei 
<https://www.google.com/url?q=https%3A%2F%2Fwww.facebook.com%2Fmelaorei%2F&sa=D&sntz=1&usg=AFQjCNHpoNbpLy4hPWrbONSyBkPJZ3Da5A> 
 f/ItaueiraTurmadaMonica 
<https://www.google.com/url?q=https%3A%2F%2Fwww.facebook.com%2FItaueiraTurmadaMonica&sa=D&sntz=1&usg=AFQjCNEiygBAltzyxrySohIxySxT03oNLg> 
 f/ItaueiraMelon 
<https://www.google.com/url?q=https%3A%2F%2Fwww.facebook.com%2Fitaueiramelon&sa=D&sntz=1&usg=AFQjCNH2YLsM-RqYfRFrgBkzTErDSOGaeg> 

Esta mensagem é endereçada exclusivamente ao seu destinatário e poderá 
conter informações confidenciais. 
O uso não autorizado de tais informações 
é proibido e estará sujeito às penalidades cabíveis. 
*This message is 
intended exclusively for its addressee and may contain information that is 
confidential. *
*Unauthorized use of such information is prohibited and 
subject to applicable penalties.*

No Connection Windows 8 and 10 in wpa2-enterprise

Thiago Martins