Here is what Buxley lied that he doesn't care about: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/29, changed state to down 387716: Feb 2 11:20:40.392: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/29, changed state to down Switch(config-if)# 387717: Feb 2 11:20:41.262: %AUTHMGR-5-START: Starting 'dot1x' for client (ip phone mac) on Interface Gi1/0/29 AuditSessionID 0A7000FC2201C28740F37DF3 387718: Feb 2 11:20:41.297: %DOT1X-5-SUCCESS: Authentication successful for client (ip phone mac) on Interface Gi1/0/29 AuditSessionID 0A7000FC2201C28740F37DF3 387719: Feb 2 11:20:41.297: %AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (ip phone mac) on Interface Gi1/0/29 AuditSessionID 0A7000FC2201C28740F37DF3 Switch(config-if)# 387720: Feb 2 11:20:41.297: %DOT1X_SWITCH-5-ERR_VLAN_EQ_VVLAN: Data VLAN 23 on port GigabitEthernet1/0/29 cannot be equivalent to the Voice VLAN AuditSessionID 0A7000FC2201C28740F37DF3 387721: Feb 2 11:20:41.297: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (ip phone mac) on Interface Gi1/0/29 AuditSessionID 0A7000FC2201C28740F37DF3 387722: Feb 2 11:20:41.297: %DOT1X-5-RESULT_OVERRIDE: Authentication result overridden for client (ip phone mac) on Interface Gi1/0/29 AuditSessionID 0A7000FC2201C28740F37DF3 Switch(config-if)# 387723: Feb 2 11:20:41.619: %AUTHMGR-5-START: Starting 'dot1x' for client (pc mac) on Interface Gi1/0/29 AuditSessionID 0A8001FC0001E08420F28F66 Switch(config-if)# 387724: Feb 2 11:20:43.241: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/29, changed state to up Switch(config-if)# 387725: Feb 2 11:20:44.240: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/29, changed state to up -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+m_zouhairy=skno.by@lists.freeradius.org] On Behalf Of Vacheslav Sent: Friday, February 2, 2018 11:16 AM To: 'FreeRadius users mailing list' <freeradius-users@lists.freeradius.org> Subject: RE: cisco phones -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+m_zouhairy=skno.by@lists.freeradius.org] On Behalf Of Nathan Ward Sent: Thursday, February 1, 2018 2:43 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: cisco phones
On 1/02/2018, at 7:14 PM, Vacheslav <m_zouhairy@skno.by> wrote:
SELECT * FROM radreply;
| id | username | attribute | op | value | +----+-------------------------+-------------------------+----+----------+ | 7 | CP-3905-SEP2C0BA7291783| Tunnel-Type | := | VLAN | | 8 | CP-3905-SEP2C0BA7291783| Tunnel-Medium-Type | := | IEEE-802 | | 9 | CP-3905-SEP2C0BA7291783| Tunnel-Private-Group-Id | := | 23 | +----+-------------------------+-------------------------+----+—————+
(2) sql: ERROR: Failed to create the pair: Invalid character ' ' in attribute
It’s not possible to tell from what you have given, but, does one of your attributes in the radreply table have a space at the start or end? >I.e. do you perhaps have "Tunnel-Medium-Type<space>”? I finally had time to test. I deleted the attributes one at a time and test and it turns out the Tunnel-Type:=VLAN was that menace. I first added it again, this time as >check attribute, without using the auto saved entry in the browser, and the login was ok. You got happy ahead of time. Without the >attribute it authenticated on the data vlan. With the attribute, the switch reported the phone as dropped. Then I added the mentioned >attribute as a reply keeping it as check also, and again the login was ok but the switch dropped the packets. Then I deleted the mentioned >attribute from checking and no change. I final tried putting it 1:VLAN and 23:VLAN but that just makes freeradius spout: Auth: (56) Invalid user (sql: Error parsing value: Unknown or invalid value "1:VLAN" for attribute Tunnel-Type): [CP-3905->SEP2C0BE9042892/<via Auth-Type = eap>] (from client Skorini_Switch port 50145 cli 2C-0B-E9-04-28-92) Fri Feb 2 11:01:35 2018 : Auth: >(56) Login incorrect (sql: Error parsing value: Unknown or invalid value "1:VLAN" for attribute Tunnel-Type): [ip phone name via Auth-Type >= eap>] (from client Switch port 50145 cli mac) Fri Feb 2 11:02:36 2018 : Info: rlm_sql (sql): Closing connection (35): Hit idle_timeout, was >idle for 61 seconds Fri Feb 2 11:02:36 2018 : Info: rlm_sql (sql): Closing connection (36): Hit idle_timeout, was idle for 61 seconds Fri Feb >2 11:02:36 2018 : Info: rlm_sql (sql): Closing connection (34): Hit idle_timeout, was idle for 61 seconds Fri Feb 2 11:02:36 2018 : Info: >rlm_sql (sql): Opening additional connection (37), 1 of 32 pending slots used Fri Feb 2 11:02:36 2018 : Info: Need 2 more connections to >reach min connections (3) Fri Feb 2 11:02:36 2018 : Info: rlm_sql (sql): Opening additional connection (38), 1 of 31 pending slots used Fri >Feb 2 11:02:36 2018 : Auth: (58) Login OK: [ip phone name/<via Auth-Type = eap>] (from client Switch port 50145 cli mac) Fri Feb 2 >11:03:35 2018 : Info: Need 1 more connections to reach min connections (3) Fri Feb 2 11:03:35 2018 : Info: rlm_sql (sql): Opening ?>additional connection (39), 1 of 30 pending slots used Fri Feb 2 11:03:35 2018 : Auth: (60) Invalid user (sql: Error parsing value: Unknown >or invalid value "30:VLAN" for attribute Tunnel-Type): [ip phone name/<via Auth-Type = eap>] (from client Switch port 50145 cli mac) Fri >Feb 2 11:03:35 2018 : Auth: (60) Login incorrect (sql: Error parsing value: Unknown or invalid value "23:VLAN" for attribute Tunnel-Type): >[ip phone name/<via Auth-Type = eap>] (from client Switch port 50145 cli mac)
I can think of two options: Either the switch needs additional configuration or the attribute configuration is not for cisco. I am bewildered that no one here uses freeradius for cisco md5 phones, and am I the only one working for a money loving government >who won't is too stingy even to consider getting the latest acs?
--
Nathan Ward
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html