Sigh, Remember that old adage "Have you switched it off and on again?" Problematic device was an Android 8.0 phone thast continued not to work back here, Power cycle it and it sprang into life :-( A On Mon, 9 Jul 2018 at 16:56, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 9, 2018, at 11:28 AM, Alex Sharaz via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Some of our eduroam users have for quite some time been using EAP-TLS on their edge devices Normally this "just works" and I've certainly used it from various european eduroam sites quite happily.
A bit closer to home however, today one of our TLS users tried to connect at Leeds and our end generated the following errors.
Mon Jul 9 11:17:10 2018 : Auth: (10991893) Login incorrect (eap: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0x1235fc092001f154): [rw557@york.ac.uk] (from client roaming0.ja.net port 8 cli 8C-F5-A3-31-14-A8)
That's an issue. :(
Don't seem to have any more info (we're running 3.0.17) and as this is the 1st time I've seen this, not sure what to do to reproduce it. Don't really want to run server in debug mode just on the off-chance I might see something.
It will give you a bit more information, but not much..
Anything I can put in the config to generate some additional logs if it happens again ?
Not much.
The problem is that EAP-TLS should take ~18 packets to complete. If it's taking more than that, then something is very wrong. e.g.
* there really is that much data in the certs, so it needs 50 trips.
Not likely.
* there's some kind of pathological negotiation going on
The server is saying "let's do TLS", and the client says "no, let's do PEAP". The server says "OK, let's do PEAP", and the client goes "No, let's do TLS"... ad nauseum.
* something else is going on.
Magic. :(
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html