Hi,

I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "eap_peap : Got tunneled reply code 11." My NAS is receiving other Access-Challenge requests but not this one. 

I tried to find out what code 11 but I cannot find a simple answer. 

Do I need to configure my inner-tunnel? 

Jake He


Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095
Session-Timeout := 600
Idle-Timeout := 30
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb77514c3b6770d58e310744eea16afdc
(1) Finished request 1.

(8)   [pap] = noop
(8)  } #  authorize = updated
(8) Found Auth-Type = EAP
(8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
(8)   authenticate {
(8) eap : Expiring EAP session with state 0x7b061f337b0e0549
(8) eap : Finished EAP session with state 0x7b061f337b0e0549
(8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list
(8) eap : Peer sent MSCHAPv2 (26)
(8) eap : EAP MSCHAPv2 (26)
(8) eap : Calling eap_mschapv2 to process EAP data
(8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
(8) eap_mschapv2 :  Auth-Type MS-CHAP {
(8) mschap : Found Cleartext-Password, hashing to create LM-Password
(8) mschap : Found Cleartext-Password, hashing to create NT-Password
(8) mschap : Creating challenge hash with username: bob
(8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password
(8) mschap : adding MS-CHAPv2 MPPE keys
(8)   [mschap] = ok
(8)  } # Auth-Type MS-CHAP = ok
MSCHAP Success 
(8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549
(8)   [eap] = handled
(8)  } #  authenticate = handled
} # server inner-tunnel
(8) eap_peap : Got tunneled reply code 11
Session-Timeout := 600
Idle-Timeout := 30
EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x7b061f337a0f0549d125cd93a8b94882
(8) eap_peap : Got tunneled reply RADIUS code 11
Session-Timeout := 600
Idle-Timeout := 30
EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x7b061f337a0f0549d125cd93a8b94882
(8) eap_peap : Got tunneled Access-Challenge
(8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58
(8)   [eap] = handled
(8)  } #  authenticate = handled





On Tue, May 13, 2014 at 9:32 PM, Russell Mike <radius.sir@gmail.com> wrote:



On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,

Thank you for your patience. I am very happy someone can help me. Now I made some progress.

I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this:
 query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM `radacct` WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"

Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
 
Now, have one more problem. 

My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds. 

Freeradius is sending it:

(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60
(2)   [dailycounter] = ok

Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097
Session-Timeout = 60
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x543a9074553889da6f504855ab4e7a4b
(2) Finished request 2.

I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log. 

Is it my a problem with NAS configuration?

What should I do now?

The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results.

FreeRADIUS is now fine. Configure your NAS properly

NOTE: Check item is for FreeRADIUS. reply item is for NAS.

Thanks / Regards

--RM



Jake He


On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:

On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:

> You mean I need to upgrade to 3.0.3?

yes.

Arran Cudbard-Bell <a.cudbardb@freeradius.org>
FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html