OK, so I send a request to the inner-tunnel: Ready to process requests (0) Received Access-Request Id 68 from 127.0.0.1:31482 to 127.0.0.1:18120 length 86 (0) User-Name = "passpoint/adrian" (0) User-Password = "xxx" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0xdb9b44df28c428b47f82ed0ad6065ea4 (0) # Executing section authorize from file /home/adrian/freeradius-server-3.0.15/etc/raddb/sites-enabled/inner-tunnel (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [chap] = noop (0) [mschap] = noop (0) IPASS: Checking for prefix before "/" (0) IPASS: Looking up realm "passpoint" for User-Name = "passpoint/adrian" (0) IPASS: Found realm "passpoint" (0) IPASS: Adding Realm = "passpoint" (0) IPASS: Proxying request from user passpoint/adrian to realm passpoint (0) IPASS: Preparing to proxy authentication request to realm "passpoint" (0) suffix: Request already has destination realm set. Ignoring (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated (0) Starting proxy to home server 192.168.19.20 port 1812 (0) Proxying request to home server 192.168.19.20 port 1812 timeout 20.000000 (0) Sent Access-Request Id 162 from 0.0.0.0:50236 to 192.168.19.20:1812 length 90 (0) User-Name = "passpoint/adrian" (0) User-Password = "xxx" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0xdb9b44df28c428b47f82ed0ad6065ea4 (0) Proxy-State = 0x3638 All looks good, same config. TIA. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 21 September 2017 21:13 To: FreeRadius users mailing list Subject: Re: Terminate EAP-TTLS then proxy On Sep 21, 2017, at 3:31 PM, adrian.p.smith@bt.com wrote:
I have returned to this problem and am using a fresh copy of 3.0.15 and the eapol_test client.
I'd suggest just using radtest on the inner-tunnel virtual server. If that can proxy, *then* test EAP-TTLS. Otherwise, the debug output will be huge and hard to read.
(6) IPASS: Checking for prefix before "/" (6) IPASS: Looking up realm "passpoint" for User-Name = "passpoint/adrian" (6) IPASS: Found realm "passpoint" (6) IPASS: Adding Realm = "passpoint" (6) IPASS: Proxying request from user passpoint/adrian to realm passport
So... what's the configuration for that realm?
(6) IPASS: Preparing to proxy authentication request to realm "passpoint" (6) [IPASS] = updated (6) suffix: Request already has destination realm set. Ignoring (6) [suffix] = noop (6) eap: No EAP-Message, not doing EAP (6) [eap] = noop (6) [files] = noop (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = updated (6) } # server inner-tunnel (6) Virtual server sending reply (6) eap_ttls: Tunneled authentication will be proxied to passpoint (6) eap: WARNING: Tunneled session will be proxied. Not doing EAP (6) [eap] = handled (6) } # authenticate = handled (6) WARNING: Cancelling proxy as no home pool exists
Probably because you defined the realm, but didn't define a home_pool for it. See raddb/proxy.conf for docs and examples/
The offending line appears to be:
(6) WARNING: Cancelling proxy as no home pool exists
It's often useful to read earlier messages to see what happened *before* that error occurred. In this case, it tried to proxy to realm "passpoint". But it can't. So... what's wrong with that realm? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html