Hi, all I recently changed my firewall and move my dns server to the same host running freeradius. The 802.1x connection between windows xp and my AP which works perfectly now stop working. How can I troubleshooting this? 802.1x may be secure, but definitely pain in the ass. Here is what I see in radius log. BTW: Hardware, freeradius, certificates are all the same. --- --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.2.5:1024, id=67, length=166 User-Name = "Vincent Chen" NAS-IP-Address = 10.1.2.5 NAS-Identifier = "AWL500" State = 0xf6d7edea4e31a89cdd1e573b8e7f619c EAP-Message = 0x021500500d800000004616030100410100003d030144482d535841e9b32d4e67beba62b2534c19d5a49d7a9f56d591282a9597af8600001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf6f1d2620cddb7f2b187f79e91dff8dc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 rlm_eap: EAP packet type response id 21 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 users: Matched entry Vincent Chen at line 19 modcall[authorize]: module "files" returns ok for request 16 modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ee9], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008b], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 16 modcall: leaving group authenticate (returns handled) for request 16 Sending Access-Challenge of id 67 to 10.1.2.5 port 1024 Termination-Action = RADIUS-Request Session-Timeout = 1200 EAP-Message = 0x0116040a0dc000000fcd160301004a02000046030144482d544fab626b96135973511a6d2c7a3ca4375ecf30af715f751166aca50d20338a07507a2423dec32483c2c11d54669ffba33d3f829a3f7f27ea56047a96240004001603010ee90b000ee5000ee20006fa308206f6308204dea003020102020101300d06092a864886f70d0101050500307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c204341312b302906092a864886f70d010901161c76696e63656e744069736f6c7574696f6e2e64796e64 EAP-Message = 0x6e732e62697a301e170d3036303330333131313233315a170d3131303330323131313233315a3057310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b13024954311730150603550403130e76657264692e686f6d652e6e6574310a3008060355040513013130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8819383482d847fda6b0d13bbc5dc6e6880d3b692076a19b3c1c9487505798e113454d8a8ed2c378c0743029eece31c989826592bafc121c43784d9b835105fdc89cc8e3df125573e76d56c2283e7803f2660a70e095d051ef4e2191c EAP-Message = 0x997d0d69051c1383d82f5abba1a451ca886b0271a7ffd88b63da0b41c3aab3faf6b0a96584924466a11e0e13a19fb6fa7e31ff9f2edd01a7f8298b30152f7af49004860d8dfbf320f593fb1b4634bba64d558a75b851149007c21dbd665f81ee57c414a118b2697acfd5d5418a4e5d9dd7ce6f5356829d20bc0859c53cf9a09a444c278c85bd8a972e05b4e65da8db7ab1ae3c445d902ede58efea886cf0b16a7ec4dd0203010001a38202a8308202a430090603551d130402300030480603551d200441303f300606042a030304300606042a030305302d06042a0303063025302306082b060105050702011617687474703a2f2f736f6d652e75726c EAP-Message = 0x2e6f72672f637073301106096086480186f8420101040403020640300b0603551d0f0404030204f030130603551d25040c300a06082b06010505070301302a06096086480186f842010d041d161b5757572d536572766572206f6620416d4a6574204469676974616c301d0603551d0e04160414a37a030823f727fd625ea3b2e772b37295f8acfc3081ac0603551d230481a43081a180148c3fd1b0c717607c67d8d845ece8741f4ff8ed60a17ea47c307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c20 EAP-Message = 0x4341312b302906092a864886f70d010901161c76696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4016d74af2be5576af501ab3faf576f1 Finished request 16 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.1.2.5:1024, id=68, length=92 User-Name = "Vincent Chen" NAS-IP-Address = 10.1.2.5 NAS-Identifier = "AWL500" State = 0x4016d74af2be5576af501ab3faf576f1 EAP-Message = 0x021600060d00 Message-Authenticator = 0x5a66fb7be4afdcbc9547bcfb1f6f906e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 17 rlm_eap: EAP packet type response id 22 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 17 users: Matched entry Vincent Chen at line 19 modcall[authorize]: module "files" returns ok for request 17 modcall: leaving group authorize (returns updated) for request 17 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 17 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 17 modcall: leaving group authenticate (returns handled) for request 17 Sending Access-Challenge of id 68 to 10.1.2.5 port 1024 Termination-Action = RADIUS-Request Session-Timeout = 1200 EAP-Message = 0x0117040a0dc000000fcd63656e744069736f6c7574696f6e2e64796e646e732e62697a820900f3bd792c9c40ec4c30270603551d110420301e811c76696e63656e744069736f6c7574696f6e2e64796e646e732e62697a30270603551d120420301e811c76696e63656e744069736f6c7574696f6e2e64796e646e732e62697a304206096086480186f842010404351633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f63726c2f636163726c2e63726c304206096086480186f842010304351633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f6372 EAP-Message = 0x6c2f636163726c2e63726c30440603551d1f043d303b3039a037a0358633687474703a2f2f69736572766963652e64796e646e732e62697a2f6f70656e63612f7075622f63726c2f636163726c2e63726c300d06092a864886f70d01010505000382020100a55af54cb3ad70b6d429de93b37b49e161f7975473a3727c1209267f59512eedd04741b77231661d8e45c1479955536ef14648a504ad00252e2d9c8315a60ba9f2604491e965e3c47f00c3355b06d7b6da6cf06ec622b40765f6e6da3390a09ffb5f6dd3cd790cf479b21d504e0be8e135cfeda486dd2febb632a3796f4ae94d949ecb64677b50aa1e754d3158e2738df2fbd94d4837ce6d EAP-Message = 0xb719302a99ad583e26ac0f231ab772db7cbef0a4aecebd056f2d333322d94565217603b022e08043c999eecb9d9543771e4beffc7d0a17fee3706b76dde92da5acf134d8f4795ca72864fc39b71cb9cdf1867bcffca3b195206636ce3e6c714951cbb323cd38e9b876c3668c8a5ba6d3b1201a54bd98d44d77e8e308ddc60a4a8cbebbb87454a31ec031edc09100bf2fc9060950ba6e2da98f8bfbb58ee1a14e89808e773bf6075c0c153ba0a76552957e515a6461fbda579090c57eba1a58d303d40b384fc39b8f7fafd72991a00352d3e0ed144ba679d92117784a18d734530c33d453453908039860106acdb00cfeb8a76b2da25ff0b032e7e9a8b3 EAP-Message = 0x3a57b0787ceb145d8a3a2c82477944d2159d8d3614095e5b618a6e86b69dbac307867c5ffe2e719d90b918260eb685cb3ce1e112a31fa2c234af91fda883b26ad1e60c0d57efc2b2cdc1c129f19e9129a40543fcdd4ee0c9a12b9abfdf46c88aac46ecce3b0ff12d6d3fd20007e2308207de308205c6a003020102020900f3bd792c9c40ec4c300d06092a864886f70d0101050500307a310b300906035504061302545731163014060355040a130d416d4a6574204469676974616c310b3009060355040b130249543119301706035504031310416d4a6574204469676974616c204341312b302906092a864886f70d010901161c76696e63656e7440 EAP-Message = 0x69736f6c7574696f6e2e64796e646e732e62697a301e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf0f9b620b8316abaee0c3ccac9df0bc4 Finished request 17 Going to the next request --- ___________________________________________________ 最新版 Yahoo!奇摩即時通訊 7.0，免費網路電話任你打！ http://messenger.yahoo.com.tw/ ___________________________________________________ 最新版 Yahoo!奇摩即時通訊 7.0，免費網路電話任你打！ http://messenger.yahoo.com.tw/