On Nov 7, 2018, at 7:32 AM, Joe Garcia <joe27256@gmail.com> wrote:
In that case are we being asked to do something that's not possible, i.e. having the client/supplicant talk directly to the RADIUS server without a NAS involved? That would also explain why we're having problems with it.
Yes. A RADIUS server accepts RADIUS packets from a RADIUS client. You can't send raw EAP to a RADIUS server and expect it to work.
Send an EAP-Message containing an EAP-Identity. That starts EAP. The server SHOULD respond with an Access-Challenge containing an EAP-Message. That EAP-Message essentially says "Hi! Let's do TTLS!"
I've tried that, and got no resonse from the server...
Then either you didn't send the right thing, or their RADIUS server is configured to discard all messages containing EAP, or their RADIUS server isn't configured to accept RADIUS packets from your IP address. You *can* run eapol_test yourself, as I suggested in my previous reply. That will tell you if the RADIUS server works at all.
This sorta reinforces my suspicion (see above) that we're being asked to implement something that may not be possible?
Yes. Alan DeKok.