Hi, i am trying now to make this scenario work with sql. But the VLAN information disapear in the eap answer, like(full log attach): (12) eap_peap: Got tunneled reply RADIUS code 2 (12) eap_peap: Tunnel-Type = VLAN (12) eap_peap: Tunnel-Medium-Type = IEEE-802 (12) eap_peap: Tunnel-Private-Group-Id = "5" (12) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Required (12) eap_peap: MS-MPPE-Encryption-Types = 4 (12) eap_peap: MS-MPPE-Send-Key = 0x13ee183f2b36e3ab894c988ab66767cf (12) eap_peap: MS-MPPE-Recv-Key = 0x619eade4a503a46bb6cfe472b89763ff (12) eap_peap: EAP-Message = 0x03540004 (12) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (12) eap_peap: User-Name = "kemi2" (12) eap_peap: Tunneled authentication was successful (12) eap_peap: SUCCESS (12) eap: Sending EAP Request (code 1) ID 85 length 46 (12) eap: EAP session adding &reply:State = 0xe437a030ed62b94d (12) [eap] = handled (12) } # authenticate = handled (12) Using Post-Auth-Type Challenge (12) Post-Auth-Type sub-section not found. Ignoring. (12) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (12) Sent Access-Challenge Id 117 from 192.168.3.1:1812 to 192.168.3.190:49091 length 0 (12) EAP-Message = 0x0155002e19001703030023e11004 733abe7be1910c9689bf21cbcbf1ef5c6fa111398d0e5523e4c0c15e812b1e8d (12) Message-Authenticator = 0x00000000000000000000000000000000 (12) State = 0xe437a030ed62b94ddcae84c47b005509 (12) Finished request ....... (13) [sql] = ok (13) [exec] = noop (13) policy remove_reply_message_if_eap { (13) if (&reply:EAP-Message && &reply:Reply-Message) { (13) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (13) else { (13) [noop] = noop (13) } # else = noop (13) } # policy remove_reply_message_if_eap = noop (13) } # post-auth = ok (13) Login OK: [kemi2/<via Auth-Type = eap>] (from client private-network-1 port 0 cli 00-37-6D-ED-69-41) (13) Sent Access-Accept Id 118 from 192.168.3.1:1812 to 192.168.3.190:49091 length 0 (13) MS-MPPE-Recv-Key = 0xbef38cc2e01eeff7b73767ce0801 54e8453b8b1d6c8faaf140a7dd05683552da (13) MS-MPPE-Send-Key = 0x09861f887608b2e276d24f1d7ee1 d1557b00a4bbcbec566ad63fe7c0ddd5669f (13) EAP-Message = 0x03550004 (13) Message-Authenticator = 0x00000000000000000000000000000000 (13) User-Name = "kemi2" (13) Finished request Waking up in 4.7 seconds. (14) Received Accounting-Request Id 119 from 192.168.3.190:50137 to 192.168.3.1:1813 length 151 (14) Acct-Session-Id = "0000000C-00000007" (14) Acct-Status-Type = Start (14) Acct-Authentic = RADIUS (14) User-Name = "kemi2" (14) NAS-Identifier = "802aa8907353" (14) NAS-Port = 0 (14) Called-Station-Id = "80-2A-A8-91-73-53:TESTE" (14) Calling-Station-Id = "00-37-6D-ED-69-41" (14) NAS-Port-Type = Wireless-802.11 (14) Connect-Info = "CONNECT 0Mbps 802.11b" (14) # Executing section preacct from file /usr/local/etc/raddb/sites- enabled/default The tables: mysql> SELECT * FROM radcheck; +----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 1 | kemi2 | Cleartext-Password | := | 1q2w3e4r | +----+----------+--------------------+----+----------+ 1 row in set (0.00 sec) mysql> SELECT * FROM radreply; +----+----------+-------------------------+----+-------+ | id | username | attribute | op | value | +----+----------+-------------------------+----+-------+ | 1 | kemi2 | Tunnel-Type | := | VLAN | | 2 | kemi2 | Tunnel-Medium-Type | := | 6 | | 3 | kemi2 | Tunnel-Private-Group-Id | := | 5 | +----+----------+-------------------------+----+-------+ 3 rows in set (0.00 sec) I can see the reply mensage in eap and in sql, but the reply is not in the final mensage and i don't know why (note:radtest works fine) Thanks 2016-11-10 10:54 GMT-02:00 Gabriel Ozaki <gabriel.ozaki@kemi.com.br>:
You are correct, now is working fine
Thanks
2016-11-10 10:47 GMT-02:00 Brian Candler <b.candler@pobox.com>:
On 10/11/2016 12:02, Gabriel Ozaki wrote:
But unifi still using vlan 1, is possible the unifi is not receiving the Tunnel information?
Look carefully at the end of your debug output:
(9) Login OK: [kemi/<via Auth-Type = eap>] (from client private-network-1 port 0 cli F8-2F-A8-F5-12-97) (9) Sent Access-Accept Id 40 from 192.168.3.1:1812 to 192.168.3.190:49091 length 0 (9) MS-MPPE-Recv-Key = 0x9cef482e0e294db32ca069d27b9a 4b1605896ae638b2d845ffd593d7fc00777e (9) MS-MPPE-Send-Key = 0xd010d975e1b595af9f1c04a1ad0e 07d22213f62823948c425fc21bfb18c16b5e (9) EAP-Message = 0x033a0004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "kemi" (9) Finished request
The final reply doesn't include those attributes; the inner tunnel auth has them, but they don't appear in the outer session. You need to set:
use_tunneled_reply = yes
Similarly, if in your inner tunnel logic you want to make use of attributes in the request (such as Called-Station-ID to see which SSID the client is connecting to), you need:
copy_request_to_tunnel = yes
These settings are in mods-available/eap
Regards,
Brian.