Thanks Brian and Alan I enable the update blocks and works on the first time, but on second too, but in the thirt connection the reply VLAN is not present Process: Connect to wifi(works with vlan) disconnect and reconnect(Sometimes works) disconnect and reconnect again(don't work) And looking in the radpostauth table i see some accept-accept replys with login without password :O +----+----------+----------+---------------+---------------------+ | id | username | pass | reply | authdate | +----+----------+----------+---------------+---------------------+ | 1 | kemi2 | 1q2w3e4r | Access-Reject | 2016-11-10 12:04:35 | | 2 | kemi | 1q2w3e4r | Access-Accept | 2016-11-10 12:06:00 | | 3 | kemi2 | 1q2w3e4r | Access-Reject | 2016-11-10 15:26:27 | | 4 | kemi2 | 1q2w3e4r | Access-Reject | 2016-11-10 15:27:52 | | 5 | kemi2 | 1q2w3e4r | Access-Reject | 2016-11-10 15:28:04 | | 6 | kemi2 | 1q2w3e4r | Access-Accept | 2016-11-10 15:28:58 | | 7 | kemi2 | | Access-Accept | 2016-11-10 15:37:49 | | 8 | kemi2 | | Access-Accept | 2016-11-10 15:37:49 | | 9 | kemi2 | 1q2w3e4r | Access-Accept | 2016-11-10 15:49:14 | | 10 | kemi2 | 1q2w3e4 | Access-Reject | 2016-11-10 15:49:18 | | 11 | kemi2 | 1q2w3e4r | Access-Accept | 2016-11-10 15:49:25 | | 12 | kemi2 | | Access-Accept | 2016-11-10 15:49:54 | | 13 | kemi2 | | Access-Accept | 2016-11-10 15:49:54 | | 14 | kemi2 | | Access-Reject | 2016-11-10 16:10:44 | ... | 54 | kemi2 | | Access-Accept | 2016-11-11 09:45:48 | | 55 | kemi2 | | Access-Accept | 2016-11-11 09:45:56 | +----+----------+----------+---------------+---------------------+ There is any flowchart of freeradius 3 to help me understand how the login proccess? if i understand the log is something like: client send wireless request -> eap decode, send to sql(via inner-tunnel?) -> sql validate, if fails try other options(ex:users file), then send back to eap(via inner-tunnel?) -> eap send reply to client 2016-11-11 9:23 GMT-02:00 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
and on 3.0.12 etc you dont use that option, read the inner-tunnel and enable:
# # Instead of "use_tunneled_reply", uncomment the # next two "update" blocks. # # update { # &outer.session-state: += &reply: # }
# # These attributes are for the inner session only. # They MUST NOT be sent in the outer reply. # # If you uncomment the previous block and leave # this one commented out, WiFi WILL NOT WORK, # because the client will get two MS-MPPE-keys # # update outer.session-state { # MS-MPPE-Encryption-Policy !* ANY # MS-MPPE-Encryption-Types !* ANY # MS-MPPE-Send-Key !* ANY # MS-MPPE-Recv-Key !* ANY # Message-Authenticator !* ANY # EAP-Message !* ANY # Proxy-State !* ANY # }