Hello, I desperately need your help. I am noob with FreeRadius so please guide me what i am doing wrong. My point is using freeradius as a Proxy. Because we already have a PAP supported Radius, so i want to do eap auth part on freeradius and then Proxy the Access-request to our own Radius. We are trying 802.1x authantication. According to my readings i did below steps : 1 . Edit clients.conf for my mobile devices to Access freeradius client nevotek { ipaddr = 213.74.143.140 secret = testing1234 } 2. add home_server in proxy.conf home_server IAS { ipaddr = 192.168.0.252<tel:+11921680252> port = 1812 type = "auth" secret = "secret" response_window = 20 max_outstanding = 65536 } home_server_pool jack_pool { type = fail-over home_server = IAS } realm nevotek { auth_pool = jack_pool nostirp } 3. edit eap.cof default_eap_type = ttls and in ttls function : ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } 4. prepare Proxy.config soft link for sites-enabled, added nevotek in proxy-inner-tunnel: server proxy-inner-tunnel { authorize { update control { Proxy-To-Realm := "nevotek" } } authenticate { eap } post-proxy { eap } } 5. disabled "suffix" part in sites-enabled/default But no chance. Also android and IOS devices has different behaviors. Here is the output of IOS device : (2) Received Access-Request Id 216 from 213.74.143.148:19733 to 10.0.0.4:1812 length 311 (2) User-Name = "iosuser2@nevotek.com<mailto:iosuser2@nevotek.com>" (2) Chargeable-User-Identity = 0x00 (2) Operator-Name = "1nevotek.com<http://1nevotek.com/>" (2) Location-Capable = Civic-Location (2) Calling-Station-Id = "74-8d-08-b1-f2-17" (2) Called-Station-Id = "58-f3-9c-43-52-a0:Nevotek" (2) NAS-Port = 4 (2) Cisco-AVPair = "audit-session-id=0a0102e1000001205<tel:+11000001205>fbba08c" (2) Acct-Session-Id = "5fbba08c/74:8d:08:b1:f2:17/352" (2) NAS-IP-Address = 10.1.2.225 (2) NAS-Identifier = "aa5a6c45-b2c2-436b-90da-0ed2031" (2) Airespace-Wlan-Id = 7 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) EAP-Message = 0x020300061500 (2) State = 0xca8e79cacb8d6ce3fd1d37ee8f32d170 (2) Message-Authenticator = 0xc7b01c5b471b2eb70578f1dc7ed6e7ea (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /@\./<mailto:/@\./>) { (2) if (&User-Name =~ /@\./<mailto:/@\./>) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xca8e79cacb8d6ce3 (2) eap: Finished EAP session with state 0xca8e79cacb8d6ce3 (2) eap: Previous EAP request found for state 0xca8e79cacb8d6ce3, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 336 (2) eap: EAP session adding &reply:State = 0xca8e79cac88a6ce3 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 216 from 10.0.0.4:1812 to 213.74.143.148:19733 length 0 (2) EAP-Message = 0x01040150158000000528d123b84f84592a0a7ccb12b23ec09a0c025464d3f258d5090bffa282b17870910449329f906380b0b4340ef2b6a1dc73e72d35763148b65bfc0401010038<tel:+10401010038>af8b17d95590598994e5ec35c96642e3e8fce291173f61b7e1ca06aa4b749dd3f2bbe12175a964524311069490e0f6 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xca8e79cac88a6ce3fd1d37ee8f32d170 (2) Finished request And here is the output of Android device : (2) Received Access-Request Id 59 from 213.74.143.148:38031 to 10.0.0.4:1812 length 312 (2) User-Name = "anonymous@nevotek.com<mailto:anonymous@nevotek.com>" (2) Chargeable-User-Identity = 0x00 (2) Operator-Name = "1nevotek.com<http://1nevotek.com/>" (2) Location-Capable = Civic-Location (2) Calling-Station-Id = "04-b1-a1-53-4d-1e" (2) Called-Station-Id = "58-f3-9c-43-52-a0:Nevotek" (2) NAS-Port = 4 (2) Cisco-AVPair = "audit-session-id=0a0102e1000001275<tel:+11000001275>fbbbb17" (2) Acct-Session-Id = "5fbbbb17/04:b1:a1:53:4d:1e/359" (2) NAS-IP-Address = 10.1.2.225 (2) NAS-Identifier = "aa5a6c45-b2c2-436b-90da-0ed2031" (2) Airespace-Wlan-Id = 7 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) EAP-Message = 0x020300061500 (2) State = 0xd875f9c9d976ec270910ae6415adb475 (2) Message-Authenticator = 0xe92ebb9e5e7641c5515a25ae2ee50929 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /@\./<mailto:/@\./>) { (2) if (&User-Name =~ /@\./<mailto:/@\./>) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xd875f9c9d976ec27 (2) eap: Finished EAP session with state 0xd875f9c9d976ec27 (2) eap: Previous EAP request found for state 0xd875f9c9d976ec27, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 336 (2) eap: EAP session adding &reply:State = 0xd875f9c9da71ec27 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 59 from 10.0.0.4:1812 to 213.74.143.148:38031 length 0 (2) EAP-Message = 0x01040150158000000528a2e03207e6a1163699<tel:+11163699>a1cff7af74692beaafff15b2a3033c4d0238dd7014db04f7f40d669da91832dd39bbdbfca1bdb456f26f4a981b5a820108040100b7a20cf24aad9d35b94575b849f9e8ef528d1b13e7caea59f3cc578845763a601b7fceb8ffda9d989423730b5ea4c0f3 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xd875f9c9da71ec270910ae6415adb475 (2) Finished request Waking up in 4.3 seconds. (3) Received Access-Request Id 60 from 213.74.143.148:38031 to 10.0.0.4:1812 length 319 (3) User-Name = "anonymous@nevotek.com<mailto:anonymous@nevotek.com>" (3) Chargeable-User-Identity = 0x00 (3) Operator-Name = "1nevotek.com<http://1nevotek.com/>" (3) Location-Capable = Civic-Location (3) Calling-Station-Id = "04-b1-a1-53-4d-1e" (3) Called-Station-Id = "58-f3-9c-43-52-a0:Nevotek" (3) NAS-Port = 4 (3) Cisco-AVPair = "audit-session-id=0a0102e1000001275<tel:+11000001275>fbbbb17" (3) Acct-Session-Id = "5fbbbb17/04:b1:a1:53:4d:1e/359" (3) NAS-IP-Address = 10.1.2.225 (3) NAS-Identifier = "aa5a6c45-b2c2-436b-90da-0ed2031" (3) Airespace-Wlan-Id = 7 (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Wireless-802.11 (3) EAP-Message = 0x0204000<tel:+10204000>d150015030300020230 (3) State = 0xd875f9c9da71ec270910ae6415adb475 (3) Message-Authenticator = 0xbd27e9cbdb496b0f8072580915<tel:+18072580915>cabc5d (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)<mailto:/@(.+)\.(.+)$/)>) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /@\./<mailto:/@\./>) { (3) if (&User-Name =~ /@\./<mailto:/@\./>) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) eap: Peer sent EAP Response (code 2) ID 4 length 13 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xd875f9c9da71ec27 (3) eap: Finished EAP session with state 0xd875f9c9da71ec27 (3) eap: Previous EAP request found for state 0xd875f9c9da71ec27, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: [eaptls verify] = ok (3) eap_ttls: Done initial handshake (3) eap_ttls: <<< recv TLS 1.2 [length 0002] (3) eap_ttls: ERROR: TLS Alert read:fatal:unknown CA (3) eap_ttls: TLS_accept: Need to read more data: error (3) eap_ttls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (3) eap_ttls: In SSL Handshake Phase (3) eap_ttls: In SSL Accept mode (3) eap_ttls: SSL Application Data (3) eap_ttls: ERROR: TLS failed during operation (3) eap_ttls: ERROR: [eaptls process] = fail (3) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (3) eap: Sending EAP Failure (code 4) ID 4 length 4 (3) eap: Failed in EAP select (3) [eap] = invalid (3) } # authenticate = invalid (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Post-Auth-Type REJECT { (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> anonymous@nevotek.com<mailto:anonymous@nevotek.com> (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Delaying response for 1.000000<tel:+11000000> seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 60 from 10.0.0.4:1812 to 213.74.143.148:38031 length 44 (3) EAP-Message = 0x04040004 (3) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.1 seconds. (0) Cleaning up request packet ID 57 with timestamp +25 Waking up in 0.2 seconds. (1) Cleaning up request packet ID 58 with timestamp +26 Waking up in 0.3 seconds. (2) Cleaning up request packet ID 59 with timestamp +26 Waking up in 0.2 seconds. (3) Cleaning up request packet ID 60 with timestamp +26 Regards. Get Outlook for Android<https://aka.ms/ghei36> [http://www.nevotek.com/nevotekmail/logo.png] Mesut Ozturk R&D Senior Developer P: +902122867576 E: mesut@nevotek.com F: +902122867476 W: www.nevotek.com [http://www.nevotek.com/nevotekmail/maps-icon.png] Santa Clara-CA, USA<https://www.google.com/maps/place/5201+Great+America+Pkwy+%23320,+Santa+Clara,+CA+95054,+USA/@37.4063062,-121.978682,923m/data=!3m2!1e3!4b1!4m5!3m4!1s0x808fc9cc6fc08be1:0xa189e7ab47ebcdc!8m2!3d37.4063062!4d-121.9764933?hl=en> [http://www.nevotek.com/nevotekmail/maps-icon.png] Istanbul, TURKEY<https://www.google.com/maps/search/teknokent,+Istanbul,+Turkey/@41.106333,29.015257,876m/data=!3m1!1e3?hl=en> [http://www.nevotek.com/nevotekmail/maps-icon.png] Dubai, UAE<https://www.google.com/maps/place/Internet+City,+Building+%2314+-+Dubai+-+United+Arab+Emirates/@25.0984488,55.1609574,1052m/data=!3m2!1e3!4b1!4m13!1m7!3m6!1s0x3e5f6b696d88a9ab:0x6d495147845cd0f1!2sInternet+City,+Building+%2314+-+Dubai+-+United+Arab+Emirates!3b1!8m2!3d25.0983618!4d55.1631953!3m4!1s0x3e5f6b696d88a9ab:0x6d495147845cd0f1!8m2!3d25.0983618!4d55.1631953?hl=en> [www.nevotek.com]<www.nevotek.com>