Hello everybody, my name is Leandro and I'm from an ISP in Brazil. My freeradius is giving me errors saying that my NAS is sending auth packets to the wrong port. I have already seen people with this error around the net, including here at the list. Testing with radclient it works very well. I'm trying to migrate from cistron to freeradius. The packet is coming from the telecom that handles the dial-in for us. I've already set up a sniffer on the machine to check to what port they are sending the packets and it's to 1812. There is something to do with NAS type? Does anyone knows how to solve this? Thanks, Leandro. Running freeradius -X: (...) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 200.184.x.x:49852, id=141, length=124 Authentication-Request sent to a non-authentication port from client nas-intelig-1:49852 - ID 141 : IGNORED --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 200.184.x.x:49852, id=141, length=124 Authentication-Request sent to a non-authentication port from client nas-intelig-1:49852 - ID 141 : IGNORED --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 200.184.x.x:49852, id=220, length=124 Authentication-Request sent to a non-authentication port from client nas-intelig-1:49852 - ID 220 : IGNORED (...) -- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay
Leandro Pereira de Lima e Silva - ViaLink <leandro@vialink.com.br> wrote:
I've already set up a sniffer on the machine to check to what port they are sending the packets and it's to 1812.
To 1812, or from 1812? That message is printed only when Access-Request packets go to non-1812 ports. Alan DeKok.
Alan, it's going to 1812. As we can see at the log that I posted, it's coming from port 49852. Thanks, Leandro. Alan DeKok escreveu:
Leandro Pereira de Lima e Silva - ViaLink <leandro@vialink.com.br> wrote:
I've already set up a sniffer on the machine to check to what port they are sending the packets and it's to 1812.
To 1812, or from 1812?
That message is printed only when Access-Request packets go to non-1812 ports.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay
Alan, thank you very much for your help. I saw in sniffer packets going to 1812 and 1813, so I presumed that auth and acct ports were correct. Today I modified freeradius source to show me the destination port in the error and got a little surprise. They were sending auth to 1813 and acct to 1812. To bypass this problem I set port = 1234 and used listen directive to open 1812 to acct and 1813 to auth. I will make a request for them (to my dial-up backbone) to correct the port in NAS. I will send my little patch to freeradius too, this little new information in log ended up helping a lot. Best regards, Leando. Alan DeKok escreveu:
Leandro Pereira de Lima e Silva - ViaLink <leandro@vialink.com.br> wrote:
Alan, it's going to 1812. As we can see at the log that I posted, it's coming from port 49852.
OK. I've never seen that problem before, so I'm not sure what to say.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay
By the way, there is any way of authorizing the other ports (1813 and 1814) to receive auth packets? I tried that with listen directive, but the port was already open so it didn't worked. Thanks, Leandro. Alan DeKok escreveu:
Leandro Pereira de Lima e Silva - ViaLink <leandro@vialink.com.br> wrote:
I've already set up a sniffer on the machine to check to what port they are sending the packets and it's to 1812.
To 1812, or from 1812?
That message is printed only when Access-Request packets go to non-1812 ports.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay
participants (2)
-
Alan DeKok -
Leandro Pereira de Lima e Silva - ViaLink