I have a problem , My freeradius Server works with Radtest , with Normal Home Router but not with UNIFI APs , he is the debug , The Server send the Access-Accept but the AP seems to not accept the connection from the Server my Hardware is Unifi please Help (0) Received Access-Request Id 4 from 192.168.1.6:44463 to 192.168.1.10:1812 length 245 (0) User-Name = "oktaradius@contentful.com" (0) NAS-IP-Address = 192.168.1.6 (0) NAS-Identifier = "F09FC2307B82D74DA8A1" (0) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "8C-85-90-C9-C4-A5" (0) Connect-Info = "CONNECT 0Mbps 802.11b" (0) Acct-Session-Id = "9CDA00101279DBED" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027074 (0) WLAN-AKM-Suite = 1027073 (0) Framed-MTU = 1400 (0) EAP-Message = 0x0216001e016f6b746172616469757340636f6e74656e7466756c2e636f6d (0) Message-Authenticator = 0xeec65192e2ddf53d4d33db8190adf232 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) authorize { (0) update control { (0) Proxy-To-Realm := LOCAL (0) } # update control = noop (0) eap: Peer sent EAP Response (code 2) ID 22 length 30 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 23 length 6 (0) eap: EAP session adding &reply:State = 0xfaa47198fab36411 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) Sent Access-Challenge Id 4 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (0) EAP-Message = 0x011700061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xfaa47198fab36411baefeb91c43d0602 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 5 from 192.168.1.6:44463 to 192.168.1.10:1812 length 394 (1) User-Name = "oktaradius@contentful.com" (1) NAS-IP-Address = 192.168.1.6 (1) NAS-Identifier = "F09FC2307B82D74DA8A1" (1) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "8C-85-90-C9-C4-A5" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "9CDA00101279DBED" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027074 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x021700a115800000009716030100920100008e03035d5188828d15cd4d7a82bf0731e77373065ecf57a0bf3f4d4082633bee46876100002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00 (1) State = 0xfaa47198fab36411baefeb91c43d0602 (1) Message-Authenticator = 0xbe4a540bc251f8055feaedc56f6d5fff (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) authorize { (1) update control { (1) Proxy-To-Realm := LOCAL (1) } # update control = noop (1) eap: Peer sent EAP Response (code 2) ID 23 length 161 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) authenticate { (1) eap: Expiring EAP session with state 0xfaa47198fab36411 (1) eap: Finished EAP session with state 0xfaa47198fab36411 (1) eap: Previous EAP request found for state 0xfaa47198fab36411, released from the list (1) eap: Peer sent packet with method EAP TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Authenticate (1) eap_ttls: Continuing EAP-TLS (1) eap_ttls: Peer indicated complete TLS record size will be 151 bytes (1) eap_ttls: Got complete TLS record (151 bytes) (1) eap_ttls: [eaptls verify] = length included (1) eap_ttls: (other): before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (1) eap_ttls: TLS_accept: SSLv3/TLS read client hello (1) eap_ttls: >>> send TLS 1.2 [length 003d] (1) eap_ttls: TLS_accept: SSLv3/TLS write server hello (1) eap_ttls: >>> send TLS 1.2 [length 03e8] (1) eap_ttls: TLS_accept: SSLv3/TLS write certificate (1) eap_ttls: >>> send TLS 1.2 [length 014d] (1) eap_ttls: TLS_accept: SSLv3/TLS write key exchange (1) eap_ttls: >>> send TLS 1.2 [length 0004] (1) eap_ttls: TLS_accept: SSLv3/TLS write server done (1) eap_ttls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_ttls: In SSL Handshake Phase (1) eap_ttls: In SSL Accept mode (1) eap_ttls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 24 length 1004 (1) eap: EAP session adding &reply:State = 0xfaa47198fbbc6411 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) Sent Access-Challenge Id 5 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (1) EAP-Message = 0x011803ec15c00000058a160303003d02000039030349e81822793d24a35e670383027a3eada3f2f3378a72d3789a4e393459bb0f3600c030000011ff01000100000b0004030001020017000016030303e80b0003e40003e10003de308203da308202c2a003020102020101300d06092a864886f70d0101 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xfaa47198fbbc6411baefeb91c43d0602 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 6 from 192.168.1.6:44463 to 192.168.1.10:1812 length 239 (2) User-Name = "oktaradius@contentful.com" (2) NAS-IP-Address = 192.168.1.6 (2) NAS-Identifier = "F09FC2307B82D74DA8A1" (2) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Calling-Station-Id = "8C-85-90-C9-C4-A5" (2) Connect-Info = "CONNECT 0Mbps 802.11b" (2) Acct-Session-Id = "9CDA00101279DBED" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027074 (2) WLAN-AKM-Suite = 1027073 (2) Framed-MTU = 1400 (2) EAP-Message = 0x021800061500 (2) State = 0xfaa47198fbbc6411baefeb91c43d0602 (2) Message-Authenticator = 0xd673ec1af4da37f49eee91a44fff135f (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) authorize { (2) update control { (2) Proxy-To-Realm := LOCAL (2) } # update control = noop (2) eap: Peer sent EAP Response (code 2) ID 24 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) authenticate { (2) eap: Expiring EAP session with state 0xfaa47198fbbc6411 (2) eap: Finished EAP session with state 0xfaa47198fbbc6411 (2) eap: Previous EAP request found for state 0xfaa47198fbbc6411, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 25 length 434 (2) eap: EAP session adding &reply:State = 0xfaa47198f8bd6411 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) Sent Access-Challenge Id 6 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (2) EAP-Message = 0x011901b215800000058a1243396539a2f1ad1b6a17603569def5a0794b3af441b40273fd27a0361b18742b5e898d798d94b85c2aaa4ede14cfe7c5f7406c7d5eb178bc1e609fbfefb1920ce1f720d4bbd7ea7e4c91a2b0160303014d0c0001490300174104c4784b7e2fc3e8cf21033a4766054d0266e0 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xfaa47198f8bd6411baefeb91c43d0602 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 7 from 192.168.1.6:44463 to 192.168.1.10:1812 length 369 (3) User-Name = "oktaradius@contentful.com" (3) NAS-IP-Address = 192.168.1.6 (3) NAS-Identifier = "F09FC2307B82D74DA8A1" (3) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Calling-Station-Id = "8C-85-90-C9-C4-A5" (3) Connect-Info = "CONNECT 0Mbps 802.11b" (3) Acct-Session-Id = "9CDA00101279DBED" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027074 (3) WLAN-AKM-Suite = 1027073 (3) Framed-MTU = 1400 (3) EAP-Message = 0x0219008815800000007e1603030046100000424104c9371a045101d7c7d9563212df6bc5a5b2417a499869eeaa50453d1f81bc96938addc1a9bf0512021dfdf2091938b4da9646febec921b00a57a717e72e7155861403030001011603030028860b3611b6543395b1c6bbaaf83beea322054daf0beb35 (3) State = 0xfaa47198f8bd6411baefeb91c43d0602 (3) Message-Authenticator = 0xd8e7b2d6e17e721eda1f459d4d421864 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) authorize { (3) update control { (3) Proxy-To-Realm := LOCAL (3) } # update control = noop (3) eap: Peer sent EAP Response (code 2) ID 25 length 136 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) authenticate { (3) eap: Expiring EAP session with state 0xfaa47198f8bd6411 (3) eap: Finished EAP session with state 0xfaa47198f8bd6411 (3) eap: Previous EAP request found for state 0xfaa47198f8bd6411, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (3) eap_ttls: Got complete TLS record (126 bytes) (3) eap_ttls: [eaptls verify] = length included (3) eap_ttls: TLS_accept: SSLv3/TLS write server done (3) eap_ttls: <<< recv TLS 1.2 [length 0046] (3) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (3) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (3) eap_ttls: <<< recv TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS read finished (3) eap_ttls: >>> send TLS 1.2 [length 0001] (3) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (3) eap_ttls: >>> send TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS write finished (3) eap_ttls: (other): SSL negotiation finished successfully (3) eap_ttls: SSL Connection Established (3) eap_ttls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 26 length 61 (3) eap: EAP session adding &reply:State = 0xfaa47198f9be6411 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) Sent Access-Challenge Id 7 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (3) EAP-Message = 0x011a003d15800000003314030300010116030300286d3279646040945eb6f8d448620c0719de823b9e656e0260d632d35eacaa5fa8a16d89afdfad464c (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xfaa47198f9be6411baefeb91c43d0602 (3) Finished request Waking up in 4.8 seconds. (4) Received Access-Request Id 8 from 192.168.1.6:44463 to 192.168.1.10:1812 length 332 (4) User-Name = "oktaradius@contentful.com" (4) NAS-IP-Address = 192.168.1.6 (4) NAS-Identifier = "F09FC2307B82D74DA8A1" (4) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "8C-85-90-C9-C4-A5" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "9CDA00101279DBED" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) EAP-Message = 0x021a00631580000000591703030054860b3611b65433960489141a64f3a8cb7c13b947583a4921f0806cd7acc46445465f35fb81bd6104f94599eefeb0d061f172f627a632af17613fac442a331cd9cb5030708bebf6dcf788682be55ac8c3f52b02ae (4) State = 0xfaa47198f9be6411baefeb91c43d0602 (4) Message-Authenticator = 0xdfcd2b5cc81d4042154a25f616974409 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authorize { (4) update control { (4) Proxy-To-Realm := LOCAL (4) } # update control = noop (4) eap: Peer sent EAP Response (code 2) ID 26 length 99 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authenticate { (4) eap: Expiring EAP session with state 0xfaa47198f9be6411 (4) eap: Finished EAP session with state 0xfaa47198f9be6411 (4) eap: Previous EAP request found for state 0xfaa47198f9be6411, released from the list (4) eap: Peer sent packet with method EAP TTLS (21) (4) eap: Calling submodule eap_ttls to process data (4) eap_ttls: Authenticate (4) eap_ttls: Continuing EAP-TLS (4) eap_ttls: Peer indicated complete TLS record size will be 89 bytes (4) eap_ttls: Got complete TLS record (89 bytes) (4) eap_ttls: [eaptls verify] = length included (4) eap_ttls: [eaptls process] = ok (4) eap_ttls: Session established. Proceeding to decode tunneled attributes (4) eap_ttls: Got tunneled request (4) eap_ttls: User-Name = "oktaradius@contentful.com" (4) eap_ttls: User-Password = "BetAThetA135" (4) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (4) eap_ttls: Sending tunneled request (4) Virtual server inner-tunnel received request (4) User-Name = "oktaradius@contentful.com" (4) User-Password = "BetAThetA135" (4) FreeRADIUS-Proxied-To = 127.0.0.1 (4) NAS-IP-Address = 192.168.1.6 (4) NAS-Identifier = "F09FC2307B82D74DA8A1" (4) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "8C-85-90-C9-C4-A5" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "9CDA00101279DBED" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) WARNING: Outer and inner identities are the same. User privacy is compromised. (4) server inner-tunnel { (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authorize { (4) update control { (4) Proxy-To-Realm := LOCAL (4) } # update control = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [pap] = noop (4) if (User-Password) { (4) if (User-Password) -> TRUE (4) if (User-Password) { (4) update control { (4) Auth-Type := ldap (4) } # update control = noop (4) } # if (User-Password) = noop (4) } # authorize = noop (4) Found Auth-Type = ldap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authenticate { rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 153 seconds rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 152 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 151 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 150 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 149 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (5), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://contentful.ldap.oktapreview.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (5) (4) ldap: Login attempt by "oktaradius@contentful.com" (4) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (4) ldap: --> (uid=oktaradius@contentful.com) (4) ldap: Performing search in "ou=users,dc=contentful, dc=oktapreview, dc=com" with filter "(uid=oktaradius@contentful.com)", scope "sub" (4) ldap: Waiting for search result... (4) ldap: User object found at DN "uid=oktaradius@contentful.com ,ou=users,dc=contentful,dc=oktapreview,dc=com" (4) ldap: Waiting for bind result... (4) ldap: Bind successful (4) ldap: Bind as user "uid=oktaradius@contentful.com,ou=users,dc=contentful,dc=oktapreview,dc=com" was successful rlm_ldap (ldap): Released connection (5) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (6), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://contentful.ldap.oktapreview.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (4) [ldap] = ok (4) } # authenticate = ok (4) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) } # server inner-tunnel (4) Virtual server sending reply (4) eap_ttls: Got tunneled Access-Accept (4) eap: Sending EAP Success (code 3) ID 26 length 4 (4) eap: Freeing handler (4) [eap] = ok (4) } # authenticate = ok (4) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) Sent Access-Accept Id 8 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (4) MS-MPPE-Recv-Key = 0x8c05d9a6191d353cf4101fe02b866e7a91dc69e4192eacd39647f6167f7cfd41 (4) MS-MPPE-Send-Key = 0x6e524da319bdd251d5f4b702316813dfed52e1ee2eb530ff93e742b8d1be8df4 (4) EAP-Message = 0x031a0004 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) User-Name = "oktaradius@contentful.com" (4) Finished request Waking up in 2.1 seconds. Waking up in 2.1 seconds. (0) Cleaning up request packet ID 4 with timestamp +149 (1) Cleaning up request packet ID 5 with timestamp +149 (2) Cleaning up request packet ID 6 with timestamp +149 (3) Cleaning up request packet ID 7 with timestamp +149 Waking up in 7.7 seconds. (4) Cleaning up request packet ID 8 with timestamp +149 Ready to process requests -- Nawar Al Tarazi IT Working Student nawar.tarazi@contentful.com +4915787991702 www.contentful.com