Dear Alan, Thank you for the quick reply. Indeed, on WinXP I was using the Funk Odyssey client as it offered a good debug log. However, I tested using different supplicants like IntelPROSet on WinXP and the OSX 10.4 built-in supplicant with consistent results. I even tried a LinkSys WAP54G Fat AP firmware v3.04, as well as the Aruba switch with its thin AP with no difference in the results. I would certainly appreciate any tips on the possible workarounds you mentioned. Thx Mak -----Original Message----- From: freeradius-users-bounces+mmoussa=mmoussa.com@lists.freeradius.org [mailto:freeradius-users-bounces+mmoussa=mmoussa.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, October 05, 2006 8:05 AM To: FreeRadius users mailing list Subject: Re: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ? "Mak Moussa" <mmoussa@mmoussa.com> wrote:

I would appreciate any insight into the 802.1x authentication using TTLS with MSCHAPv2. Such auth scheme is constantly failing in my wireless setup with FreeRadius. I tried 3 versions v1.0.5, v1.1.2 and v1.1.3 with not much luck.

OK...

The following authentication schemes worked fine: 1. TTLS w/ MSCHAP from my wireless client to freeradius v1.0.5, v1.1.2, v1.1.3 2. PEAP w/ MSCHAPv2 with same wireless client to same freeradius versions. 3. TTLS w/ MSCHAPv2 from the same wireless setup to an SBR v5.3

OK.

If I made a freeradius configuration mistake, TTLS with mschap wouldn't work.

Hmm... it may be that the MSCHAPv2 support in the TTLS code needs work. I haven't looked at it recently, but I do recall some work-arounds.. Which client are you using? It looks like Windows, but Windows doesn't support TTLS natively, so you're obviously doing something special. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Roberto Greiner <mrgreiner@gmail.com> wrote:

I have a server running GNU-Radius 1.3, and was preparing to migrate it to FreeRadius 1.1.3, but on recent messages I noticed that 2.0 is being developed. My doubt is, should I go ahead and install 1.1.3, or wait and go straight for 2.0? The GNU-Radius machine is not giving me troubles for now, and there are no heavy time constraints to make the switch. Should I wait or go now for 1.1.3, updating later to 2.0?

I would say 1.1.3 is fine to use. 2.0 will be out in a few months, so you're free to upgrade then, too. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

King, Michael wrote:

-----Original Message----- I would say 1.1.3 is fine to use. 2.0 will be out in a few months, so you're free to upgrade then, too.

I think question he was trying to get across, is 2.0 going to be significantly different from 1.1.3 from a config standpoint.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Actually it's both: to know if the new version was expect to be ready soon and if the general structure would be too different, but since it's still months before 2.0 is ready, I will go for 1.1.3. :-) Thank you for the feedback, Roberto -- ------------------------------------------------------------------- | Marcos Roberto Greiner | | | | Os otimistas acham que estamos no melhor dos mundos | | Os pessimistas tem medo de que isto seja verdade | | Murphy | ------------------------------------------------------------------- | rgreiner@usp.br | -------------------------------------------------------------------

"Mak Moussa" <mmoussa@mmoussa.com> wrote:

Thank you for the quick reply. Indeed, on WinXP I was using the Funk Odyssey client as it offered a good debug log.

Ok...

However, I tested using different supplicants like IntelPROSet on WinXP and the OSX 10.4 built-in supplicant with consistent results.

i.e. it doesn't work, either? It looks like it may be an issue with FreeRADIUS. See src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c, function process_reply(). Poke that code, and see if it helps... Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

"Mak Moussa" <mmoussa@mmoussa.com> wrote:

Would you still say that it is the ttls.c code, even though ttls w/mschap worked fine?

Yes.

I am looking for a differentiator in the code between mschap and mschapv2,

Like the code I pointed you to? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

hi, urgh. please never attached things using outlook/outlook express. the rest of the world doesnt tak winmail.dat files. I've fentun'd the result and reattached for you. alan

Thanks to Alan Buxey for reattaching the files in a tgz file. Resending again. Mak -----Original Message----- From: freeradius-users-bounces+mmoussa=mmoussa.com@lists.freeradius.org [mailto:freeradius-users-bounces+mmoussa=mmoussa.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, October 12, 2006 5:44 AM To: FreeRadius users mailing list Subject: Re: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ? "Mak Moussa" <mmoussa@mmoussa.com> wrote:

He tested the patch successfully using v1.1.3 on Linux and both TTLS-mschap and TTLS-mschav2 authentications worked fine. I tested the patch using v1.1.2 on Freebsd 5.3 and got the same successful authentications.

Great.

Please review the attached patch for any additional improvements as needed.

Hmm...

Content-Disposition: attachment; filename="winmail.dat"

Could you attach the files in a *standard* format (i.e. non-Outlook), or put them on a web page? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Apu islam wrote:

I am having problems rewriting the IP Netmask attribure. I am using mysql for my user authorization. the IP address seems to get set right, but the Netmask does not. I have specified it specifically and even changed the default, but could not get this to work. Its a PPP framed connection. What should I look at ? Thank you for suggestions.

Apu

Hi Apu, Run the server in debugging mode (radiusd -X) and watch the access-accept packet go from freeradius to your NAS. If the subnet mask is correct there, there's a config. problem/bug with your NAS. If it's not correct there, then there's something you've missed in your freeradius config. Is there any chance the subnet mask is specified on your NAS and it's overriding what you send it? Cheers, -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield@deakin.edu.au Website: http://www.deakin.edu.au