Hello all, I am running FreeRadius 2.1.8 with two NAS clients and a couple of end devices being authenticated successfully with EAP-TTLS. My setup was running just fine on IPv4 and I would like to jump to IPv6. My first trial seems ok, but not ideal, so here are my IPv6 related questions : a) Why am I seeing in my radius -X output lines as the following : ++[detail] returns ok [unix] IPv6 is not supported! ++[unix] returns noop rlm_radutmp: IPv6 not supported! ++[radutmp] returns noop What could trigger that "IPv6 is not supported" output? Is there something that might be going wrong, because clients get authenticated successfully as far as I can tell but I am afraid that something else might be broken. b) My FreeRadius machine has "an easy to remember" IPv6 address e.g. 2001:a::1 and NAS clients are using this to send packets to FR. However it seems that FR is configuring another IPv6 address from the router advertisements that it gets from the access network. The problem is that when this happens FR replies to NAS with packets coming from the autoconfigured address as source and thus breaks the setup as NAS are waiting packets from 2001:a::1. Is there a way to force FR to generate packets coming from the manually configured IP (2001:a::1) ? c) Is there a plan to get a dual stack FreeRadius? It would be really advantageous to be able to run FreeRadius in both ipv4 and ipv6 at the same time. Thanks a lot in advance, Panos
Panagiotis Georgopoulos wrote:
a) Why am I seeing in my radius –X output lines as the following :
[unix] IPv6 is not supported!
The "unix" module stores user login information into a "wtmp" style file. It doesn't support IPv6.
rlm_radutmp: IPv6 not supported!
Same thing here. It stores user login information into a "utmp" style file. It doesn't support IPv6.
What could trigger that “IPv6 is not supported” output? Is there something that might be going wrong, because clients get authenticated successfully as far as I can tell but I am afraid that something else might be broken.
If you don't use "radlast" and "radwho", you can delete the "unix" and "radutmp" entries from the "accounting" section. Nothing else will be affected.
b) My FreeRadius machine has “an easy to remember” IPv6 address e.g. 2001:a::1 and NAS clients are using this to send packets to FR. However it seems that FR is configuring another IPv6 address from the router advertisements that it gets from the access network.
No. FreeRADIUS doesn't configure IPv6 addresses. Your OS does.
The problem is that when this happens FR replies to NAS with packets coming from the autoconfigured address as source and thus breaks the setup as NAS are waiting packets from 2001:a::1. Is there a way to force FR to generate packets coming from the manually configured IP (2001:a::1) ?
Update the "listen" section to bind to that specific IP.
c) Is there a plan to get a dual stack FreeRadius? It would be really advantageous to be able to run FreeRadius in both ipv4 and ipv6 at the same time.
Uh... it's *already* dual stack. You are running it dual stack right now. Alan DeKok.
Hello Alan, Thanks for your replies, they are helpful. Regarding the last question...
c) Is there a plan to get a dual stack FreeRadius? It would be really advantageous to be able to run FreeRadius in both ipv4 and ipv6 at the same time.
Uh... it's *already* dual stack. You are running it dual stack right now.
I guess the emphasis on my question above is on *at the same time*. Now radiusd.conf explicitly says : # OR, you can use an IPv6 address, but not both # at the same time. In other words FR to listen to both an IPv4 and an IPv6 address simultaneously for ipv4 and ipv6 NAS clients. Cheers, Panos
Panagiotis Georgopoulos wrote:
I guess the emphasis on my question above is on *at the same time*.
Now radiusd.conf explicitly says :
# OR, you can use an IPv6 address, but not both # at the same time.
In other words FR to listen to both an IPv4 and an IPv6 address simultaneously for ipv4 and ipv6 NAS clients.
You cannot have one "listen" section accept packets on BOTH IPv4 and IPv6 addresses. You CAN have two "listen" sections, one accepting IPv4, and one accepting IPv6. Just like you can have two "listen" sections, one for authentication, and the other for accounting. Alan DeKok.
Hi Alan,
Panagiotis Georgopoulos wrote:
I guess the emphasis on my question above is on *at the same time*.
Now radiusd.conf explicitly says :
# OR, you can use an IPv6 address, but not both # at the same time.
In other words FR to listen to both an IPv4 and an IPv6 address simultaneously for ipv4 and ipv6 NAS clients.
You cannot have one "listen" section accept packets on BOTH IPv4 and IPv6 addresses.
You CAN have two "listen" sections, one accepting IPv4, and one accepting IPv6.
Just like you can have two "listen" sections, one for authentication, and the other for accounting.
Very Useful, thanks a lot, Panos
participants (3)
-
Alan Buxey -
Alan DeKok -
Panagiotis Georgopoulos