We are seeing an increasing number of eap error messages: Error: rlm_eap: No EAP session matching the State variable As mentioned in the Changelog in later version an eap error has been detected and fixed in 2.1.4 Fix EAP-TLS bug. Patch from Arnaud Ebalard Is this bug-fix related to the error messageabove so that upgrading alone would help? Norbert Wegener
Wegener, Norbert wrote:
We are seeing an increasing number of eap error messages:
Error: rlm_eap: No EAP session matching the State variable
As mentioned in the Changelog in later version an eap error has been detected and fixed in 2.1.4 Fix EAP-TLS bug. Patch from Arnaud Ebalard
Is this bug-fix related to the error messageabove so that upgrading alone would help?
I don't think it's related. That fix addressed the issue of large amounts of data inside of the TLS tunnel. The error you're seeing is usually caused by EAP packets coming in 60 seconds apart. When the EAP session takes too long to process, the server deletes the context. See "timer_expire" in eap.conf. Another possible reason for the error is that the NAS is sending EAP packets from different source IP's. The EAP sessions are keyed by (source IP, EAP Id, State). If you have load-balanced RADIUS proxies in between the NAS and the final server, then packets for the same EAP could pass through proxy 1 *or* proxy 2. That would confuse the EAP module. e.g. NAS ----> proxy 1 -----> home AAA \---> proxy 2 ----/ If the home AAA sees the EAP session as coming from "proxy 1", it won't like packets for the *same* session coming from "proxy 2". Alan DeKok.
-----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+norbert.wegener=siemens.com@lists.freeradius.org [mailto:freeradius-users-bounces+norbert.wegener=siemens.com@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Donnerstag, 30. Juli 2009 15:21 An: FreeRadius users mailing list Betreff: Re: EAP errors in 2.1.1 Wegener, Norbert wrote:
We are seeing an increasing number of eap error messages:
Error: rlm_eap: No EAP session matching the State variable .. The error you're seeing is usually caused by EAP packets coming in 60 seconds apart. When the EAP session takes too long to process, the server deletes the context. See "timer_expire" in eap.conf.
Another possible reason for the error is that the NAS is sending EAP packets from different source IP's. The EAP sessions are keyed by (source IP, EAP Id, State).
We noticed at one of the involved windows clients that for an unknown reason its system clock changed while the eap session has been started. Might such a change of system time also lead to that kind of problem? Norbert Wegener
Wegener, Norbert wrote:
We noticed at one of the involved windows clients that for an unknown reason its system clock changed while the eap session has been started. Might such a change of system time also lead to that kind of problem?
I wouldn't be surprised. I don't know enough about Windows to say for sure if this is the cause of the problem. Alan DeKok.
On 06/08/2009 16:03, Alan DeKok wrote:
Wegener, Norbert wrote:
We noticed at one of the involved windows clients that for an unknown reason its system clock changed while the eap session has been started. Might such a change of system time also lead to that kind of problem?
I wouldn't be surprised. I don't know enough about Windows to say for sure if this is the cause of the problem.
I would be surprised. It'd be pretty horrific if system time changes effected state timers. So timeouts seem the obvious candidate... Try increasing the EAP session timeout in the EAP stanza? Arran -- Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk>, Systems Administrator (AAA), Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2
Hi,
We are seeing an increasing number of eap error messages:
Error: rlm_eap: No EAP session matching the State variable
either your EAP stuff is being proxied to your server via different servers and therefore not matching (all the EAP session must go through the same proxy path), or the sessions are taking too long to be established (check your timeouts and cleanup delays in your server - if using DB to auth, for example, this could cause issues if too busy) or the network authentication server is not using the same port or MAC etc when talking to the RADIUS alan
participants (4)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Wegener, Norbert