FW: Radius Server Doesn't Communicate AP
Hi my problem is that im trying to communicate my radius server with the access point that i already configured and already added to the clients list and still doesn't work! i've been in all the forums about freeradius and i've read all the documentation of freeradius but nothing solve thisim really frustrated about this so i'd really appreciate it if someone could help me thank u
On Sat, Oct 1, 2011 at 3:52 PM, Alejandro Moreno <mamr901@hotmail.com> wrote:
Hi my problem is that im trying to communicate my radius server with the access point that i already configured and already added to the clients list and still doesn't work!
Ok this is the output from the debuging, the radtest works fine for localhost client but not for the AP Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.100 { require_message_authenticator = no secret = "testing" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "123qwe" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=192.168.0.1,shortname=huawei,secret=123qwe rlm_sql (sql): Adding client 192.168.0.1 (huawei, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests.
Alejandro Moreno wrote:
Ok this is the output from the debuging, the radtest works fine for localhost client but not for the AP
Nice. A completely useless debug output. The point of debugging output is to show that the server receives a packet, and how that packet is processed. So posting the debug output with *no* packets received is useless. If the server never receives a packet, then the problem is *not* RADIUS. You have a network problem. Go fix the network. No amount of poking the RADIUS server will make IP routing work correctly. Alan DeKok.
So...sorry for my ignorance but how should I test that the server is actually receiving packages?
Alejandro Moreno wrote:
So...sorry for my ignorance but how should I test that the server is actually receiving packages?
What I said was: The point of debugging output is to show that the server receives a packet, and how that packet is processed. The debug output shows that the server receives packets. If you had bothered to run it in debugging mode for packets from localhost, you would see what it does. Alan DeKok.
So...this is the output for the radtest from localhost...for the AP radtest there is no debugging output...what does this mean?? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 46599, id=213, length=56 User-Name = "mile" User-Password = "salsera" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mile", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> mile [sql] sql_set_user escaped user --> 'mile' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mile' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mile' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mile' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group PAP {...} [pap] login attempt with password "salsera" [pap] Using clear text password "salsera" [pap] User authenticated successfully ++[pap] returns ok Login OK: [mile] (from client localhost port 1812) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 213 to 127.0.0.1 port 46599 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 213 with timestamp +36 Ready to process requests.
What I said was:
The point of debugging output is to show that the server receives a packet, and how that packet is processed.
The debug output shows that the server receives packets. If you had bothered to run it in debugging mode for packets from localhost, you would see what it does.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sun, Oct 2, 2011 at 3:41 AM, Alejandro Moreno <mamr901@hotmail.com> wrote:
So...this is the output for the radtest from localhost...for the AP radtest there is no debugging output...what does this mean??
Get a network expert to do hands-on troubleshooting for you.
From what you've shown so far, my guess is something is preventing radius from receiving packets from external network. It can either be host-based firewall on the radius server (e.g. iptables), network setting (e.g. primary-secondary IP), etc. It should be pretty easy, and you've been given hints on how to do that, but since you're still unable to solve the problem I recommend just get an expert.
Until the debug log can show that the server receives a packet from the NAS, it's not really a radius problem. Fix your network. -- Fajar
Hi, first of all try to ping the server from the ap, then you can use tcpdump to confirm that you can reach the server. I would suggest that you check the server firewall, you may be blocking the packets with it. Regards, On 10/01/2011 04:41 AM, Alejandro Moreno wrote:
So...sorry for my ignorance but how should I test that the server is actually receiving packages?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
i've done the ping to the AP and it seems fine, and a radtest with the tcpdump listenging to see what's going on so here it is.. [root@localhost raddb]# tcpdump host 192.168.1.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 23:33:30.176868 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58 23:33:35.801316 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58 23:33:41.577914 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58
The packets are fine, hace you checked your iptables? Regards. Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 12:55 p.m., "Alejandro Moreno" <mamr901@hotmail.com> escribió:
i've done the ping to the AP and it seems fine, and a radtest with the
tcpdump listenging to see what's going on
so here it is..
[root@localhost raddb]# tcpdump host 192.168.1.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 23:33:30.176868 IP 192.168.75.129.44844 > castel.local.radius: RADIUS,
Access Request (1), id: 0x40 length: 58
23:33:35.801316 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58 23:33:41.577914 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58
it shouldnt be iptables since the firewall is not running...when i do a netstat to the port this is what i get[root@localhost radius]# netstat -antup | grep 1812udp 0 0 0.0.0.0:1812 0.0.0.0:* 12186/radiusd i've got an encore enhwi-n3 router, im afraid i cant get an expert to solve this in such a shor time if the problem is with the network so im going to keep trying to solve it with forum help Date: Sat, 1 Oct 2011 17:27:15 -0500 Subject: Re: RE: Radius Server Doesn't Communicate AP From: conesh@gmail.com To: freeradius-users@lists.freeradius.org The packets are fine, hace you checked your iptables? Regards. Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 12:55 p.m., "Alejandro Moreno" <mamr901@hotmail.com> escribió:
i've done the ping to the AP and it seems fine, and a radtest with the tcpdump listenging to see what's going on
so here it is..
[root@localhost raddb]# tcpdump host 192.168.1.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:33:30.176868 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58 23:33:35.801316 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58
23:33:41.577914 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ir seems yo be listening on the radius port. Please execute the following command and test it again: Service iptables stop ( all lower case) And let me know. Regards. Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 5:35 p.m., "Alejandro Moreno" <mamr901@hotmail.com> escribió:
it shouldnt be iptables since the firewall is not running...when i do a
netstat to the port this is what i get[root@localhost radius]# netstat -antup | grep 1812udp 0 0 0.0.0.0:1812 0.0.0.0:* 12186/radiusd i've got an encore enhwi-n3 router, im afraid i cant get an expert to solve this in such a shor time if the problem is with the network so im going to keep trying to solve it with forum help
Date: Sat, 1 Oct 2011 17:27:15 -0500 Subject: Re: RE: Radius Server Doesn't Communicate AP From: conesh@gmail.com To: freeradius-users@lists.freeradius.org
The packets are fine, hace you checked your iptables? Regards.
Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 12:55 p.m., "Alejandro Moreno" <mamr901@hotmail.com>
escribió:
i've done the ping to the AP and it seems fine, and a radtest with the
tcpdump listenging to see what's going on
so here it is..
[root@localhost raddb]# tcpdump host 192.168.1.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:33:30.176868 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58 23:33:35.801316 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58
23:33:41.577914 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nothing Happens...its already stopped, the firewall is disabled Date: Sat, 1 Oct 2011 18:58:35 -0500 Subject: Re: RE: Radius Server Doesn't Communicate AP From: conesh@gmail.com To: freeradius-users@lists.freeradius.org Ir seems yo be listening on the radius port.Please execute the following command and test it again:Service iptables stop ( all lower case)And let me know.Regards.Saludos
Mmm weird, are you sure that FreeRadius is running when you test it? Ps -ax | grep radiusd Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 7:15 p.m., "Alejandro Moreno" <mamr901@hotmail.com> escribió:
Nothing Happens...its already stopped, the firewall is disabled Date: Sat, 1 Oct 2011 18:58:35 -0500 Subject: Re: RE: Radius Server Doesn't Communicate AP From: conesh@gmail.com To: freeradius-users@lists.freeradius.org
Ir seems yo be listening on the radius port.Please execute the following
command and test it again:Service iptables stop ( all lower case)And let me know.Regards.Saludos
yes im sure, in one terminal i've got the radiusd -X for debugging mode and in another one i do the radtest...and as i said before...for the localhost the output debugging shows how the user is authenticated and the packet is accepted...but the radtest for the AP doesnt respond and there is no output and this is what happens with ps [root@localhost raddb]# ps -ax | grep radiusd Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ 13879 pts/2 S+ 0:00 radiusd -X 13928 pts/1 R+ 0:00 grep radiusd Date: Sat, 1 Oct 2011 19:23:22 -0500 Subject: Re: RE: Radius Server Doesn't Communicate AP From: conesh@gmail.com To: freeradius-users@lists.freeradius.org Mmm weird, are you sure that FreeRadius is running when you test it? Ps -ax | grep radiusd Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 7:15 p.m., "Alejandro Moreno" <mamr901@hotmail.com> escribió:
Nothing Happens...its already stopped, the firewall is disabled
Date: Sat, 1 Oct 2011 18:58:35 -0500 Subject: Re: RE: Radius Server Doesn't Communicate AP From: conesh@gmail.com To: freeradius-users@lists.freeradius.org
Ir seems yo be listening on the radius port.Please execute the following command and test it again:Service iptables stop ( all lower case)And let me know.Regards.Saludos
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Something weird just happened...I connected the router encore (the one with radius authentication) to the pc so there were two active networks, the LAN and the wirelss network....this is supposed to not letting me able to connect to the internet, but the msn was still working...just msn nothing else...i couldn't surf on the internet...i dont know what this means...? is it related with the router not communicating with the radius server...?
That's a network comunication related topic as Alan told you, first you need to fix it and then test your radius configuration. This is not the correct place to work with network issues, if your msn works or not has nothing yo do with the radius server. it just authenticate users, it doesn't have anything yo do with internet traffic. Good luck. Saludos Ing. Alfonso Alejandro Reyes Jimenez El oct 1, 2011 7:02 p.m., "Alejandro Moreno" <mamr901@hotmail.com> escribió:
Something weird just happened...I connected the router encore (the one
with radius authentication) to the pc so there were two active networks, the LAN and the wirelss network....this is supposed to not letting me able to connect to the internet, but the msn was still working...just msn nothing else...i couldn't surf on the internet...i dont know what this means...? is it related with the router not communicating with the radius server...?
..because this is what i get [root@localhost radius]# radtest marius temporal localhost 0 testing123 Sending Access-Request of id 83 to 127.0.0.1 port 1812 User-Name = "marius" User-Password = "temporal" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=83, length=20 it seems the server is accepting the packet properly
Hi,
it seems the server is accepting the packet properly
..but the AP cannot get to the RADIUS server. okay, several choices. 1) AP misconfigured...you didnt put correct IP address into the AP 2) RADIUS server is somehow isolated from the AP on the network level - you say you dont have a firewall running on the server - if I take that at face value, then theres a block elsewhere....ACLs on router VLANs? 3) AP network is misconfigured - incorrect subnet mask, gateway etc so....take the AP offline, give a Linux box the same IP details and see if it can 1) ping the RADIUS server, 2) use netcat to through some junk to port 1812 UDP to the RADIUS server alan
Ok, first of all, not everybody has the resources to afford an "expert" to do something... besides, this is a university project, is not something that im doing for a company or something, hence im not getting an expert...thats the reason im in a forum, this is what they are for...otherwise i would have got an expert and not posting in forums anyway...if someone wants to help me...this is what i got my router is a ENHWI-N3, i've got its firewall disabled it's got DHCP server enabled, wan //dinamic ip address Lan// 192.168.0.1 subnet mask 255.255.255.0 i tried to ping Centos ip adress 192.168.75.129 from the AP but is unreachable but when i do the ping to 127.0.0.1 it's alive so the radius server should it be 192.168.75.129 or 127.0.0.1? In clients.conf i have client 192.168.0.1 { secret = xxxx nastype= other } i did a nc -zu 192.168.01 1800 1820 and 1812 its working fine its succeeded and i did it for 127.0.0.1 too and its fine. so..this is it...i appreciate if someone could tell me what could it be wrong..
Step 1. Try pinging the AP from the CentOS box. If that doesn't work, then you definitely have a network problem. Step 2. Disable the firewall on the CentOS box (/etc/init.d/iptables stop). Then try pinging the CentOS box from the AP and then pinging the AP from the CentOS box. If that works, then try RADIUS from the AP again. Step 3. If ping works but RADIUS doesn't then run tcpdump on the CentOS box to see if AP is sending RADIUS packets to the CentOS box. # tcpdump host <IP address of the AP> Try these three things. If you still have problems, then send the results of these tests to the list. My guess is that the firewall is running on the CentOS box. The default configuration for CentOS and RHEL is to have the firewall enabled and blocking RADIUS - UDP ports 1812-1813. Tim From: freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.or g [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freer adius.org] On Behalf Of Alejandro Moreno Sent: Sunday, October 02, 2011 3:03 PM To: freeradius-users@lists.freeradius.org Subject: RE: Radius Server Doesn't Communicate AP Ok, first of all, not everybody has the resources to afford an "expert" to do something... besides, this is a university project, is not something that im doing for a company or something, hence im not getting an expert...thats the reason im in a forum, this is what they are for...otherwise i would have got an expert and not posting in forums anyway...if someone wants to help me...this is what i got my router is a ENHWI-N3, i've got its firewall disabled it's got DHCP server enabled, wan //dinamic ip address Lan// 192.168.0.1 subnet mask 255.255.255.0 i tried to ping Centos ip adress 192.168.75.129 from the AP but is unreachable but when i do the ping to 127.0.0.1 it's alive so the radius server should it be 192.168.75.129 or 127.0.0.1? In clients.conf i have client 192.168.0.1 { secret = xxxx nastype= other } i did a nc -zu 192.168.01 1800 1820 and 1812 its working fine its succeeded and i did it for 127.0.0.1 too and its fine. so..this is it...i appreciate if someone could tell me what could it be wrong..
Le dimanche 02 octobre 2011 à 22:03 +0000, Alejandro Moreno a écrit :
> Ok, first of all, not everybody has the resources to afford an
> "expert" to do something...
> besides, this is a university project, is not something that im doing
> for a company or something, hence im not getting an expert...thats the
> reason im in a forum, this is what they are for...otherwise i would
> have got an expert and not posting in forums
>
> anyway...if someone wants to help me...this is what i got
>
> my router is a ENHWI-N3, i've got its firewall disabled
> it's got DHCP server enabled, wan //dinamic ip address
> Lan// 192.168.0.1 subnet mask 255.255.255.0
> i tried to ping Centos ip adress 192.168.75.129 from the AP but is
> unreachable
> but when i do the ping to 127.0.0.1 it's alive
note:
- doing a ping to 127.0.0.1 will always reply from any devices(in your
case the ENHWI-N3).
- LAN IP 192.168.0.1 with subnte allow you to communicate with local ip
from 192.168.0.1 to 192.168.0.254. 192.168.75.129 is out of range, so it
sounds logical to not havae any reply from ping! change your AP IP to
something like 192.168.75.1 will help you to get reply from your radius
server.
> so the radius server should it be 192.168.75.129 or 127.0.0.1?
>
> In clients.conf i have
>
> client 192.168.0.1 {
>
> secret = xxxx
> nastype= other
> }
>
>
> i did a nc -zu 192.168.01 1800 1820 and 1812 its working fine its
> succeeded
> and i did it for 127.0.0.1 too and its fine.
>
> so..this is it...i appreciate if someone could tell me what could it
> be wrong..
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I change My AP ID but Now i cant configure it, im not allow to see My AP configurarion until i reboot itn
Enviado desde mi iPhone
El 2/10/2011, a las 19:22, yzy-oui-fi <yzy-oui-fi@hotmail.fr> escribió:
> Le dimanche 02 octobre 2011 à 22:03 +0000, Alejandro Moreno a écrit :
>> Ok, first of all, not everybody has the resources to afford an
>> "expert" to do something...
>> besides, this is a university project, is not something that im doing
>> for a company or something, hence im not getting an expert...thats the
>> reason im in a forum, this is what they are for...otherwise i would
>> have got an expert and not posting in forums
>>
>> anyway...if someone wants to help me...this is what i got
>>
>> my router is a ENHWI-N3, i've got its firewall disabled
>> it's got DHCP server enabled, wan //dinamic ip address
>> Lan// 192.168.0.1 subnet mask 255.255.255.0
>> i tried to ping Centos ip adress 192.168.75.129 from the AP but is
>> unreachable
>> but when i do the ping to 127.0.0.1 it's alive
> note:
> - doing a ping to 127.0.0.1 will always reply from any devices(in your
> case the ENHWI-N3).
> - LAN IP 192.168.0.1 with subnte allow you to communicate with local ip
> from 192.168.0.1 to 192.168.0.254. 192.168.75.129 is out of range, so it
> sounds logical to not havae any reply from ping! change your AP IP to
> something like 192.168.75.1 will help you to get reply from your radius
> server.
>> so the radius server should it be 192.168.75.129 or 127.0.0.1?
>>
>> In clients.conf i have
>>
>> client 192.168.0.1 {
>>
>> secret = xxxx
>> nastype= other
>> }
>>
>>
>> i did a nc -zu 192.168.01 1800 1820 and 1812 its working fine its
>> succeeded
>> and i did it for 127.0.0.1 too and its fine.
>>
>> so..this is it...i appreciate if someone could tell me what could it
>> be wrong..
>>
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Oct 3, 2011 at 5:03 AM, Alejandro Moreno <mamr901@hotmail.com> wrote:
Ok, first of all, not everybody has the resources to afford an "expert" to do something...
"expert" can be loosely interpreted as "someone with more knowledge/expertise/experience".
besides, this is a university project,
While radius expert might be "rare" in a university, every place with a LAN in place should have a network "expert". Someone who sets up the router/firewall/internet access. Someone who gets the call when the LAN stops working.
is not something that im doing for a company or something, hence im not getting an expert...
It doesn't need to be a CCNA/CCNP/paid support from a tech company. In IT-based university, it's common for even students to have experience in that field.
thats the reason im in a forum, this is what they are for...otherwise i would have got an expert and not posting in forums
You have over expectation on what a "forum" can do for you. An easy comparison would be to compare it with web-based support for a commercial software (e.g. Oracle's OTN, Redhat's RHN). While they are commercially-obliged to help you (with some types of SLA attached), you need to have some level of knowledge to properly describe your problem, gather diagnostic information, and implement the recommended fix. A "forum" or list consist mostly of people with spare time with similar interest in a subject. While most of them will have several minutes to reply an email, they won't do your job for you. You have to do it yourself.
anyway...if someone wants to help me...this is what i got
my router is a ENHWI-N3, i've got its firewall disabled it's got DHCP server enabled, wan //dinamic ip address Lan// 192.168.0.1 subnet mask 255.255.255.0 i tried to ping Centos ip adress 192.168.75.129 from the AP but is unreachable but when i do the ping to 127.0.0.1 it's alive so the radius server should it be 192.168.75.129 or 127.0.0.1?
Your earlier post say " [root@localhost raddb]# tcpdump host 192.168.1.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 23:33:30.176868 IP 192.168.75.129.44844 > castel.local.radius: RADIUS, Access Request (1), id: 0x40 length: 58 " what is 192.168.1.100? What is raddb? What is the router/gateway that connects 192.168.75.0 - 192.168.1.0 - 192.168.0.1? Can the networks reach each oter? What can you do to make them talk to each other? These simple questions are something network-related, and someone with experience on setting up a LAN should be able to answer that.
In clients.conf i have
client 192.168.0.1 {
secret = xxxx nastype= other }
i did a nc -zu 192.168.01 1800 1820 and 1812 its working fine its succeeded and i did it for 127.0.0.1 too and its fine.
so..this is it...i appreciate if someone could tell me what could it be wrong..
Break the problem into smaller pieces. You have radius problem (e.g. you haven't set it up yet), and you have a network problem. For network problem, get help from an expert (or just ask some IT guy on your university). That's my best advice at this point. For radius problem, start with a simple scenario first: have the radius and the NAS in the same network (e.g. 192.168.75.0), and start from there. If you don't have a real "server" and "nas", then do some simulation with just a notebook/PC (for the radius) and one cheap wireless AP that can do radius authentication (should be available under $100). -- Fajar
Alejandro Moreno wrote:
Ok, first of all, not everybody has the resources to afford an "expert" to do something...
Then you need to think for yourself. You need to pay attention to the messages on this list. If you can't do that, you have no business asking questions here. If you keep asking network questions on a RADIUS list, you can be unsubscribed from the list. Alan DeKok.
participants (8)
-
Alan Buxey -
Alan DeKok -
Alejandro Moreno -
Alfonso Reyes -
Fajar A. Nugraha -
Ing. Alfonso Alejandro Reyes Jimenez
-
Tim Sylvester -
yzy-oui-fi