Re: Freeradius 3.0.12 - Cisco EAP-Fast Supported?
Hi Alan, Thank you for your assistance with this! I worked with my network engineer today and we were able to confirm that PEAP works to authenticate, but when changed over to EAP-FAST, it fails as before. I have a debug log of PEAP working and then EAP-FAST failing, however, it is pretty dang large at over 4k lines in Notepad++. I am attaching the text file, with some information changed to protect internal names, MAC addresses, etc. I am extremely grateful for whatever help you can render me. Warmest regards, Kevin Morrison Systems Administrator T: +1 (704) 378-9235 C: +1 (980) 255-9668 kmorrison@vectorusa.com VectorUSA 2520 Whitehall Park Drive, Suite 300 Charlotte, NC 28273 Customer Service: +1 (877) 569-8800 -----Original Message----- Date: Wed, 14 Dec 2016 16:21:15 -0500 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeradius 3.0.12 - Cisco EAP-Fast Supported? Message-ID: <04774D10-8DB6-409F-9589-8FC7DFAE5A55@deployingradius.com> Content-Type: text/plain; charset=us-ascii
On Dec 14, 2016, at 3:54 PM, Kevin Morrison <kmorrison@vectorusa.com> wrote:
Greetings folks,
This is my first time posting to this mailing list, I am hoping you can answer a question/help me out. Does the newest Freeradius version 3.0.12 support the CISCO version of EAP-FAST?
It's been tested against other EAP-FAST implementations.
I have been trying to get the newly created EAP FAST module to work with a Cisco WLC and Cisco device to authenticate via EAP-Fast, but I keep getting the error message about:
(37) mschap: Client is using MS-CHAPv2 (37) mschap: ERROR: MS-CHAP2-Response is incorrect
The full debug may be more useful.
I am running on CentOS 7, as well.
If the answer is Yes to supporting Cisco EAP FAST, then I can definitely provide the full output of radiusd -X for assistance.
If the same password works for PEAP (try it), it should also work for EAP-FAST. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 140, Issue 23 *************************************************
On Dec 15, 2016, at 4:54 PM, Kevin Morrison <kmorrison@vectorusa.com> wrote:
I worked with my network engineer today and we were able to confirm that PEAP works to authenticate, but when changed over to EAP-FAST, it fails as before.
That's an issue then.
I have a debug log of PEAP working and then EAP-FAST failing, however, it is pretty dang large at over 4k lines in Notepad++. I am attaching the text file, with some information changed to protect internal names, MAC addresses, etc.
I am extremely grateful for whatever help you can render me.
EAP-FAST is more than a bit magical. We've tested it with a bunch of equipment. But if it fails in the MS-CHAP calculation.. then something bad is going wrong. FreeRADIUS has been doing MS-CHAP for almost 20 years. If that calculation fails, then either the other end is buggy, or the password really is incorrect. Alan DeKok.
Alan, We've tested the password, as well, with LEAP authentication and it works. Is there something else we can check? Or something else we can configure? What puzzles me about this whole thing is that PEAP works with an eapol_test, but then also fails with EAP-FAST. Using eapol_test should eliminate any issues with it being a CISCO EAP FAST implementation, right? Kevin Morrison Systems Administrator T: +1 (704) 378-9235 C: +1 (980) 255-9668 kmorrison@vectorusa.com VectorUSA 2520 Whitehall Park Drive, Suite 300 Charlotte, NC 28273 Customer Service: +1 (877) 569-8800 -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+kmorrison=vectorusa.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, December 15, 2016 6:41 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeradius 3.0.12 - Cisco EAP-Fast Supported? On Dec 15, 2016, at 4:54 PM, Kevin Morrison <kmorrison@vectorusa.com> wrote:
I worked with my network engineer today and we were able to confirm that PEAP works to authenticate, but when changed over to EAP-FAST, it fails as before.
That's an issue then.
I have a debug log of PEAP working and then EAP-FAST failing, however, it is pretty dang large at over 4k lines in Notepad++. I am attaching the text file, with some information changed to protect internal names, MAC addresses, etc.
I am extremely grateful for whatever help you can render me.
EAP-FAST is more than a bit magical. We've tested it with a bunch of equipment. But if it fails in the MS-CHAP calculation.. then something bad is going wrong. FreeRADIUS has been doing MS-CHAP for almost 20 years. If that calculation fails, then either the other end is buggy, or the password really is incorrect. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Dec 16, 2016, at 8:51 AM, Kevin Morrison <kmorrison@vectorusa.com> wrote:
We've tested the password, as well, with LEAP authentication and it works. Is there something else we can check? Or something else we can configure?
There is no configuration which un-breaks MS-CHAP. MS-CHAP shouldn't be broken.
What puzzles me about this whole thing is that PEAP works with an eapol_test, but then also fails with EAP-FAST. Using eapol_test should eliminate any issues with it being a CISCO EAP FAST implementation, right?
If it fails with eapol_test, then something weird is going on. It works for me when I use eapol_test, and the local Cisco switches. Alan DeKok.
I know the debug log I sent was rather long, but would you be able to review it for any misconfigurations that might be breaking EAP-Fast? Kevin Morrison Systems Administrator T: +1 (704) 378-9235 C: +1 (980) 255-9668 kmorrison@vectorusa.com VectorUSA 2520 Whitehall Park Drive, Suite 300 Charlotte, NC 28273 Customer Service: +1 (877) 569-8800 -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+kmorrison=vectorusa.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, December 16, 2016 8:55 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeradius 3.0.12 - Cisco EAP-Fast Supported? On Dec 16, 2016, at 8:51 AM, Kevin Morrison <kmorrison@vectorusa.com> wrote:
We've tested the password, as well, with LEAP authentication and it works. Is there something else we can check? Or something else we can configure?
There is no configuration which un-breaks MS-CHAP. MS-CHAP shouldn't be broken.
What puzzles me about this whole thing is that PEAP works with an eapol_test, but then also fails with EAP-FAST. Using eapol_test should eliminate any issues with it being a CISCO EAP FAST implementation, right?
If it fails with eapol_test, then something weird is going on. It works for me when I use eapol_test, and the local Cisco switches. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Dec 16, 2016, at 9:20 AM, Kevin Morrison <kmorrison@vectorusa.com> wrote:
I know the debug log I sent was rather long, but would you be able to review it for any misconfigurations that might be breaking EAP-Fast?
I've already explained this repeatedly. If PEAP works, EAP-FAST should work. eapol_test should work. There is no magic configuration setting which secretly breaks EAP-FAST. There is no magic configuration setting which secretly un-breaks EAP-FAST if you ask "pretty please". Alan DeKok.
participants (2)
-
Alan DeKok -
Kevin Morrison