NAS ignoring Access-Accept
Hi, I'm not sure if I run into a Cisco or Freeradius issue here. I try to migrate from icradius to freeradius and everything worked in the new configuration when I tried with NTRadPing and so I'm switched the Cisco NAS to the new server. Unfortunately the NAS is ignoring the Access-Accept replies and always denies login attempts. That worked correctly with icradius and the NAS config changed only the ip address of the radius server. My first guess was an ip source issue but my server only has one ip address (and IPv6 ones but radiusd is only listening on 0.0.0.0) and freeradius is compiled with --with-udpfromto. Here are parts of my Cisco config: aaa authentication ppp default if-needed radius local aaa authorization network default radius local aaa accounting update newinfo aaa accounting exec default start-stop radius aaa accounting network default start-stop radius aaa accounting connection default start-stop radius radius-server configure-nas radius-server host a.b.c.d auth-port 1812 acct-port 1813 non-standard radius-server timeout 3 radius-server vsa send accounting I ran radiusd -X and saw that freeradius sent an Access-Accept reply to the NAS' ip address and source port. Any ideas? Thanks, Wolfgang
Run debug radius on Cisco. You are missing a key (shared secret) in radius-server host ... statement. See if that is the problem. Ivan Kalik Kalik Informatika ISP Dana 21/5/2007, "Wolfgang Rosenauer" <wolfgang@rosenauer.org> piše:
Hi,
I'm not sure if I run into a Cisco or Freeradius issue here.
I try to migrate from icradius to freeradius and everything worked in the new configuration when I tried with NTRadPing and so I'm switched the Cisco NAS to the new server. Unfortunately the NAS is ignoring the Access-Accept replies and always denies login attempts. That worked correctly with icradius and the NAS config changed only the ip address of the radius server. My first guess was an ip source issue but my server only has one ip address (and IPv6 ones but radiusd is only listening on 0.0.0.0) and freeradius is compiled with --with-udpfromto.
Here are parts of my Cisco config:
aaa authentication ppp default if-needed radius local aaa authorization network default radius local aaa accounting update newinfo aaa accounting exec default start-stop radius aaa accounting network default start-stop radius aaa accounting connection default start-stop radius
radius-server configure-nas radius-server host a.b.c.d auth-port 1812 acct-port 1813 non-standard radius-server timeout 3 radius-server vsa send accounting
I ran radiusd -X and saw that freeradius sent an Access-Accept reply to the NAS' ip address and source port.
Any ideas?
Thanks, Wolfgang - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
tnt@kalik.co.yu wrote:
Run debug radius on Cisco. You are missing a key (shared secret) in radius-server host ... statement. See if that is the problem.
The shared secret is in another config line which I've left out. radius-server key XXXXXXXXXX How can I get debug output on a Cisco? (I'm not really too familiar with IOS and that is old 11.3) Wolfgang
debug radius (This will activate debugging) show log (To read logged requests/answers) Ivan Kalik Kalik Informatika ISP Dana 21/5/2007, "Wolfgang Rosenauer" <wolfgang@rosenauer.org> piše:
tnt@kalik.co.yu wrote:
Run debug radius on Cisco. You are missing a key (shared secret) in radius-server host ... statement. See if that is the problem.
The shared secret is in another config line which I've left out. radius-server key XXXXXXXXXX
How can I get debug output on a Cisco? (I'm not really too familiar with IOS and that is old 11.3)
Wolfgang - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
tnt@kalik.co.yu wrote:
debug radius (This will activate debugging)
show log (To read logged requests/answers)
Hmm, got no output. I enabled "debug radius", made a dialin attempt (what failed) but haven't seen any radius log message on the Cisco with show log and also not on the remote syslog host. Only the usual interface up-down message appeared. Wolfgang
Check logging in your config. Debug information has lowest priority so requires highest level of logging (7). Ivan Kalik Kalik Informatika ISP Dana 22/5/2007, "Wolfgang Rosenauer" <wolfgang@rosenauer.org> piše:
tnt@kalik.co.yu wrote:
debug radius (This will activate debugging)
show log (To read logged requests/answers)
Hmm, got no output. I enabled "debug radius", made a dialin attempt (what failed) but haven't seen any radius log message on the Cisco with show log and also not on the remote syslog host. Only the usual interface up-down message appeared.
Wolfgang - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, tnt@kalik.co.yu wrote:
Check logging in your config. Debug information has lowest priority so requires highest level of logging (7).
got an output now: May 23 07:42:25 dialin1 274: May 23 05:42:25: RADIUS: Received from id 214 1.1.1.1:1812, Access-Accept, len 20 May 23 07:42:25 dialin1 275: May 23 05:42:25: RADIUS: saved authorization data for user 3DCB74 at 1F66F0 May 23 07:42:25 dialin1 276: May 23 05:42:25: RADIUS: no appropriate authorization type for user. So "no appropriate authorization type for user" seems to let the Cisco ignore the reply. And now I know the difference in the config. With the old server I had a default group in radgroupreply: Service-Type = Framed-User, Framed-Protocol = PPP What I don't have in the new server yet because I thought I wouldn't need it (since the same attributes are in the request already). Thanks for the hints, Wolfgang
participants (2)
-
tnt＠kalik.co.yu -
Wolfgang Rosenauer