Re: rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD
Martin wrote:
I forgot about radius -X.
<sigh> If you're going to make it hard to help you, I'm just going to delete your posts. The debug output you posted is *useless*. You claimed it had problems when receiving packets. So to "help", you post a debug output... where it doesn't receive packets.
regarding the other AAA I don't have access to it.
Then how do you know it works? Alan DeKok.
This is the debug output of radclient command: echo "User-Name='{am=1}543B4DAC6723E8BB0156BA2BBDE133DB@alvarion.ro', WiMAX-AAA-Session-Id = 18ed983f3c2371c6f4bc692e0c89dffe,Calling-Station-Id = 00-17-c4-3d-41-ea" | /usr/local/freeradius2.10/bin/radclient -c '1' -n '3' -r '3' -t '3' -s -xx '192.168.60.122:3799' 'disconnect' 'secret' 2>&1 Sending Disconnect-Request of id 117 to 192.168.60.122 port 3799 User-Name = "{am=1}543B4DAC6723E8BB0156BA2BBDE133DB@alvarion.ro" WiMAX-AAA-Session-Id = 0x3138656439383366336332333731633666346263363932653063383964666665 Calling-Station-Id = "00-17-c4-3d-41-ea" rad_recv: Disconnect-ACK packet from host 192.168.60.122 port 3799, id=117, length=20 rad_verify: Received Disconnect-ACK packet from home server 192.168.60.122 port 3799 with invalid signature! (Shared secret is incorrect.) In radius log there is nothing related to this Martin Ion ________________________________ From: Alan DeKok <aland@deployingradius.com> To: Martin <martynion@yahoo.com> Cc: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Wednesday, September 7, 2011 3:51 PM Subject: Re: rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD Martin wrote:
I forgot about radius -X.
<sigh> If you're going to make it hard to help you, I'm just going to delete your posts. The debug output you posted is *useless*. You claimed it had problems when receiving packets. So to "help", you post a debug output... where it doesn't receive packets.
regarding the other AAA I don't have access to it.
Then how do you know it works? Alan DeKok.
Martin wrote:
This is the debug output of radclient command:
echo "User-Name='{am=1}543B4DAC6723E8BB0156BA2BBDE133DB@alvarion.ro', WiMAX-AAA-Session-Id = 18ed983f3c2371c6f4bc692e0c89dffe,Calling-Station-Id = 00-17-c4-3d-41-ea" | /usr/local/freeradius2.10/bin/radclient -c '1' -n '3' -r '3' -t '3' -s -xx '192.168.60.122:3799' 'disconnect' 'secret' 2>&1
You really don't need '' around everything.
Sending Disconnect-Request of id 117 to 192.168.60.122 port 3799 User-Name = "{am=1}543B4DAC6723E8BB0156BA2BBDE133DB@alvarion.ro" WiMAX-AAA-Session-Id = 0x3138656439383366336332333731633666346263363932653063383964666665 Calling-Station-Id = "00-17-c4-3d-41-ea" rad_recv: Disconnect-ACK packet from host 192.168.60.122 port 3799, id=117, length=20 rad_verify: Received Disconnect-ACK packet from home server 192.168.60.122 port 3799 with invalid signature! (Shared secret is incorrect.)
So use the *correct* shared secret.
In radius log there is nothing related to this
It doesn't show the server receiving a Disconnect-Request? It doesn't show the shared secret for the client IP address? You can't use that shared secret in the "radclient" command above? Alan DeKok.
I am using this command on the FR server in order to dicsconect the user on the NAS. The thing is that the NAS is using the same shared secret for Authentication/Accounting/PoD/CoA and as you can see these messages are accepted and NAS also replyed back with Disconect-ACK. Is there another place where to configure the secret for PoD in FreeRadius? Martin Ion ________________________________ From: Alan DeKok <aland@deployingradius.com> To: Martin <martynion@yahoo.com>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Wednesday, September 7, 2011 4:45 PM Subject: Re: rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD Martin wrote:
This is the debug output of radclient command:
echo "User-Name='{am=1}543B4DAC6723E8BB0156BA2BBDE133DB@alvarion.ro', WiMAX-AAA-Session-Id = 18ed983f3c2371c6f4bc692e0c89dffe,Calling-Station-Id = 00-17-c4-3d-41-ea" | /usr/local/freeradius2.10/bin/radclient -c '1' -n '3' -r '3' -t '3' -s -xx '192.168.60.122:3799' 'disconnect' 'secret' 2>&1
You really don't need '' around everything.
Sending Disconnect-Request of id 117 to 192.168.60.122 port 3799 User-Name = "{am=1}543B4DAC6723E8BB0156BA2BBDE133DB@alvarion.ro" WiMAX-AAA-Session-Id = 0x3138656439383366336332333731633666346263363932653063383964666665 Calling-Station-Id = "00-17-c4-3d-41-ea" rad_recv: Disconnect-ACK packet from host 192.168.60.122 port 3799, id=117, length=20 rad_verify: Received Disconnect-ACK packet from home server 192.168.60.122 port 3799 with invalid signature! (Shared secret is incorrect.)
So use the *correct* shared secret.
In radius log there is nothing related to this
It doesn't show the server receiving a Disconnect-Request? It doesn't show the shared secret for the client IP address? You can't use that shared secret in the "radclient" command above? Alan DeKok.
Martin wrote:
I am using this command on the FR server in order to dicsconect the user on the NAS.
OK... that wasn't clear from the original message.
The thing is that the NAS is using the same shared secret for Authentication/Accounting/PoD/CoA and as you can see these messages are accepted and NAS also replyed back with Disconect-ACK.
The Disconnect-Request messages aren't signed. So... the fact that the NAS replies doesn't mean anything.
Is there another place where to configure the secret for PoD in FreeRadius?
You're not using the FreeRADIUS server. You're using "radclient". The secret is passed on the command line. You have two choices: 1) use the same shared secret that the NAS is using 2) the NAS is broken, and doesn't implement Disconnect-NAK properly. Alan DeKok.
participants (2)
-
Alan DeKok -
Martin