Hi all! I have a freeradius 2.0.5 installed and configured to authorize to realms (for example @a and @b) First realm - @a - authorizes locally (via rlm_sql) Second - @b - is proxying to remote server. The trouble looks so (we take this with with tcpdump): - my freeradius 2.0.5 server sends auth-req -- remote server gets it and process -- remote server sends answer -- it reach our server -- ~95% replyes goes to NAS'es, but sometimes my server says that "Rejecting request 4490 due to lack of any response from home server xx.xx.xx.xx port 1812" (but in fact this response arrives to the interface of the computer with freeradius installed - i see this with sniffer, but there is nothing in freeradius logs about this packet) -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.
Evgeniy Kozhuhovskiy wrote:
- my freeradius 2.0.5 server sends auth-req -- remote server gets it and process -- remote server sends answer -- it reach our server -- ~95% replyes goes to NAS'es, but sometimes my server says that "Rejecting request 4490 due to lack of any response from home server xx.xx.xx.xx port 1812"
The proxy only does that if the home server is very slow... i.e. it doesn't respond within 30 seconds. See proxy.conf for configuration parameters.
(but in fact this response arrives to the interface of the computer with freeradius installed - i see this with sniffer, but there is nothing in freeradius logs about this packet)
Odds are that it arrives, but too late. Run the server in debugging mode to see it print a message saying exactly this. Alan DeKok.
Alan DeKok wrote:
(but in fact this response arrives to the interface of the computer with freeradius installed - i see this with sniffer, but there is nothing in freeradius logs about this packet) Odds are that it arrives, but too late. Run the server in debugging mode to see it print a message saying exactly this.
I've take this from debug. BTW, can this problem be related to problems with network latency? I found this today: 64 bytes from 172.26.x.xx: icmp_seq=10 ttl=253 time=3.28 ms 64 bytes from 172.26.x.xx: icmp_seq=11 ttl=253 time=6.23 ms 64 bytes from 172.26.x.xx: icmp_seq=12 ttl=253 time=5.68 ms 64 bytes from 172.26.x.xx: icmp_seq=13 ttl=253 time=2.64 ms 64 bytes from 172.26.x.xx: icmp_seq=14 ttl=253 time=10.0 ms 64 bytes from 172.26.x.xx: icmp_seq=15 ttl=253 time=7.54 ms 64 bytes from 172.26.x.xx: icmp_seq=16 ttl=253 time=5.49 ms 64 bytes from 172.26.x.xx: icmp_seq=17 ttl=253 time=3.44 ms 64 bytes from 172.26.x.xx: icmp_seq=18 ttl=253 time=8.39 ms 64 bytes from 172.26.x.xx: icmp_seq=19 ttl=253 time=9.85 ms PS Sometimes remote server hangs up, and i switch proxying to my radius with users file generated from remove server database (just to allow customers to login) - and this message ("Rejecting request 4490 due to lack of any response from home server xx.xx.xx.xx port 1812") appears sometimes. -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.
Hi, We are having an issue with inserting dynamic VLAN information in to proxied Access-Accept packets with FR V2.0.5. Local authentications do have VLAN info inserted into the accept packet. In V1.1.7 we use the post_proxy_authorize directive in proxy.conf to re-run authorize to obtain the VLAN information, however this is depreciated in V2. Can someone tell me what method I should use to achieve this for proxied requests in FR V2? Many thanks, Jezz Palmer.
http://freeradius.org/radiusd/man/unlang.html Ivan Kalik Kalik Informatika ISP Dana 29/8/2008, "Palmer J.D.F." <J.D.F.Palmer@swansea.ac.uk> piše:
Hi,
We are having an issue with inserting dynamic VLAN information in to proxied Access-Accept packets with FR V2.0.5. Local authentications do have VLAN info inserted into the accept packet.
In V1.1.7 we use the post_proxy_authorize directive in proxy.conf to re-run authorize to obtain the VLAN information, however this is depreciated in V2. Can someone tell me what method I should use to achieve this for proxied requests in FR V2?
Many thanks, Jezz Palmer.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Palmer J.D.F. wrote:
In V1.1.7 we use the post_proxy_authorize directive in proxy.conf to re-run authorize to obtain the VLAN information, however this is depreciated in V2. Can someone tell me what method I should use to achieve this for proxied requests in FR V2?
If you have "users" in the "authorize" section, edit the "post-auth" section, and add an entry "users.authorize". Alan DeKok.
Thanks Alan. :) Was sql.authorize in our case. Cheers, Jezz.
-----Original Message----- From: freeradius-users- bounces+j.d.f.palmer=swansea.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+j.d.f.palmer=swansea.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 29 August 2008 14:07 To: FreeRadius users mailing list Subject: Re: Equivalent of post_proxy_authorize in FR 2.0.5?
Palmer J.D.F. wrote:
In V1.1.7 we use the post_proxy_authorize directive in proxy.conf to re-run authorize to obtain the VLAN information, however this is depreciated in V2. Can someone tell me what method I should use to achieve this for proxied requests in FR V2?
If you have "users" in the "authorize" section, edit the "post-auth" section, and add an entry "users.authorize".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Evgeniy Kozhuhovskiy -
Ivan Kalik -
Palmer J.D.F.