(I think I messed up the previous posting by returning on a previous by Winter answered post. This message is found in the end of that post. I am sorry. Hope this one comes in with the new subject.) Can I connect to radius via a router that has a guestzone? It simply means that the router has an extra guestzone interface that also contains choice for PSK or EAP
From the following information I wonder why the radiusd is not responding.Remember I am trying to log in with the radius from the PC where the radius is installed. Radius is on 192.168.0.198 and I am attempting login or request from 192.168.0.198. This may also be a mistake. Maybe there will be a conflict betw 192.168.0.1 = router and 192.168.0.198 localhost. I simply dont know.
The router is a DLINK 655 The OS is SuSE Linux Enterprise Desktop 10, ServPack 3 The radius is the freeradiu-sserver-2.1.12 Here are the fields from this zone in the router: **ROUTER PART** "Use this section to configure the guest zone settings of your router. The guest zone provide a separate network zone for guest to access Internet": --GUEST ZONE SELECTION-- Enable Guest Zone : (Yes) Wireless Band : 2.4GHz Band Wireless Network Name : EAP_sled (Also called the SSID) Enable Routing Between Zones : (No) Security Mode : WPA-Enterprise --WPA-- WPA Mode : Auto (WPA or WPA2) Cipher Type : TKIP and AES Group Key Update Interval : 3600 (seconds) --EAP (802.1x)-- "When WPA enterprise is enabled, the router uses EAP (802.1x) to authenticate clients via a remote RADIUS server." Authentication Timeout : 60 (minutes) RADIUS server IP Address : 192.168.0.198 RADIUS server Port : 1812 RADIUS server Shared Secret : testing123 MAC Address Authentication : No **CLIENT.CONF** Then I change the client.conf from localhost 127.0.0.1 to the IP of the router 192.168.0.1 #client localhost { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # ipaddr = 127.0.0.1 # Test with router: client router { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) ipaddr = 192.168.0.1 # and I keep rest of it as it was. **/ETC/HOSTS/** I put in a line in /etc/hosts/ (I am not sure if it is right or necessary: # IP-Address Full-Qualified-Hostname Short-Hostname 192.168.0.1 router dlink **YAST CONFIG FOR THE USERCLIENT** I change the setup in system (YaST)from PKS key to EAP: --MODUS-- Accesspoint: (Yes) Ad hoc: no Master: no --NETWORKNAME SSID-- EAP_sled --AUTHENTICATION MODUS-- Open: no Shared key: no WPA-EAP (Yes) WPA-PSK: no EAP Modus: TTLS Identity: sigbj (as in /usr/local/etc/raddb/users) Password: testing-0 (as in /usr/local/etc/raddb/users) Anonymous identity: (left open) Client-Sert: (closed) Client-Key: (closed) Client-Key_password: whatever Server-Sert: /usr/local/etc/raddb/certs/server.csr I have made no changes in eap.conf and radius.conf I try to start the radiusd -X with these changes (the previous test on localhost is successful: "Ready to process requests." And radtest test gives the right feedback:Sending Access-Accept of id 178 to 127.0.0.1 port 1932,so this test part works) Some of the messages from the radiusd -X with the changed client.conf: ........ radiusd: #### Loading Clients #### client router { ipaddr = 192.168.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" ............. ... adding new socket proxy address * port 1047 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. radtest gives this: Sending Access-Request of id 207 to 127.0.0.1 port 1812 User-Name = "sigbj" User-Password = "testing-0" NAS-IP-Address = 192.168.0.198 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 207 socket 3 and radiusd consequently: Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 1048 Trying to login with the Knetworkmanager (KDE) on to the network gives no reaction on the server, server is just waiting, the knetworkmanager may blink or just dryrun. I have a feeling that the server is listening on the 127.0.0.1 instead on 192.168.0.1, but do not know I am of course doing a typical newbie mistake somewhere, but I do not know what. IF YOU NEED THE WHOLE RADIUSD -X LOG AT THIS POINT, PLEASE TELL ME. I have given this explanations to begin with. The problems may also be that a router of this kind cannot be used on freeradius or that the router is 100% "Windows-messed-up". -- Si St sigbj-st@operamail.com -- http://www.fastmail.fm - The professional email service
Si St wrote:
From the following information I wonder why the radiusd is not responding.
Read the debug log. Really. It's not hard. Nothing else will help.
Remember I am trying to log in with the radius from the PC where the radius is installed.
I have no idea what that means.
Here are the fields from this zone in the router: **ROUTER PART** "Use this section to configure the guest zone settings of your router.
We don't need to see any of the router config.
**CLIENT.CONF** Then I change the client.conf from localhost 127.0.0.1 to the IP of the router 192.168.0.1
Why? Why not just add a *new* section?
**/ETC/HOSTS/** I put in a line in /etc/hosts/ (I am not sure if it is right or necessary:
If you're not sure, don't do it.
**YAST CONFIG FOR THE USERCLIENT**
We don't need to see any of this.
I try to start the radiusd -X with these changes (the previous test on localhost is successful: "Ready to process requests." And radtest test gives the right feedback:Sending Access-Accept of id 178 to 127.0.0.1 port 1932,so this test part works)
Until you delete 127.0.0.1 from the clients.conf file.
Sending Access-Request of id 207 to 127.0.0.1 port 1812 User-Name = "sigbj" User-Password = "testing-0" NAS-IP-Address = 192.168.0.198 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 207 socket 3
and radiusd consequently: Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 1048
Of course. That's what you told it do to.
Trying to login with the Knetworkmanager (KDE) on to the network gives no reaction on the server, server is just waiting, the knetworkmanager may blink or just dryrun.
Then you have a networking problem. Not a RADIUS problem. Go fix that.
I have a feeling that the server is listening on the 127.0.0.1 instead on 192.168.0.1, but do not know
The server listens on all IPs by default. It prints this out in debug mode. Alan DeKok.
Hi, you can use the following to include all the IPs inside the clients file: client 0.0.0.0/0 { secret = mysecret shortname = myNAS }
From the router's side you need to write a command to add your radius shared key and ip. For example if it's allied telesis radius-server key <key> radius-server host <ip> for cisco is something similar.
If you are using Mysql then you need to add it to the nas table but before that you need to edit the sql.conf file and uncomment the radclients = yes for example my Mysql nas table is like that: +----+----------+--------------+-------+-------+--------+-----------+---------------+--------+ | id | nasname | shortname | type | ports | secret | community | description | server | +----+----------+--------------+-------+-------+--------+-----------+---------------+--------+ | 1 | <IP> | Core | other | NULL | <key> | NULL | Radius Client | NULL | | 2 | <IP> | ZoneDirector | other | NULL | <key> | NULL | Radius Client | NULL | +----+----------+--------------+-------+-------+--------+-----------+---------------+--------+ because i am using the core and the zone director as a NAS. Good luckAndrew
From: sigbj-st@operamail.com To: freeradius-users@lists.freeradius.org Subject: a router as NAS Date: Sun, 15 Jul 2012 18:49:18 +0200
(I think I messed up the previous posting by returning on a previous by Winter answered post. This message is found in the end of that post. I am sorry. Hope this one comes in with the new subject.) Can I connect to radius via a router that has a guestzone? It simply means that the router has an extra guestzone interface that also contains choice for PSK or EAP
From the following information I wonder why the radiusd is not responding.Remember I am trying to log in with the radius from the PC where the radius is installed. Radius is on 192.168.0.198 and I am attempting login or request from 192.168.0.198. This may also be a mistake. Maybe there will be a conflict betw 192.168.0.1 = router and 192.168.0.198 localhost. I simply dont know.
The router is a DLINK 655 The OS is SuSE Linux Enterprise Desktop 10, ServPack 3 The radius is the freeradiu-sserver-2.1.12
Here are the fields from this zone in the router: **ROUTER PART** "Use this section to configure the guest zone settings of your router. The guest zone provide a separate network zone for guest to access Internet":
--GUEST ZONE SELECTION-- Enable Guest Zone : (Yes) Wireless Band : 2.4GHz Band Wireless Network Name : EAP_sled (Also called the SSID) Enable Routing Between Zones : (No) Security Mode : WPA-Enterprise
--WPA-- WPA Mode : Auto (WPA or WPA2) Cipher Type : TKIP and AES Group Key Update Interval : 3600 (seconds)
--EAP (802.1x)--
"When WPA enterprise is enabled, the router uses EAP (802.1x) to authenticate clients via a remote RADIUS server."
Authentication Timeout : 60 (minutes) RADIUS server IP Address : 192.168.0.198 RADIUS server Port : 1812 RADIUS server Shared Secret : testing123 MAC Address Authentication : No **CLIENT.CONF** Then I change the client.conf from localhost 127.0.0.1 to the IP of the router 192.168.0.1 #client localhost { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # ipaddr = 127.0.0.1 # Test with router: client router { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) ipaddr = 192.168.0.1 # and I keep rest of it as it was.
**/ETC/HOSTS/** I put in a line in /etc/hosts/ (I am not sure if it is right or necessary: # IP-Address Full-Qualified-Hostname Short-Hostname 192.168.0.1 router dlink
**YAST CONFIG FOR THE USERCLIENT** I change the setup in system (YaST)from PKS key to EAP: --MODUS-- Accesspoint: (Yes) Ad hoc: no Master: no --NETWORKNAME SSID-- EAP_sled --AUTHENTICATION MODUS-- Open: no Shared key: no WPA-EAP (Yes) WPA-PSK: no EAP Modus: TTLS Identity: sigbj (as in /usr/local/etc/raddb/users) Password: testing-0 (as in /usr/local/etc/raddb/users) Anonymous identity: (left open) Client-Sert: (closed) Client-Key: (closed) Client-Key_password: whatever Server-Sert: /usr/local/etc/raddb/certs/server.csr
I have made no changes in eap.conf and radius.conf
I try to start the radiusd -X with these changes (the previous test on localhost is successful: "Ready to process requests." And radtest test gives the right feedback:Sending Access-Accept of id 178 to 127.0.0.1 port 1932,so this test part works)
Some of the messages from the radiusd -X with the changed client.conf: ........ radiusd: #### Loading Clients #### client router { ipaddr = 192.168.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" ............. ... adding new socket proxy address * port 1047 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.
radtest gives this: Sending Access-Request of id 207 to 127.0.0.1 port 1812 User-Name = "sigbj" User-Password = "testing-0" NAS-IP-Address = 192.168.0.198 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 207 socket 3
and radiusd consequently: Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 1048
Trying to login with the Knetworkmanager (KDE) on to the network gives no reaction on the server, server is just waiting, the knetworkmanager may blink or just dryrun. I have a feeling that the server is listening on the 127.0.0.1 instead on 192.168.0.1, but do not know
I am of course doing a typical newbie mistake somewhere, but I do not know what.
IF YOU NEED THE WHOLE RADIUSD -X LOG AT THIS POINT, PLEASE TELL ME. I have given this explanations to begin with. The problems may also be that a router of this kind cannot be used on freeradius or that the router is 100% "Windows-messed-up".
-- Si St sigbj-st@operamail.com
-- http://www.fastmail.fm - The professional email service
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thank you, I have done that already. The IP and the shared secret is inside the EAP config of the router just like you say. I have ping contact from the PC to the router. The configuration "client router { secret = testing123; ipaddr = 192.168.0.1; }" should work so that I would be able to send "radtest sigbj testing-0 192.168.0.1 0 testing123" to the router to have the router call the radiusd at 192.168.0.199. Using 127.0.0.1 there is full acceptance both with radtetst -t eap-md5, chap, mschap, pap. It IS working, and WELL too. -- The mysql part I have not tried out, but it is not so important at this stage. To me the radius is so well configured and constructed that it should be this simple, at least taken in consideration the docu I have read. The problem seems to be that call from the computer to the NAS-client (the router) does not come through, or the NAS will not send requests to the radius server. Again, it might be a network problem, a missing part from my side, or something else. Strange is it, because the router works with WAP-PSK -- Si St [1]sigbj-st@operamail.com On Sun, Jul 15, 2012, at 11:21 PM, Andrew Andonopoulos wrote: Hi, you can use the following to include all the IPs inside the clients file: client 0.0.0.0/0 { secret = mysecret shortname = myNAS }
From the router's side you need to write a command to add your radius shar ed key and ip. For example if it's allied telesis
radius-server key <key> radius-server host <ip> for cisco is something similar. If you are using Mysql then you need to add it to the nas table but before that you need to edit the sql.conf file and uncomment the radclients = ye s for example my Mysql nas table is like that: +----+----------+--------------+-------+-------+--------+-----------+----- ----------+--------+ | id | nasname | shortname | type | ports | secret | community | desc ription | server | +----+----------+--------------+-------+-------+--------+-----------+----- ----------+--------+ | 1 | <IP> | Core | other | NULL | <key> | NULL | Radi us Client | NULL | | 2 | <IP> | ZoneDirector | other | NULL | <key> | NULL | Radi us Client | NULL | +----+----------+--------------+-------+-------+--------+-----------+----- ----------+--------+ because i am using the core and the zone director as a NAS. Good luck Andrew
From: sigbj-st@operamail.com To: freeradius-users@lists.freeradius.org Subject: a router as NAS Date: Sun, 15 Jul 2012 18:49:18 +0200
(I think I messed up the previous posting by returning on a previous by Winter answered post. This message is found in the end of that post. I am sorry. Hope this one comes in with the new subject.) Can I connect to radius via a router that has a guestzone? It simply means that the router has an extra guestzone interface that also contains choice for PSK or EAP
From the following information I wonder why the radiusd is not responding.Remember I am trying to log in with the radius from the PC where the radius is installed. Radius is on 192.168.0.198 and I am attempting login or request from 192.168.0.198. This may also be a mistake. Maybe there will be a conflict betw 192.168.0.1 = router and 192.168.0.198 localhost. I simply dont know.
The router is a DLINK 655 The OS is SuSE Linux Enterprise Desktop 10, ServPack 3 The radius is the freeradiu-sserver-2.1.12
Here are the fields from this zone in the router: **ROUTER PART** "Use this section to configure the guest zone settings of your router. The guest zone provide a separate network zone for guest to access Internet":
--GUEST ZONE SELECTION-- Enable Guest Zone : (Yes) Wireless Band : 2.4GHz Band Wireless Network Name : EAP_sled (Also called the SSID) Enable Routing Between Zones : (No) Security Mode : WPA-Enterprise
--WPA-- WPA Mode : Auto (WPA or WPA2) Cipher Type : TKIP and AES Group Key Update Interval : 3600 (seconds)
--EAP (802.1x)--
"When WPA enterprise is enabled, the router uses EAP (802.1x) to authenticate clients via a remote RADIUS server."
Authentication Timeout : 60 (minutes) RADIUS server IP Address : 192.168.0.198 RADIUS server Port : 1812 RADIUS server Shared Secret : testing123 MAC Address Authentication : No **CLIENT.CONF** Then I change the client.conf from localhost 127.0.0.1 to the IP of the router 192.168.0.1 #client localhost { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # ipaddr = 127.0.0.1 # Test with router: client router { # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) ipaddr = 192.168.0.1 # and I keep rest of it as it was.
**/ETC/HOSTS/** I put in a line in /etc/hosts/ (I am not sure if it is right or necessary: # IP-Address Full-Qualified-Hostname Short-Hostname 192.168.0.1 router dlink
**YAST CONFIG FOR THE USERCLIENT** I change the setup in system (YaST)from PKS key to EAP: --MODUS-- Accesspoint: (Yes) Ad hoc: no Master: no --NETWORKNAME SSID-- EAP_sled --AUTHENTICATION MODUS-- Open: no Shared key: no WPA-EAP (Yes) WPA-PSK: no EAP Modus: TTLS Identity: sigbj (as in /usr/local/etc/raddb/users) Password: testing-0 (as in /usr/local/etc/raddb/users) Anonymous identity: (left open) Client-Sert: (closed) Client-Key: (closed) Client-Key_password: whatever Server-Sert: /usr/local/etc/raddb/certs/server.csr
I have made no changes in eap.conf and radius.conf
I try to start the radiusd -X with these changes (the previous test on localhost is successful: "Ready to process requests." And radtest test gives the right feedback:Sending Access-Accept of id 178 to 127.0.0.1 port 1932,so this test part works)
Some of the messages from the radiusd -X with the changed client.conf: ........ radiusd: #### Loading Clients #### client router { ipaddr = 192.168.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" ............. ... adding new socket proxy address * port 1047 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.
radtest gives this: Sending Access-Request of id 207 to 127.0.0.1 port 1812 User-Name = "sigbj" User-Password = "testing-0" NAS-IP-Address = 192.168.0.198 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 207 socket 3
and radiusd consequently: Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 1048
Trying to login with the Knetworkmanager (KDE) on to the network gives no reaction on the server, server is just waiting, the knetworkmanager may blink or just dryrun. I have a feeling that the server is listening on the 127.0.0.1 instead on 192.168.0.1, but do not know
I am of course doing a typical newbie mistake somewhere, but I do not know what.
IF YOU NEED THE WHOLE RADIUSD -X LOG AT THIS POINT, PLEASE TELL ME. I have given this explanations to begin with. The problems may also be that a router of this kind cannot be used on freeradius or that the router is 100% "Windows-messed-up".
-- Si St sigbj-st@operamail.com
-- http://www.fastmail.fm - The professional email service
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
References 1. mailto:sigbj-st@operamail.com -- http://www.fastmail.fm - Accessible with your email software or over the web
Hi, what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server? if its a typical router, then it will ne acting as a NAS to directly connected clients - and those clients will be sending their authentication to the NAS using 802.1X (EAPOW or EAPOL) which then get taken by the RADIUS server and converted to RADIUS over IP to the RADIUS server. alan
Hi , Alan is right. If you connect you pc directly to you router then you must configure the port to accept dot1x request usually they call dot1x port control. If you have wireless controller from the AAA settings you can test it and the same time you can see the request from the radius ( if you are running radiusd -X) Regards, Andy Antonopoulos Sent from my iPhone On 16 Jul 2012, at 08:52, alan buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server?
if its a typical router, then it will ne acting as a NAS to directly connected clients - and those clients will be sending their authentication to the NAS using 802.1X (EAPOW or EAPOL) which then get taken by the RADIUS server and converted to RADIUS over IP to the RADIUS server.
alan
Q:Buxey: Hi, what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server? A:Because the router documentation said it: "-WPA-Enterprise This option works with a RADIUS Server to authenticate wireless clients. Wireless clients should have established the necessary credentials before attempting to authenticate to the Server through this Gateway. Furthermore, it may be necessary to configure the RADIUS Server to allow this Gateway to authenticate users." I really cant help for that the docu is unprecise, has lacks etc. The "credentials " and understand as certs, the "configure" is very sparse if PORTS have to be taken in consideration. - But we are really getting somewhere taking PORTS into my knowledge. But I do not how to configure this and where. If the router has the 1812 configured I would assume that radius would return through the same port. I will try to read through the files in raddb to find something about it. Could /etc/service give a clue? -- Si St sigbj-st@operamail.com On Mon, Jul 16, 2012, at 08:57 AM, Andrew Antonopoulos wrote:
Hi ,
Alan is right. If you connect you pc directly to you router then you must configure the port to accept dot1x request usually they call dot1x port control.
If you have wireless controller from the AAA settings you can test it and the same time you can see the request from the radius ( if you are running radiusd -X)
Regards, Andy Antonopoulos
Sent from my iPhone
On 16 Jul 2012, at 08:52, alan buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server?
if its a typical router, then it will ne acting as a NAS to directly connected clients - and those clients will be sending their authentication to the NAS using 802.1X (EAPOW or EAPOL) which then get taken by the RADIUS server and converted to RADIUS over IP to the RADIUS server.
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- http://www.fastmail.fm - A fast, anti-spam email service.
Hi,
I really cant help for that the docu is unprecise, has lacks etc. The "credentials " and understand as certs, the "configure" is very sparse if PORTS have to be taken in consideration. - But we are really getting somewhere taking PORTS into my knowledge. But I do not how to configure this and where. If the router has the 1812 configured I would assume that radius would return through the same port. I will try to read through the files in raddb to find something about it. Could /etc/service give a clue?
its a very very special router that can receive and process and forward/proxy RADIUS traffic. most routers are the originator of RADIUS traffic, not recipients of it. all you need is to add your router IP address to the RADIUS server as a client and then start throwing tests from it. if the router has a RADIUS test function (via command line or GUI) then use it to see the RADIUS auth requests come through.. otherwise you'll have to have real clients connecting to it... alan
Si St wrote:
Q:Buxey: Hi, what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server? A:Because the router documentation said it: "-WPA-Enterprise
This option works with a RADIUS Server to authenticate wireless clients. Wireless clients should have established the necessary credentials before attempting to authenticate to the Server through this Gateway. Furthermore, it may be necessary to configure the RADIUS Server to allow this Gateway to authenticate users."
That text does NOT say the router accepts RADIUS requests.
I really cant help for that the docu is unprecise, has lacks etc.
It assumes that you are familiar with RADIUS and wireless configuration. If you're not, the text is hard to understand.
The "credentials " and understand as certs, the "configure" is very sparse if PORTS have to be taken in consideration. - But we are really getting somewhere taking PORTS into my knowledge. But I do not how to configure this and where. If the router has the 1812 configured I would assume that radius would return through the same port. I will try to read through the files in raddb to find something about it. Could /etc/service give a clue?
No. Read more about RADIUS and wireless configuration. Start with Wikipedia. Alan DeKok.
DeKOK, Buxey and andy79! Please, see if my understanding below is better. Taking a glimps at the page http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1... it seemes obvious to me that I have misunderstood a few things: I thought I needed something EXTRA that should run a NAS request to the radius-server, and thought the router should do the job. But the NAS is there already in the freeradiusserver downloadfile installed together with the server. Looking at what the radtest is spitting out it is there with its NAS IP and port "Sending Access-Request". The radiud -X answers this request:"rad_recv: Access-Request......[pap] User authenticated successfully ++[pap] returns ok........... Were there no NAS already, the radiusd would not have answered. Simple as that. From this it is of course obvious to me that it is impossible that the router can run a NAS, and I can understand Buxeys resignation about my "very special router". The router can only direct or rather route the userclient message to the NAS-radius machinery. That is what the router's EAP-switch is for, letting me configure an IP and a port in that box where to send it, have it treated by the NAS/radclient/radserver and receive an OK or something to let me through to the f.ex. internet. Isn't this correct? For the radtest to work I found that I had to apply the IPs or their authorized names or shortnames registered in the /etc/hosts. Otherwise: "radclient: Failed to find IP address for host sled-10sp3m: No such file or directory" At the same time the client.conf must correlate with the /etc/hosts What is wrong is my subject heading: "router as NAS", which of course confuses. If this is correct everything is simplified to just find out how to network this. Am I closer now? -- Si St sigbj-st@operamail.com On Mon, Jul 16, 2012, at 12:34 PM, Alan DeKok wrote:
Si St wrote:
Q:Buxey: Hi, what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server? A:Because the router documentation said it: "-WPA-Enterprise
This option works with a RADIUS Server to authenticate wireless clients. Wireless clients should have established the necessary credentials before attempting to authenticate to the Server through this Gateway. Furthermore, it may be necessary to configure the RADIUS Server to allow this Gateway to authenticate users."
That text does NOT say the router accepts RADIUS requests.
I really cant help for that the docu is unprecise, has lacks etc.
It assumes that you are familiar with RADIUS and wireless configuration. If you're not, the text is hard to understand.
The "credentials " and understand as certs, the "configure" is very sparse if PORTS have to be taken in consideration. - But we are really getting somewhere taking PORTS into my knowledge. But I do not how to configure this and where. If the router has the 1812 configured I would assume that radius would return through the same port. I will try to read through the files in raddb to find something about it. Could /etc/service give a clue?
No.
Read more about RADIUS and wireless configuration. Start with Wikipedia.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- http://www.fastmail.fm - Choose from over 50 domains or use your own
Hi Si St, I don't know why you are using router but in my situation we have sites where we installed L3 core switches and we just configure the radius ip and the radius shared key and is working or we have sites where we install a ZoneDirector (wireless controller) and can use as a NAS under the AAA settings we configured the port number (1812 or 1813 if you want) and the ip / shared key.As you can see the NAS need to know the ip , port number and the shared key. If you have a router then you need to do something similar so the router can pass the "messages" to the Radius server. The next step is about your clients. Again we have sited (with the core switches) where the clients are connected with the ethernet cable so you need to configure the ports for dot1x, 1 example from the Alied telesis switch is : switchport switchport mode access dot1x port-control auto dot1x control-direction both auth dynamic-vlan-creation as you can see the port-control is necessary and the dynamic vlan is optional. If your clients are connected through the wireless then you need to configure PEAP / mschapv2 because the freeradius is using MD5 by default and all the ports trunks (Access Point, Controller, Radius server). I believe in you case you are using a cisco router, so configure the router with the AAA commands (check the cisco site) and the port where you connect the client for dot1x. Run the server in debug mode (radiusd -X) and the same time from the client try to connect with the radius server. You should be able to see the requests , if the radius can't find the NAS or recognise then you will see an error and the ip of the router. If you are using MAC OS as a client go to the network preferences and setup the dot1x to use MD5 only (if you haven't change it in the EAP file) regardsAndrew
From: sigbj-st@operamail.com To: freeradius-users@lists.freeradius.org Subject: Re: a router as NAS Date: Wed, 18 Jul 2012 21:43:49 +0200
DeKOK, Buxey and andy79! Please, see if my understanding below is better.
Taking a glimps at the page http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1... it seemes obvious to me that I have misunderstood a few things: I thought I needed something EXTRA that should run a NAS request to the radius-server, and thought the router should do the job. But the NAS is there already in the freeradiusserver downloadfile installed together with the server. Looking at what the radtest is spitting out it is there with its NAS IP and port "Sending Access-Request". The radiud -X answers this request:"rad_recv: Access-Request......[pap] User authenticated successfully ++[pap] returns ok...........
Were there no NAS already, the radiusd would not have answered. Simple as that. From this it is of course obvious to me that it is impossible that the router can run a NAS, and I can understand Buxeys resignation about my "very special router". The router can only direct or rather route the userclient message to the NAS-radius machinery. That is what the router's EAP-switch is for, letting me configure an IP and a port in that box where to send it, have it treated by the NAS/radclient/radserver and receive an OK or something to let me through to the f.ex. internet. Isn't this correct?
For the radtest to work I found that I had to apply the IPs or their authorized names or shortnames registered in the /etc/hosts. Otherwise: "radclient: Failed to find IP address for host sled-10sp3m: No such file or directory" At the same time the client.conf must correlate with the /etc/hosts
What is wrong is my subject heading: "router as NAS", which of course confuses.
If this is correct everything is simplified to just find out how to network this. Am I closer now? -- Si St sigbj-st@operamail.com
On Mon, Jul 16, 2012, at 12:34 PM, Alan DeKok wrote:
Si St wrote:
Q:Buxey: Hi, what makes you think you can send RADIUS requests to this router and for it to then send those requests to your server? A:Because the router documentation said it: "-WPA-Enterprise
This option works with a RADIUS Server to authenticate wireless clients. Wireless clients should have established the necessary credentials before attempting to authenticate to the Server through this Gateway. Furthermore, it may be necessary to configure the RADIUS Server to allow this Gateway to authenticate users."
That text does NOT say the router accepts RADIUS requests.
I really cant help for that the docu is unprecise, has lacks etc.
It assumes that you are familiar with RADIUS and wireless configuration. If you're not, the text is hard to understand.
The "credentials " and understand as certs, the "configure" is very sparse if PORTS have to be taken in consideration. - But we are really getting somewhere taking PORTS into my knowledge. But I do not how to configure this and where. If the router has the 1812 configured I would assume that radius would return through the same port. I will try to read through the files in raddb to find something about it. Could /etc/service give a clue?
No.
Read more about RADIUS and wireless configuration. Start with Wikipedia.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- http://www.fastmail.fm - Choose from over 50 domains or use your own
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Si St wrote:
Taking a glimps at the page http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1...
So... why are you reading random pages on the net? And not the pages we suggested you read?
it seemes obvious to me that I have misunderstood a few things: I thought I needed something EXTRA that should run a NAS request to the radius-server, and thought the router should do the job.
You're mixing up terminology. Get it right, or you'll *never* understand what's going on.
But the NAS is there already in the freeradiusserver downloadfile installed together with the server.
What the heck does that mean?
Looking at what the radtest is spitting out it is there with its NAS IP and port "Sending Access-Request". The radiud -X answers this request:"rad_recv: Access-Request......[pap] User authenticated successfully ++[pap] returns ok...........
Well... you've completely misunderstand everything about that.
Were there no NAS already, the radiusd would not have answered. Simple as that.
No. Absolutely not. Not "simple as that".
From this it is of course obvious to me that it is impossible that the router can run a NAS,
No. Many routers do send RADIUS Access-Request packets.
and I can understand Buxeys resignation about my "very special router".
No. You thought that the router would accept RADIUS packets from a third party, and then send them to the RADIUS server. Routers don't work like that. Hence his comment of "very special router".
The router can only direct or rather route the userclient message to the NAS-radius machinery.
You're using terminology you invented. STOP IT NOW. Your misconception of how everything works is making it IMPOSSIBLE for you to understand ANYTHING.
That is what the router's EAP-switch is for, letting me configure an IP and a port in that box where to send it, have it treated by the NAS/radclient/radserver and receive an OK or something to let me through to the f.ex. internet. Isn't this correct?
It's complete nonsense. You might as well be writing gibberish.
If this is correct everything is simplified to just find out how to network this. Am I closer now?
You're even further away from understanding how it works. Read the Wikipedia pages on RADIUS and EAP. It's really not hard. Alan DeKok.
participants (5)
-
alan buxey -
Alan DeKok -
Andrew Andonopoulos -
Andrew Antonopoulos
-
Si St