I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening? VPN logs from my failing PPTP connection: Mar 27 15:03:30 macvpn-inside 13885796 03/27/2009 15:03:30.520 SEV=4 PPTP/47 RPT=37605 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:03:30 macvpn-inside 13885797 03/27/2009 15:03:30.590 SEV=4 PPTP/42 RPT=37421 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:03:33 macvpn-inside 13885798 03/27/2009 15:03:33.800 SEV=5 PPP/8 RPT=33514 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:03:33 macvpn-inside 13885799 03/27/2009 15:03:33.890 SEV=4 PPTP/35 RPT=37406 76.64.100.68 Session closed on tunnel 76.64.100.68 (peer 0, local 61694, serial 44796), reason: User request (No additional info) FreeRadius debug log of failed connection: Ready to process requests. rad_recv: Access-Request packet from host 172.26.69.8 port 1479, id=77, length=146 User-Name = "test26" NAS-Port = 8057 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "76.64.100.68" MS-CHAP-Response = 0x02010000000000000000000000000000000000000000000000002f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 MS-CHAP-Challenge = 0x5e0b3b68c24784e0 NAS-IP-Address = 172.26.69.8 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test26", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=test26 [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 [mschap] mschap1: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=5e0b3b68c24784e0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 Exec-Program output: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program-Wait: plaintext: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program: returned: 0 ++[mschap] returns ok Login OK: [test26] (from client macvpn port 8057) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 77 to 172.26.69.8 port 1479 Finished request 5. Going to the next request And my VPN logs from a working connection (ciscosecure radius): Mar 27 15:08:11 macvpn-inside 13886204 03/27/2009 15:08:11.640 SEV=4 PPTP/47 RPT=37606 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:08:11 macvpn-inside 13886205 03/27/2009 15:08:11.710 SEV=4 PPTP/42 RPT=37422 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:08:14 macvpn-inside 13886215 03/27/2009 15:08:14.920 SEV=5 PPP/8 RPT=33515 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:08:17 macvpn-inside 13886216 03/27/2009 15:08:17.790 SEV=5 PPP/49 RPT=33002 76.64.100.68 User [test26] IPCP assigned IP Address 172.26.94.7 Mar 27 15:08:17 macvpn-inside 13886217 03/27/2009 15:08:17.790 SEV=4 AUTH/22 RPT=354231 76.64.100.68 User [test26] Group [Base Group] connected, Session Type: PPTP -Mike
FreeRadius debug log of failed connection:
Ready to process requests. rad_recv: Access-Request packet from host 172.26.69.8 port 1479, id=77, length=146 User-Name = "test26" NAS-Port = 8057 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "76.64.100.68" MS-CHAP-Response = 0x02010000000000000000000000000000000000000000000000002f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 MS-CHAP-Challenge = 0x5e0b3b68c24784e0 NAS-IP-Address = 172.26.69.8 NAS-Port-Type = Virtual
----------------snip
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=test26 [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 [mschap] mschap1: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=5e0b3b68c24784e0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345
Looks like the client is trying to do MSCHAP and not PAP and it's not finding a password ? -- Philippe-Alexandre Lemelin
I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening?
Yes, the reply is different.
Sending Access-Accept of id 77 to 172.26.69.8 port 1479 Finished request 5.
Authentication works. But authorization? Read cisco documentation to see if you need to return something more (most likely Service-Type). Ivan Kalik Kalik Informatika ISP
Mike Diggins wrote:
I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening?
The replies are different, and the VPN3030 doesn't like the replies. So... run "tcpdump", or "radsniff" on the packets from your old server. See what is in the packets, and then make FreeRADIUS respond with the same content. That's it. Alan DeKok.
On Sat, 28 Mar 2009, Alan DeKok wrote:
Mike Diggins wrote:
I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening?
The replies are different, and the VPN3030 doesn't like the replies.
So... run "tcpdump", or "radsniff" on the packets from your old server. See what is in the packets, and then make FreeRADIUS respond with the same content. That's it.
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope). -Mike
Mike Diggins wrote:
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
Wireshark will show you the contents as RADIUS attributes... just like radclient, or the server in debugging mode. Look at the attributes && values for the "working" one, and configure FreeRADIUS to send the same attributes and values. Do you have *specific* questions? Alan DeKok.
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
That's the conversation between NAS and the client, not NAS and radius server. Ivan Kalik Kalik Informatika ISP
On Sun, 29 Mar 2009, tnt@kalik.net wrote:
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
That's the conversation between NAS and the client, not NAS and radius server.
Right. I guess I captured the wrong end of the conversation. I'll have to capture that tomorrow, and hope that wireshark can provide the full radius response as Alan mentioned. Thanks. -Mike
On Sun, 29 Mar 2009, tnt@kalik.net wrote:
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
That's the conversation between NAS and the client, not NAS and radius server.
So I have attached the correct captures this time, and can see that my CiscoSecure Radius server is supplying some PPTP MPPE Encryption policy and keys in the reply. I didn't know it was doing that! Is this something I can duplicated with FreeRadius? -Mike
On Sun, 29 Mar 2009, tnt@kalik.net wrote:
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
That's the conversation between NAS and the client, not NAS and radius server.
So I have attached the correct captures this time, and can see that my CiscoSecure Radius server is supplying some PPTP MPPE Encryption policy and keys in the reply. I didn't know it was doing that! Is this something I can duplicated with FreeRadius? -Mike
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
That's the conversation between NAS and the client, not NAS and radius server.
So I have attached the correct captures this time, and can see that my CiscoSecure Radius server is supplying some PPTP MPPE Encryption policy and keys in the reply. I didn't know it was doing that! Is this something I can duplicated with FreeRadius?
It works in freeradius by default. You have disabled mppe in mschap module (raddb/modules/mschap). Ivan Kalik Kalik Informatika ISP
On Mon, 30 Mar 2009, tnt@kalik.net wrote:
I used wireshark to capture the working and non-working PPTP authentication. There is a difference, but I don't know how to interpret what's missing on the failed reply. Anyone want to have a look? Files are attached (I hope).
That's the conversation between NAS and the client, not NAS and radius server.
So I have attached the correct captures this time, and can see that my CiscoSecure Radius server is supplying some PPTP MPPE Encryption policy and keys in the reply. I didn't know it was doing that! Is this something I can duplicated with FreeRadius?
It works in freeradius by default. You have disabled mppe in mschap module (raddb/modules/mschap).
Doh! That was it. Thanks once again. -Mike
participants (4)
-
Alan DeKok -
Mike Diggins -
phil lemelin -
tnt＠kalik.net