WING-ASN throwing error - Mandatory HA Mode parameter
Dear All, I am using WING-ASN and AAA(Radius server) to test EAP-TLS authentication mechanism. WING-ASN is throwing following error. 08.06.2012(12:16.50.249.739) [ASN C Plane] Mandatory HA Mode parameter (HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY) I did not find all above attributes in AAA. Can anybody tell me how to add above attributes and also their values? Thanks! Rathod.
I am using Free Radius only. I would like to know whether FreeRadius supports following attributes in ACCESS-ACCEPT. HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY Thanks ! Rathod. -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Monday, June 11, 2012 11:11 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: WING-ASN throwing error - Mandatory HA Mode parameter Rathod Subhashchandra wrote:
I am using WING-ASN and AAA(Radius server) to test EAP-TLS authentication mechanism.
WING-ASN is throwing following error.
Go ask the vendor how their product works. This list is for questions about FreeRADIUS. Alan DeKok.
Rathod Subhashchandra wrote:
I am using Free Radius only. I would like to know whether FreeRadius supports following attributes in ACCESS-ACCEPT.
HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY
Yes. FreeRADIUS supports all standard, and many non-standard attributes. See dictionary.wimax. Alan DeKok.
On Mon, Jun 11, 2012 at 12:50 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
I am using Free Radius only. I would like to know whether FreeRadius supports following attributes in ACCESS-ACCEPT.
HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY
freeradius supports adding custom or vendor-specific attributes. You need to know what they are to add them. Ask your NAS vendor for the radius dictionary file, and what the values should be for a successful authentication. IF (and ONLY if) you already have a working radius server for that NAS, you could probably use wireshark/tcpdump/whatever to capture what attributes were sent, and configure FR to send those attributes as well. I don't recommend this method for newbies though, better ask your vendor. -- Fajar
Dear Fajar, ACCESS-ACCEPT screen logs shows following attributes but not in pcap. Screen logs: Sending Access-Accept of id 6 to 125.125.40.38 port 1812 WiMAX-MN-NAI = "user@tataelxsi.com" Service-Type = Authenticate-Only State = 0xd2be425bd6b84f57c4a7ea648e1803b6 MS-MPPE-Recv-Key = 0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d MS-MPPE-Send-Key = 0x49a17afa5f030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3 WiMAX-MSK = 0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d49a17afa5f 030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user@tataelxsi.com" WiMAX-IP-Technology = PMIP4 WiMAX-hHA-IP-MIP4 = 172.16.104.175 WiMAX-DNS-Server = 192.168.10.3 WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-AAA-Session-Id = 0x30313032 WiMAX-Packet-Data-Flow-Id = 1 WiMAX-Service-Data-Flow-Id = 1 WiMAX-Service-Profile-Id = 1 WiMAX-Direction = Bi-Directional WiMAX-FA-RK-Key = 0xb977ed6f9bf2231bba840d7cf1c02cd1bd7f47fa Framed-IP-Address = 192.168.10.3 Session-Timeout = 172800 Termination-Action = 3 Chargeable-User-Identity = "user@tataelxsi.com" WiMAX-HA-RK-Lifetime = 900 WiMAX-HA-RK-SPI = 0 WiMAX-HA-RK-Key = 0x2b83c9fd0e5c3e2f8af0aa4464ba27ff8372fe4b WiMAX-FA-RK-SPI = 2474926121 The content of Wireshark is attached. Wireshark ACCESS-ACCEPT message does not reflect WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI. Does it mean that above attributes are not added in the message and simply printed by FreeRadius server? Or Vendor specific HA mode parameters are different? Thanks ! Rathod. -----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Monday, June 11, 2012 11:39 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: WING-ASN throwing error - Mandatory HA Mode parameter On Mon, Jun 11, 2012 at 12:50 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
I am using Free Radius only. I would like to know whether FreeRadius supports following attributes in ACCESS-ACCEPT.
HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY
freeradius supports adding custom or vendor-specific attributes. You need to know what they are to add them. Ask your NAS vendor for the radius dictionary file, and what the values should be for a successful authentication. IF (and ONLY if) you already have a working radius server for that NAS, you could probably use wireshark/tcpdump/whatever to capture what attributes were sent, and configure FR to send those attributes as well. I don't recommend this method for newbies though, better ask your vendor. -- Fajar
Judging by that access-accept message you don't have all of the attributes needed to set up a WiMax service flow. There are far more attributes that need to be sent than you have listed below, and they all have to be sent in the order listed in dictionary.wimax. Check the archives of this list for WiMax service flow replies, this is fairly well documented. Your ASN manufacturer should be able to supply you with an IOT document or other radius documentation. David -----Original Message----- From: freeradius-users-bounces+davidp=wirelessconnections.net@lists.freeradius.org [mailto:freeradius-users-bounces+davidp=wirelessconnections.net@lists.freera dius.org] On Behalf Of Rathod Subhashchandra Sent: Monday, June 11, 2012 9:10 AM To: 'Fajar A. Nugraha'; 'FreeRadius users mailing list' Subject: RE: WING-ASN throwing error - Mandatory HA Mode parameter Importance: High Dear Fajar, ACCESS-ACCEPT screen logs shows following attributes but not in pcap. Screen logs: Sending Access-Accept of id 6 to 125.125.40.38 port 1812 WiMAX-MN-NAI = "user@tataelxsi.com" Service-Type = Authenticate-Only State = 0xd2be425bd6b84f57c4a7ea648e1803b6 MS-MPPE-Recv-Key = 0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d MS-MPPE-Send-Key = 0x49a17afa5f030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3 WiMAX-MSK = 0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d49a17afa5f 030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user@tataelxsi.com" WiMAX-IP-Technology = PMIP4 WiMAX-hHA-IP-MIP4 = 172.16.104.175 WiMAX-DNS-Server = 192.168.10.3 WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-AAA-Session-Id = 0x30313032 WiMAX-Packet-Data-Flow-Id = 1 WiMAX-Service-Data-Flow-Id = 1 WiMAX-Service-Profile-Id = 1 WiMAX-Direction = Bi-Directional WiMAX-FA-RK-Key = 0xb977ed6f9bf2231bba840d7cf1c02cd1bd7f47fa Framed-IP-Address = 192.168.10.3 Session-Timeout = 172800 Termination-Action = 3 Chargeable-User-Identity = "user@tataelxsi.com" WiMAX-HA-RK-Lifetime = 900 WiMAX-HA-RK-SPI = 0 WiMAX-HA-RK-Key = 0x2b83c9fd0e5c3e2f8af0aa4464ba27ff8372fe4b WiMAX-FA-RK-SPI = 2474926121 The content of Wireshark is attached. Wireshark ACCESS-ACCEPT message does not reflect WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI. Does it mean that above attributes are not added in the message and simply printed by FreeRadius server? Or Vendor specific HA mode parameters are different? Thanks ! Rathod. -----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Monday, June 11, 2012 11:39 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: WING-ASN throwing error - Mandatory HA Mode parameter On Mon, Jun 11, 2012 at 12:50 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
I am using Free Radius only. I would like to know whether FreeRadius supports following attributes in ACCESS-ACCEPT.
HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY
freeradius supports adding custom or vendor-specific attributes. You need to know what they are to add them. Ask your NAS vendor for the radius dictionary file, and what the values should be for a successful authentication. IF (and ONLY if) you already have a working radius server for that NAS, you could probably use wireshark/tcpdump/whatever to capture what attributes were sent, and configure FR to send those attributes as well. I don't recommend this method for newbies though, better ask your vendor. -- Fajar
On Mon, Jun 11, 2012 at 8:10 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
The content of Wireshark is attached. Wireshark ACCESS-ACCEPT message does not reflect WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI.
Does it mean that above attributes are not added in the message and simply printed by FreeRadius server? Or Vendor specific HA mode parameters are different?
Do you have rlm_wimax compiled and installed? If your using debian/ubuntu, and use the default package, chances are you don't. -- Fajar
I've looked into the pcap file. WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI attributes are there. My Wireshark does not show their names, but they are there: WiMAX-HA-RL-Lifetime = 900 VSA: l=7 t=Unknown-Attribute(17): 0000000384 WiMAX-HA-RK-SPI = 0 VSA: l=7 t=Unknown-Attribute(16): 0000000000 WiMAX-HA-RK-Key = 0xA2DD89C4... VSA: l=37 t=Unknown-Attribute(15): 00A2DD89C4... WiMAX-FA-RK-SPI = 2474926121 VSA: l=7 t=Unknown-Attribute(61): 0093846029 Go ask ASN-GW vendor what's going on. Rathod Subhashchandra wrote:
Dear Fajar,
ACCESS-ACCEPT screen logs shows following attributes but not in pcap. Screen logs: Sending Access-Accept of id 6 to 125.125.40.38 port 1812 WiMAX-MN-NAI = "user@tataelxsi.com" Service-Type = Authenticate-Only State = 0xd2be425bd6b84f57c4a7ea648e1803b6 MS-MPPE-Recv-Key = 0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d MS-MPPE-Send-Key = 0x49a17afa5f030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3 WiMAX-MSK = 0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d49a17afa5f 030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user@tataelxsi.com" WiMAX-IP-Technology = PMIP4 WiMAX-hHA-IP-MIP4 = 172.16.104.175 WiMAX-DNS-Server = 192.168.10.3 WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-AAA-Session-Id = 0x30313032 WiMAX-Packet-Data-Flow-Id = 1 WiMAX-Service-Data-Flow-Id = 1 WiMAX-Service-Profile-Id = 1 WiMAX-Direction = Bi-Directional WiMAX-FA-RK-Key = 0xb977ed6f9bf2231bba840d7cf1c02cd1bd7f47fa Framed-IP-Address = 192.168.10.3 Session-Timeout = 172800 Termination-Action = 3 Chargeable-User-Identity = "user@tataelxsi.com" WiMAX-HA-RK-Lifetime = 900 WiMAX-HA-RK-SPI = 0 WiMAX-HA-RK-Key = 0x2b83c9fd0e5c3e2f8af0aa4464ba27ff8372fe4b WiMAX-FA-RK-SPI = 2474926121
The content of Wireshark is attached. Wireshark ACCESS-ACCEPT message does not reflect WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI.
Does it mean that above attributes are not added in the message and simply printed by FreeRadius server? Or Vendor specific HA mode parameters are different?
Iliya Peregoudov wrote:
I've looked into the pcap file. WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI attributes are there. My Wireshark does not show their names, but they are there:
Wireshark doesn't decode WiMAX attributes properly. I'm not surprised. The format is weird.
Go ask ASN-GW vendor what's going on.
Exactly. Q: FreeRADIUS returned Access-Accept. Why isn't the user online? A: Go ask the NAS vendor why their product doesn't work. Alan DeKok.
Dear Iliya Peregoudov, Thanks lot. ASN-GW throwing following error. 08.06.2012(12:16.50.249.739) [ASN C Plane] Mandatory HA Mode parameter (HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY) not received in HA Supported Mode:397dde 1 Thanks ! Rathod. -----Original Message----- From: Iliya Peregoudov [mailto:iperegudov@cboss.ru] Sent: Wednesday, June 13, 2012 7:30 PM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Cc: 'Fajar A. Nugraha' Subject: Re: WING-ASN throwing error - Mandatory HA Mode parameter I've looked into the pcap file. WiMAX-HA-RK-Lifetime, WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI attributes are there. My Wireshark does not show their names, but they are there: WiMAX-HA-RL-Lifetime = 900 VSA: l=7 t=Unknown-Attribute(17): 0000000384 WiMAX-HA-RK-SPI = 0 VSA: l=7 t=Unknown-Attribute(16): 0000000000 WiMAX-HA-RK-Key = 0xA2DD89C4... VSA: l=37 t=Unknown-Attribute(15): 00A2DD89C4... WiMAX-FA-RK-SPI = 2474926121 VSA: l=7 t=Unknown-Attribute(61): 0093846029 Go ask ASN-GW vendor what's going on. Rathod Subhashchandra wrote:
Dear Fajar,
ACCESS-ACCEPT screen logs shows following attributes but not in pcap.
Screen logs:
Sending Access-Accept of id 6 to 125.125.40.38 port 1812
WiMAX-MN-NAI = "user@tataelxsi.com"
Service-Type = Authenticate-Only
State = 0xd2be425bd6b84f57c4a7ea648e1803b6
MS-MPPE-Recv-Key =
0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d
MS-MPPE-Send-Key =
0x49a17afa5f030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3
WiMAX-MSK =
0xd967448623358aa2149aee72c8d59c7640ca9b7fb4c06836781533bb9ae7679d49a17afa5f
030067f31c8a3e44d14e88a312af0a90e1299e73019fa1c27e7fb3
EAP-Message = 0x03060004
Message-Authenticator = 0x00000000000000000000000000000000
User-Name = "user@tataelxsi.com"
WiMAX-IP-Technology = PMIP4
WiMAX-hHA-IP-MIP4 = 172.16.104.175
WiMAX-DNS-Server = 192.168.10.3
WiMAX-Accounting-Capabilities = IP-Session-Based
WiMAX-Idle-Mode-Notification-Cap = Supported
WiMAX-AAA-Session-Id = 0x30313032
WiMAX-Packet-Data-Flow-Id = 1
WiMAX-Service-Data-Flow-Id = 1
WiMAX-Service-Profile-Id = 1
WiMAX-Direction = Bi-Directional
WiMAX-FA-RK-Key = 0xb977ed6f9bf2231bba840d7cf1c02cd1bd7f47fa
Framed-IP-Address = 192.168.10.3
Session-Timeout = 172800
Termination-Action = 3
Chargeable-User-Identity = "user@tataelxsi.com"
WiMAX-HA-RK-Lifetime = 900
WiMAX-HA-RK-SPI = 0
WiMAX-HA-RK-Key = 0x2b83c9fd0e5c3e2f8af0aa4464ba27ff8372fe4b
WiMAX-FA-RK-SPI = 2474926121
The content of Wireshark is attached.
Wireshark ACCESS-ACCEPT message does not reflect WiMAX-HA-RK-Lifetime,
WiMAX-HA-RK-SPI, WiMAX-HA-RK-Key, and WiMAX-FA-RK-SPI.
Does it mean that above attributes are not added in the message and simply
printed by FreeRadius server? Or Vendor specific HA mode parameters are
different?
On Thu, Jun 14, 2012 at 4:17 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
Dear Iliya Peregoudov,
Thanks lot.
ASN-GW throwing following error.
08.06.2012(12:16.50.249.739) [ASN C Plane] Mandatory HA Mode parameter (HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY) not received in HA Supported Mode:397dde 1
Let me rephrase Iliya's statement, in case you misunderstand: (1) FR sends wimax-related attributes already (2) your NAS (ASN-GW) rejects it (3) you should ask ASN-GW vendor what's going on. Did you do (3)? Pasting your NAS's log over and over again on this list will not help if you haven't ask its vendor. Is that clear enough? It might be something simple (e.g. there's no attribute for "Duration Quota" sent, whatever that is). Your vendor can tell you what you missed. Those who aren't familiar with your NAS will not be able to help you more, no matter how many times you pasted NAS's log. -- Fajar
participants (5)
-
Alan DeKok -
David Peterson -
Fajar A. Nugraha -
Iliya Peregoudov -
Rathod Subhashchandra