confusion about radius.log entries
We have had back to school this week and a lot of students are complaining about "unstable wifi". Not a lot of help… but after much digging, the general report is that they connect to the wireless network (Cisco 5508 controller advertising WPA2 Enterprise / PEAP / MSCHAPv2 network authenticating against FreeRadius 3.0.7 with Active Directory) but then they will lose their connection and may not be able to get connected again for 30 minutes to several hours later. We didn’t have problems at all this summer with light traffic, but now with heavy traffic, it’s quite overwhelming. I plan to upgrade to FR 3.0.9 tomorrow. I will also open a case with Cisco in the morning. My question here is related to the activity I’m seeing in the radius.log on the FR servers. I see login OK messages for the same user repeatedly at intervals from a few seconds to a few minutes apart. I thought it might have something to do with a user moving between access points, but even when they are in a fixed location, multiple entries show in the log. I’m not familiar with the radius protocol, but this seems… excessive. My first thought is a misconfiguration of the WLAN on the Cisco controller, but, before opening a case with Cisco, are there thoughts from the FR community? Here is a sample of log messages for me from a period today: Tue Aug 25 14:15:08 2015 : Auth: (24739) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:15:14 2015 : Auth: (25069) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:15:44 2015 : Auth: (26647) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:19:42 2015 : Auth: (37222) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:19:58 2015 : Auth: (38197) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:21:11 2015 : Auth: (41519) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:23:00 2015 : Auth: (46534) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:23:38 2015 : Auth: (48018) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) I can post additional logs or configuration information if that would be helpful. I’m not sure exactly what would be helpful, so I’ll hold off including anything more for now. Thank you. -- Tim Winders Associate Dean of Information Technology South Plains College (806) 716-2369
On Aug 25, 2015, at 8:08 PM, Winders, Timothy A <twinders@southplainscollege.edu> wrote:
We have had back to school this week and a lot of students are complaining about "unstable wifi". Not a lot of help… but after much digging, the general report is that they connect to the wireless network (Cisco 5508 controller advertising WPA2 Enterprise / PEAP / MSCHAPv2 network authenticating against FreeRadius 3.0.7 with Active Directory) but then they will lose their connection and may not be able to get connected again for 30 minutes to several hours later.
If they're connected, any later disconnect is *not* a RADIUS problem.
My question here is related to the activity I’m seeing in the radius.log on the FR servers. I see login OK messages for the same user repeatedly at intervals from a few seconds to a few minutes apart. I thought it might have something to do with a user moving between access points, but even when they are in a fixed location, multiple entries show in the log.
It's the user trying to re-authenticate. Over and over.
I’m not familiar with the radius protocol, but this seems… excessive. My first thought is a misconfiguration of the WLAN on the Cisco controller, but, before opening a case with Cisco, are there thoughts from the FR community?
Blame the end user system, and / or the WiFi access point.
Here is a sample of log messages for me from a period today:
Tue Aug 25 14:15:08 2015 : Auth: (24739) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel)
FreeRADIUS is authenticating the user OK. After that, if anything goes wrong, it's the fault of some other system in the network. Alan DeKok.
On 8/25/15, 8:01 PM, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+twinders=southplainscollege.edu@lists.freeradius.org on behalf of aland@deployingradius.com> wrote:
Here is a sample of log messages for me from a period today:
Tue Aug 25 14:15:08 2015 : Auth: (24739) Login OK: [twinders@southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel)
FreeRADIUS is authenticating the user OK. After that, if anything goes wrong, it's the fault of some other system in the network.
Thanks, Alan. It was not my intention to blame FR. The fact that we have various clients (iOS, MacOS, Win, Android) all exhibiting the same behavior, the obvious problem is the AP/Controller, or more likely, the configuration of such. As this was my account, and I know the device was working, in a stationary location, it makes no sense that the device would attempt to continue to reauthenticate. As I am also the admin for the wireless system, I blame the configuration of the wireless and will open the case with Cisco in the morning. Thank you for your reply! -- Tim Winders Associate Dean of Information Technology South Plains College (806) 716-2369
They shouldn't be reauthenticating when bouncing from AP to AP. Check your mobility settings on the controller and any eg load balancing methods you have on. Also, what's your session timeout? Alan
There is no session timeout setting. The idle timeout was set to 5 minutes. I have changed that to 10 hours. This should help clients, especially phones and tablets, not have to reauth everytime the device goes to sleep. I am still seeing some clients with the same continuous reauthentication pattern. Most seem to be OK after upgrading from FR 3.0.7 to 3.0.9. I know that makes no sense. I put it out there for information only. We do have the Cisco settings for "Client Load Balancing" and "Client Band Select" enabled. I do see my account with multiple repeated auth attempts (all show Login OK) in short periods of time. This appears to be when I was moving across campus or within earshot of multiple Aps. I’m not sure why multiple auths would be showing up in radius.log in that situation, though. Still seems like a bad controller setting. I may try disabling the cisco options mentioned above tonight and see what happens tomorrow… -- Tim Winders Associate Dean of Information Technology South Plains College (806) 716-2369 From: Alan Buxey Date: Wednesday, August 26, 2015 at 4:29 AM To: FreeRadius users mailing list, Timothy Winders Subject: Re: confusion about radius.log entries They shouldn't be reauthenticating when bouncing from AP to AP. Check your mobility settings on the controller and any eg load balancing methods you have on. Also, what's your session timeout? Alan
participants (3)
-
Alan Buxey -
Alan DeKok -
Winders, Timothy A