It is noticed that some VSAs are sent with Access-Challenge but not with Access-Accept when PEAP is used. Is there a way to configure the server such that those attributes are sent with Access-Accept? Thank you.
rosect190@yahoo.com wrote:
It is noticed that some VSAs are sent with Access-Challenge but not with Access-Accept when PEAP is used.
Is there a way to configure the server such that those attributes are sent with Access-Accept?
Configure the server to send them in the Access-Accept. If you're not going to give useful information in your question, any answer will be likewise useless. Alan DeKok.
On 12/20/2012 05:14 PM, rosect190@yahoo.com wrote:
It is noticed that some VSAs are sent with Access-Challenge but not with Access-Accept when PEAP is used.
Is there a way to configure the server such that those attributes are sent with Access-Accept?
"use_tunneled_reply = yes" under the "peap {}" section in "eap.conf". In addition, if you're seeing the VSAs in Access-Challenge, it's most likely because you're returning them in the "authorize" second. Instead, consider returning them in the "post-auth" section of the "inner-tunnel" server, combined with the config above. There are other options, depending on your needs.
Hi,
In addition, if you're seeing the VSAs in Access-Challenge, it's most likely because you're returning them in the "authorize" second. Instead, consider returning them in the "post-auth" section of the "inner-tunnel" server, combined with the config above.
dont forget RFC 2865 Access-Challenge The Attributes field MAY have one or more Reply-Message Attributes, and MAY have a single State Attribute, or none. Vendor-Specific, Idle-Timeout, Session-Timeout and Proxy-State attributes MAY also be included. No other Attributes defined in this document are permitted in an Access-Challenge. ensure only the right things are in those challenge packets alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Phil Mayers -
rosect190＠yahoo.com