EAP challenge gets ignored with some clients
Hi, Firstly, sorry about the vague subject line! Here's the scenario: - FreeRADIUS 1.0.4 running on OpenBSD 3.7 - Netgear WAG302 access points (configured for WPA/TKIP) I'm using PEAP and MSCHAPv2 to authenticate wireless folk against our Windows domain controller with ntlm_auth. As things stand, it's all working... for some clients... some of the time. My testing shows that: - XP clients can always connect, although it sometimes takes them a few tries (those using the card vendor's software work better than those using the Windows client) - Windows Mobile/Pocket PC devices sometimes work, sometimes don't (mine worked until yesterday, now it refuses to connect) - Various other version of Windows have varying results. - Linux with wpa_supplicant _always_ works, and authenticates much faster than anything else. When a client fails to connect, the output of radiusd -X shows that the daemon sends the first EAP challenge, but never receives a reply (tcpdump on the OpenBSD box confirms this). The symptoms are the same regardless of the type of client. I'm tearing my hair out, and have run out of things to try... I'm hoping that this will all sound horribly familiar to someone who knows exactly what's happening! Many, many thanks for any advice (or just a shoulder rub :-) - Ian -- Ian Chard, Unix & Network Administrator | E: ian.chard@sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 204937
Ian Chard <ian.chard@sers.ox.ac.uk> wrote:
When a client fails to connect, the output of radiusd -X shows that the daemon sends the first EAP challenge, but never receives a reply (tcpdump on the OpenBSD box confirms this). The symptoms are the same regardless of the type of client.
If this is happening when all clients are on the same AP, then the only conclusion is that the problem is related to the clients. SP2 has a stupid problem where it won't talk to non-MS RADIUS servers. There's a fix, though. Try doing tcpdump on the wireless side, to see what the traffic is there. Alan DeKok.
SP2 has a stupid problem where it won't talk to non-MS RADIUS servers. There's a fix, though.
If anyone needs this hotfix, let me know. MS sent it to me, but their "ongoing" support is a PITA -- I told them thanks and to close the ticket, but they kept e-mailing me so I finally told them what I really though. :-) -kb -- Kris Benson, CCP, I.S.P. Technical Analyst, District Projects School District #57 (Prince George)
participants (3)
-
Alan DeKok -
Ian Chard -
Kris Benson