Hi list, I've just upgraded a freeradius v1.1.8 server with MySQL DB to 3.0.11. I didn't install or configure the original and haven't used freeradius previously so its been a steep learning curve. I've now got the server to a point where it seems to all work on the server side, we are testing via NTRadPing and we get a successful authentication logged on the server and in NTRadPing. However when we try and use Radius for real with a Cisco device doing authentication for L2TP something is failing. This is what my colleague who runs the network told me having looking at the debug info on the router side: "PPP comes up and then the router tries to get an IP address. This messages 0.0.0.0 there is no address and request the local router to provide it. So basically it's not getting an address from the radius server" When we test with NTRadPing we noticed that the output is slightly different if we authenticate against the v1 or v3 radius server: radius 1 - not working Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\0x0a Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0x85K\0x97\0xd5jk\0x0b\0xefbN\0xac\0x12y\0x80.\0xda\0xb3\0xb1 Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3 radius 2 - working (differences in red) Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\n Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0xb0}=G\0xe7\0xe4\0x08\0xd1\\0xe4\0xax;\0x0d?\0x15\0xe4\0x8f\0xfe Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3 could this be related to our issue? Noticing the line return is different on the avpair line and the password is different, its stored in clear text in the DB. Currently a bit stumped. Can pass on the output of radiusd -X if the above isn't the key to the problem, thanks, Andy.
On Jun 2, 2016, at 9:09 AM, Andy Smith <a.smith@ldex.co.uk> wrote:
I've just upgraded a freeradius v1.1.8 server with MySQL DB to 3.0.11. I didn't install or configure the original and haven't used freeradius previously so its been a steep learning curve. I've now got the server to a point where it seems to all work on the server side, we are testing via NTRadPing and we get a successful authentication logged on the server and in NTRadPing. However when we try and use Radius for real with a Cisco device doing authentication for L2TP something is failing.
OK...
This is what my colleague who runs the network told me having looking at the debug info on the router side:
"PPP comes up and then the router tries to get an IP address. This messages 0.0.0.0 there is no address and request the local router to provide it. So basically it's not getting an address from the radius server"
Everyone blames the RADIUS server for everything. They're usually wrong.
When we test with NTRadPing we noticed that the output is slightly different if we authenticate against the v1 or v3 radius server:
radius 1 - not working Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\0x0a Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0x85K\0x97\0xd5jk\0x0b\0xefbN\0xac\0x12y\0x80.\0xda\0xb3\0xb1 Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3
radius 2 - working (differences in red)
The list strips HTML.
Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\n Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0xb0}=G\0xe7\0xe4\0x08\0xd1\\0xe4\0xax;\0x0d?\0x15\0xe4\0x8f\0xfe Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3
The only difference is the cisco-avpair, which ends in 0x0a or \n.
could this be related to our issue? Noticing the line return is different on the avpair line and the password is different, its stored in clear text in the DB.
The Tunnel-Password is encrypted in the RADIUS packet. It's supposed to be unreadable.
Currently a bit stumped. Can pass on the output of radiusd -X if the above isn't the key to the problem,
Update v3 to send a 0x0a as the final character of the Cisco-AVPair. But even that shouldn't make a difference. The two packets are identical, so far as how things *should* work. Alan DeKok.
On 2016-06-02 17:29:43, ALAN DEKOK wrote:
radius 1 - not working vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback _ 2003\0x0a _
_ radius 2 - working (differences in red)_ vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback _ 2003\n_
Update v3 to send a 0x0a as the final character of the Cisco-AVPair. But even that shouldn't make a difference.
The two packets are identical, so far as how things *should* work.
So sorry wasn't clear on my original email, the v3 is the one that sends the 0x0a and the v1 one sends \n. The field in MySQL has a \n so seems its being rewritten in v3. So is there anyway I can change this behavior so I get and identical packet for both?
thanks very much for replying!
Andy.
On Thu, Jun 02, 2016 at 06:04:18PM +0200, Andy Smith wrote:
On 2016-06-02 17:29:43, ALAN DEKOK wrote:
radius 1 - not working vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback _ 2003\0x0a _
_ radius 2 - working (differences in red)_ vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback _ 2003\n_
Update v3 to send a 0x0a as the final character of the Cisco-AVPair. But even that shouldn't make a difference.
The two packets are identical, so far as how things *should* work.
So sorry wasn't clear on my original email, the v3 is the one that sends the 0x0a and the v1 one sends \n. The field in MySQL has a \n so seems its being rewritten in v3. So is there anyway I can change this behavior so I get and identical packet for both?
In post-auth if (&reply:cisco-avpair =~ /^(.*)\\0x0a$/) { update reply { cisco-avpair := "%{1}\n" } } or that sort of idea. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 2016-06-02 18:54:06, Matthew Newton wrote:
In post-auth
if (&reply:cisco-avpair =~ /^(.*)\\0x0a$/) { update reply { cisco-avpair := "%{1}\n" } }
or that sort of idea.
Hi Matthew, thanks for the info! I've tested putting this code in the post-auth in sites-enabled/defaut but it doesn't seem to have any effect, have I done something wrong? thanks, Andy.
just to update the thread, I think we´ve excluded the possibility that the issue is anything to do with the carriage return character. We continue with the issue, whereby on freeradius 1.1.18 everything works but as soon as we switch to 3.0.11 the L2TP stops working. The logs from radiusd -X seem to indicate everything is working so still stumped. We are building a dedicated test server so we can investigate further, tho currently Im not sure what other tests we can do so any suggestions gratefully received, thanks, Andy.
On Jun 3, 2016, at 12:02 PM, Andy Smith <a.smith@ldex.co.uk> wrote:
just to update the thread, I think we´ve excluded the possibility that the issue is anything to do with the carriage return character.
We continue with the issue, whereby on freeradius 1.1.18 everything works but as soon as we switch to 3.0.11 the L2TP stops working. The logs from radiusd -X seem to indicate everything is working so still stumped. We are building a dedicated test server so we can investigate further, tho currently Im not sure what other tests we can do so any suggestions gratefully received,
Throw the NAS in the garbage and buy one that works. FreeRADIUS implements RADIUS correctly. If the NAS is incompatible with it, the NAS is broken. If it matters... send me PCAP files of 1.1.18 and 3.0.11 off-list. Use the shared secret "testing123". I'll take at the packets and see if there's anything unusual. But I doubt it. Alan DeKok.
participants (3)
-
Alan DeKok -
Andy Smith -
Matthew Newton