unexpected radius packets
NAS are Colubris cn3200; they are periodically logging events like the following: warning iprulesmgr Received unexpected RADIUS packet (id='56') from RADIUS Server (ip-address='65.xxx.xxx.x',port='1812') I have run a capture on the interface (server) and see that the packet with this id is an access-reject(3) in response to a request. Can someone help me with debugging why the NAS is logging this as unexpected? It is recording the reject prior to the unexpected event. From the capture I see that there was only 1 packet (id56) returned. I am pretty unfamiliar with reading captures, but I do have the saved files if more info is needed. Regards, Andrew
Dear folks... I do need some example and explanation about how to used the following attributes : + session-time + login-time + called-station-id Is the above attributes need some configuration script on radiusd.conf? I do try to used : +----+----------+-----------------+----+-------------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+-------------------+ | 11 | demo | Auth-Type | := | Local | | 12 | demo | Password | == | 123456 | | 39 | demo | Login-Time | == | Mo-Sa1900-0800|Su | | 42 | demo | Session-Timeout | == | 1800 | +----+----------+-----------------+----+-------------------+ and the consequense... user can not login... TIA Paul
Login-Time should have operator := Session-Timeout is a reply attribute, so it shouldn't be there at all. It should be in radreply or radgroupreply table. Ivan Kalik Kalik Informatika ISP Dana 8/6/2007, "PD" <paul@ranahminang.net> piše:
Dear folks...
I do need some example and explanation about how to used the following attributes : + session-time + login-time + called-station-id
Is the above attributes need some configuration script on radiusd.conf?
I do try to used : +----+----------+-----------------+----+-------------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+-------------------+ | 11 | demo | Auth-Type | := | Local | | 12 | demo | Password | == | 123456 | | 39 | demo | Login-Time | == | Mo-Sa1900-0800|Su | | 42 | demo | Session-Timeout | == | 1800 | +----+----------+-----------------+----+-------------------+
and the consequense... user can not login...
TIA
Paul
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear Paul, (please don't hijack other people's threads - start a new one!)
I do need some example and explanation about how to used the following attributes :
+ session-time
You mean Session-Timeout?
+ login-time + called-station-id
Is the above attributes need some configuration script on radiusd.conf?
All supported natively.
I do try to used : +----+----------+-----------------+----+-------------------+
| id | UserName | Attribute | op | Value |
+----+----------+-----------------+----+-------------------+
| 11 | demo | Auth-Type | := | Local |
Don't set Auth-Type. This mantra is used very frequently on this list! Delete this line.
| 12 | demo | Password | == | 123456 |
The operator should be :=, not ==. You didn't report which FreeRADIUS version you are using, in any case the name of the attribute is wrong: prior to version 1.1.6, the Attribute "User-Password" was supposed to be used, since 1.1.6 it is "Cleartext-Password".
| 39 | demo | Login-Time | == | Mo-Sa1900-0800|Su |
I've never seen this syntax for specifying Login-Time before. Where did you get that from? It looks very odd in a radcheck table...
| 42 | demo | Session-Timeout | == | 1800 |
Here as well, I think the operator must be := not ==.
and the consequense... user can not login...
Given that almost every line in your output above has flaws, this doesn't really surprise me. Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
(please don't hijack other people's threads - start a new one!)
I though... I just hit reply and change the subject... cause... I cann't remember the list address as I subscribe for some others too.
I do need some example and explanation about how to used the following attributes :
+ session-time
You mean Session-Timeout?
yeah... sorry for typo.. I just found it by myself.. it should put it radreply table, not radcheck.
+ login-time + called-station-id
Is the above attributes need some configuration script on radiusd.conf?
All supported natively.
Thx.. but I still can not find how to use login-time. :(
I do try to used : +----+----------+-----------------+----+-------------------+
| id | UserName | Attribute | op | Value |
+----+----------+-----------------+----+-------------------+
| 11 | demo | Auth-Type | := | Local |
Don't set Auth-Type. This mantra is used very frequently on this list! Delete this line. Hm... why ? I though FR will see password user at /etc/password if we don't define local. Also... I need to change this Auth-Type value become Reject if we need to block this user for some reason.
| 12 | demo | Password | == | 123456 |
The operator should be :=, not ==.
I read some thread regarding this.. and tried them. In my case... user can not login if I change operator become :=
You didn't report which FreeRADIUS version you are using, in any case the name of the attribute is wrong: prior to version 1.1.6, the Attribute "User-Password" was supposed to be used, since 1.1.6 it is "Cleartext-Password".
Just check it out... Freeradius 1.1.4
| 39 | demo | Login-Time | == | Mo-Sa1900-0800|Su |
I've never seen this syntax for specifying Login-Time before. Where did you get that from? It looks very odd in a radcheck table...
Hm... see http://www.freeradius.org/radiusd/doc/README you can find the example of Login-Time attribute.
| 42 | demo | Session-Timeout | == | 1800 |
Here as well, I think the operator must be := not ==.
will try later as it just work when I move it to radreply. Some other comments please.... TIA Paul
On 6/8/07, PD <paul@ranahminang.net> wrote:
(please don't hijack other people's threads - start a new one!)
I though... I just hit reply and change the subject...
That _is_ thread hijacking... threaded readers see embedded information in the header and aggregate your new topic with the old topic.
cause... I cann't remember the list address as I subscribe for some others too.
freeradius-users@lists.freeradius.org It's easy for me on gmail - start typing 'freeradius', and I'm offered the whole list address for completion. If you can't remember it, you could set up some sort of address book entry in whatever mailer you use, or just put a postit note on your monitor. There are many solutions to the "I can't remember it" problem. -ethan
PS. And value should be: Mo-Sa1900-0800,Su Ivan Kalik Kalik Informatika ISP Dana 8/6/2007, "PD" <paul@ranahminang.net> piše:
Dear folks...
I do need some example and explanation about how to used the following attributes : + session-time + login-time + called-station-id
Is the above attributes need some configuration script on radiusd.conf?
I do try to used : +----+----------+-----------------+----+-------------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+-------------------+ | 11 | demo | Auth-Type | := | Local | | 12 | demo | Password | == | 123456 | | 39 | demo | Login-Time | == | Mo-Sa1900-0800|Su | | 42 | demo | Session-Timeout | == | 1800 | +----+----------+-----------------+----+-------------------+
and the consequense... user can not login...
TIA
Paul
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thx Ivan, I just update radcheck and it seems to be work. | 39 | demo | Login-Time | := | Mo-Sa1900-0800,Su | Big Thanks :D Paul
On 6/8/2007, "PD" <paul@ranahminang.net> wrote:
Dear folks...
I do need some example and explanation about how to used the following attributes : + session-time + login-time + called-station-id
I got the answer myself by some try and error... but only for session-timeout and called-station-id + session-timeout is should be on radreply, not radcheck. it's working right now. + called-station-id is suppored natively on radcheck. Some pls help me for login-time attribute.. The FR used is version... wait... cd /usr/ports/net/freeradius.. open Makefile.. ah.. that it... portname freeradius, portversion 1.1.4 TIA Paul
PD wrote:
I got the answer myself by some try and error...
Why? What's wrong with the documentation that ships with FreeRADIUS?
but only for session-timeout and called-station-id
See the README's for documentation on Login-Time.
+ session-timeout is should be on radreply, not radcheck. it's working right now. + called-station-id is suppored natively on radcheck.
Read the documentation for rlm_sql. It explains how things work. It makes *no* sense to say "called-station-id is supported natively on radcheck". None. Saying that means you don't understand how the server works. The documentation explains this... Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (6)
-
Alan Dekok -
Andrew Long -
Ethan Dicks -
PD -
Stefan Winter -
tnt＠kalik.co.yu