Hi All, Think I am seeing the Inner tunnel issue but I am simply passing through unless the inner tunnel config has changed, It appears to be the same as with the 2x. Just to clarify I never changed any settings from the default both in 2x and 3.0.4. No other errors on radius -X (fixed the warnings about client ipaddr being needed in clients) Connection receives request and ID's it then Invalid packet code 1 sent to a proxy port from home server x.x.x.x port 37438 - ID 124 : IGNORED Tried Commenting out the suffix and domain stuff in sites-enabled/inner-tunnel but that did not work either. Thoughts on things to try? Thanks, Brad
Hi,
No other errors on radius -X (fixed the warnings about client ipaddr being needed in clients)
Connection receives request and ID's it then
Invalid packet code 1 sent to a proxy port from home server x.x.x.x port 37438 - ID 124 : IGNORED
output of radiusd -X always handy - it shows us whats happening - also, whats your config? FR is waiting on port 1812 for authentication...you're pointing the client to that, yes? alan
On 09/24/2015 02:57 PM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
No other errors on radius -X (fixed the warnings about client ipaddr being needed in clients)
Connection receives request and ID's it then
Invalid packet code 1 sent to a proxy port from home server x.x.x.x port 37438 - ID 124 : IGNORED output of radiusd -X always handy - it shows us whats happening - also, whats your config? FR is waiting on port 1812 for authentication...you're pointing the client to that, yes?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hi Alan,
Yes all the hosts are pointing to the proxy port 1814 and allowed through the clients list and should be passing through the inner tunnel out the 1812 with the home servers list to the RSA servers. I have not checked the network between the proxy and the RSA servers yet, I'll do that in the morning, didn't think of it as an issue as I have 3 other proxies set up the same way. Difference with this one is Cent7 and FreeRadius 3.0.4, looking to upgrade. What specific configs did you want to see? default, proxy, inner-tunnel and radius? Thanks, Brad
Hi,
Yes all the hosts are pointing to the proxy port 1814 and allowed through the clients list and should be passing through the inner tunnel out the 1812 with the home servers list to the RSA servers.
all the hosts should be pointing to the RADIUS server authentication port which acts as the proxy - the proxy port isnt 'proxy this packet' if you will. alan
On Sep 25, 2015, at 3:35 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Yes all the hosts are pointing to the proxy port 1814 and allowed through the clients list and should be passing through the inner tunnel out the 1812 with the home servers list to the RSA servers.
That is 100% backwards. ALL of the documentation and examples make it clear that the clients send packets to port 1812.
all the hosts should be pointing to the RADIUS server authentication port which acts as the proxy - the proxy port isnt 'proxy this packet' if you will.
Exactly. Alan DeKok.
On 09/25/2015 07:15 AM, Alan DeKok wrote:
On Sep 25, 2015, at 3:35 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Yes all the hosts are pointing to the proxy port 1814 and allowed through the clients list and should be passing through the inner tunnel out the 1812 with the home servers list to the RSA servers. That is 100% backwards.
ALL of the documentation and examples make it clear that the clients send packets to port 1812.
all the hosts should be pointing to the RADIUS server authentication port which acts as the proxy - the proxy port isnt 'proxy this packet' if you will. Exactly.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hi Alan and Alan,
Thanks for the clarification and I am moving the ports around and will test. Thanks again for the help and have a great weekend. Brad
On Sep 24, 2015, at 2:06 PM, Brad <bradzynda42@comcast.net> wrote:
Think I am seeing the Inner tunnel issue but I am simply passing through unless the inner tunnel config has changed, It appears to be the same as with the 2x. Just to clarify I never changed any settings from the default both in 2x and 3.0.4.
Either you *did* make a change, or the home server is broken.
No other errors on radius -X (fixed the warnings about client ipaddr being needed in clients)
Connection receives request and ID's it then
Invalid packet code 1 sent to a proxy port from home server x.x.x.x port 37438 - ID 124 : IGNORED
Why is the home server sending an Access-Request to the proxy port? That makes *zero* sense.
Tried Commenting out the suffix and domain stuff in sites-enabled/inner-tunnel but that did not work either.
Changing the proxy RADIUS configuration won't fix the home server. What are you using for a home server? And what is the FULL debug log? Posting pieces of the debug log can hide local misconfigurations. Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Brad