IPv6 coa isn't working having IPv6 NAS IP
Hi Experts, I need your help and expertise with pushing ipv6 coa on the 802.1x sessions. UUT (Switch) and Freeradius are directly connected and can ping each other. Freeradius installed: [root@ott-freerad-7a raddb]# radiusd -X radiusd: FreeRADIUS Version 2.2.8, for host x86_64-unknown-linux-gnu, built on Jul 15 2015 at 13:42:04 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Issue: [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco radclient: Failed to find IP address for host 2020::11:1700: Success COA push works for IPv4 NAS IP but shows above for IPv6 case. Really appreciate your help with the issue. I am not sure if IPv6 coa push is supported yet with 2.2.8 freeradius version. [root@ott-freerad-7a raddb]# more coa Calling-Station-Id="c414.3c52.900e" Acct-Session-Id="0x0000000b" Cisco-Command-Code=" TEMP_IAF100" [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco [root@ott-freerad-7a raddb]# ifconfig eth0 Link encap:Ethernet HWaddr 00:50:56:8E:78:33 inet addr:172.16.7.11 Bcast:172.16.255.255 Mask:255.255.0.0 inet6 addr: fe80::250:56ff:fe8e:7833/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:80804 errors:0 dropped:0 overruns:0 frame:0 TX packets:20649 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:14539074 (13.8 MiB) TX bytes:3061296 (2.9 MiB) eth1 Link encap:Ethernet HWaddr 00:50:56:8E:5F:BB inet addr:99.0.7.12 Bcast:99.0.7.255 Mask:255.255.255.0 inet6 addr: 2020::250:56ff:fe8e:5fbb/64 Scope:Global inet6 addr: fe80::250:56ff:fe8e:5fbb/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:47806 errors:0 dropped:0 overruns:0 frame:0 TX packets:138 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:3463175 (3.3 MiB) TX bytes:17024 (16.6 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:936 errors:0 dropped:0 overruns:0 frame:0 TX packets:936 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:66843 (65.2 KiB) TX bytes:66843 (65.2 KiB) [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# ping6 2020::11 PING 2020::11(2020::11) 56 data bytes 64 bytes from 2020::11: icmp_seq=0 ttl=64 time=11.4 ms 64 bytes from 2020::11: icmp_seq=1 ttl=64 time=1.52 ms --- 2020::11 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 999ms rtt min/avg/max/mdev = 1.521/6.463/11.405/4.942 ms, pipe 2 [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# uname -a Linux ott-freerad-7a 2.6.18-194.8.1.el5 #1 SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux [root@ott-freerad-7a raddb]# On UUT: Router#show run int gig2/0/15 Building configuration... Current configuration : 108 bytes ! interface GigabitEthernet2/0/15 no switchport no ip address ipv6 address 2020::11/64 ipv6 enable end Router# Router# Router# Router# Router# Router# Router# Router#show access-sess Interface MAC Address Method Domain Status Fg Session ID -------------------------------------------------------------------------------------------- GigabitEthernet2/0/14 c414.3c52.900e dot1x DATA Auth 000000000000001706794990 Session count = 1 Key to Session Events Blocked Status Flags: A - Applying Policy (multi-line status for details) D - Awaiting Deletion F - Final Removal in progress I - Awaiting IIF ID allocation P - Pushed Session R - Removing User Profile (multi-line status for details) U - Applying User Profile (multi-line status for details) X - Unknown Blocker Router# Router#show access-sess poli Router#show access-sess inter Router#show access-sess interface gig2/0/14 polic Router#show access-sess interface gig2/0/14 policy Interface : GigabitEthernet2/0/14 MAC Address : c414.3c52.900e IPv6 Addres : Unknown IPv4 Addres : Unknown User-Name : client1 Status : Authorized Domain : DATA Oper host mode : multi-host Oper control dir : both Session timeout : N/A Timeout action : Reauthenticate Idle timeout : N/A Common Session ID : 000000000000001706794990 Acct Session ID : 0x0000000b Handle : 0x3c00000d Current Policy : DUAL Blocked On : Method status list: Method State dot1x Authc Success Device Classification Status: ------------------------------------------------------------------------------- Profile Device-Name Device-Class ------------------------------------------------------------------------------- Un Classified Un-Classified Un-Classified
On Jul 17, 2015, at 9:47 PM, Samir Patel <samir198@gmail.com> wrote:
[root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco radclient: Failed to find IP address for host 2020::11:1700: Success
2020::11:1700 isn't a valid IPv6 address. You have to use the standard IPv6 address format. Just 2020::11, or with a port, [2020::11]:1700 Alan DeKok.
Hi Alan, Thanks for looking into this. I tried to push the coa the way you suggested but seems like I am still missing something in the syntax to specify the IPv6 address. radclient is failing to find the IPv6 address same as in my previous attempts. Please see below: [root@ott-freerad-7a raddb]# ping6 2020::10 PING 2020::10(2020::10) 56 data bytes 64 bytes from 2020::10: icmp_seq=0 ttl=64 time=2.97 ms 64 bytes from 2020::10: icmp_seq=1 ttl=64 time=1.37 ms --- 2020::10 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1000ms rtt min/avg/max/mdev = 1.378/2.175/2.973/0.798 ms, pipe 2 [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa *2020::10* coa cisco radclient: Failed to find IP address for host* 2020::10:* Success [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa *[2020::10]:1700* coa cisco radclient: Failed to find IP address for host *2020::10:* Success [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# radiusd -X radiusd: FreeRADIUS Version 2.2.8, for host x86_64-unknown-linux-gnu, built on Jul 15 2015 at 13:42:04 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Thanks, Samir. On Sat, Jul 18, 2015 at 2:41 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 17, 2015, at 9:47 PM, Samir Patel <samir198@gmail.com> wrote:
[root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco radclient: Failed to find IP address for host 2020::11:1700: Success
2020::11:1700 isn't a valid IPv6 address.
You have to use the standard IPv6 address format. Just 2020::11, or with a port, [2020::11]:1700
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 20, 2015, at 6:53 PM, Samir Patel <samir198@gmail.com> wrote:
[root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa *2020::10* coa cisco radclient: Failed to find IP address for host* 2020::10:* Success [root@ott-freerad-7a raddb]#
Try /usr/local/bin/radclient -x -t 20 -c 1 -p 2 -f /usr/local/etc/raddb/coa -6 2020::10 coa cisco
Hi Alan, The solution you provided has worked like a charm. I really appreciate your help. Thank you very much for all the prompt help as well. Regards, Samir. On Mon, Jul 20, 2015 at 12:57 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 20, 2015, at 6:53 PM, Samir Patel <samir198@gmail.com> wrote:
[root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa *2020::10* coa cisco radclient: Failed to find IP address for host* 2020::10:* Success [root@ott-freerad-7a raddb]#
Try /usr/local/bin/radclient -x -t 20 -c 1 -p 2 -f /usr/local/etc/raddb/coa -6 2020::10 coa cisco - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 20, 2015, at 2:02 PM, Samir Patel <samir198@gmail.com> wrote:
Hi Alan,
The solution you provided has worked like a charm.
I really appreciate your help.
Thank you very much for all the prompt help as well.
Weird, that should work automatically. Radclient hadn't been modified to use the fr_pton* series of functions, and was using some old logic. Moving it to using fr_pton_port (slightly modified to support -4 -6), things seem to work ok: crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1]:1813 auth testing123 Sent Access-Request Id 88 from [::]:64852 to [::1]:1813 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1]:1812 auth testing123 Sent Access-Request Id 223 from [::]:63771 to [::1]:1812 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1] auth testing123 Sent Access-Request Id 99 from [::]:61089 to [::1]:1812 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient ::1 auth testing123 Sent Access-Request Id 183 from [::]:62479 to [::1]:1812 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient 127.0.0.1:1813 auth testing123 Sent Access-Request Id 176 from 0.0.0.0:58690 to 127.0.0.1:1813 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient 127.0.0.1 auth testing123 Sent Access-Request Id 92 from 0.0.0.0:60291 to 127.0.0.1:1812 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient 127.0.0.1:1812 auth testing123 Sent Access-Request Id 35 from 0.0.0.0:61014 to 127.0.0.1:1812 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient google.com:1813 auth testing123 Sent Access-Request Id 188 from 0.0.0.0:64130 to 74.125.226.101:1813 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -6 google.com:1813 auth testing123 Sent Access-Request Id 71 from [::]:49345 to [2607:f8b0:400b:80a::1002]:1813 length 25 echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -4 google.com:1813 auth testing123 Sent Access-Request Id 121 from 0.0.0.0:58580 to 74.125.226.98:1813 length 25 crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -4 [google.com]:1813 auth testing123 radclient: Failed to parse IPv6 address string "google.com" echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -4 ::1:1813 auth testing123 (0) Failed to send packet for ID 51: sendto failed: No route to host echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1]: auth testing123 radclient: Port 0 outside valid port range 1-65535 (I guess that could use a better message) I also fixed the address printing code to surround v6 addresses in brackets :) -Arran
My issue is resolved but just adding further details: [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa -6 [2020::10]:1700 coa cisco Sending CoA-Request of id 76 to 2020::10 port 1700 Calling-Station-Id = "c414.3c52.900e" Acct-Session-Id = "0x00000FAA" Cisco-AVPair += "subscriber:command=reauthenticate" rad_recv: CoA-ACK packet from host 2020::10 port 1700, id=76, length=42 Calling-Station-Id = "c414.3c52.900e" Error-Cause = 200 [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa [2020::10]:1700 coa cisco radclient: Failed to find IP address for host 2020::10: Success [root@ott-freerad-7a raddb]# Cheers, Samir. On Mon, Jul 20, 2015 at 2:26 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On Jul 20, 2015, at 2:02 PM, Samir Patel <samir198@gmail.com> wrote:
Hi Alan,
The solution you provided has worked like a charm.
I really appreciate your help.
Thank you very much for all the prompt help as well.
Weird, that should work automatically. Radclient hadn't been modified to use the fr_pton* series of functions, and was using some old logic.
Moving it to using fr_pton_port (slightly modified to support -4 -6), things seem to work ok:
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1]:1813 auth testing123 Sent Access-Request Id 88 from [::]:64852 to [::1]:1813 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1]:1812 auth testing123 Sent Access-Request Id 223 from [::]:63771 to [::1]:1812 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1] auth testing123 Sent Access-Request Id 99 from [::]:61089 to [::1]:1812 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient ::1 auth testing123 Sent Access-Request Id 183 from [::]:62479 to [::1]:1812 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient 127.0.0.1:1813 auth testing123 Sent Access-Request Id 176 from 0.0.0.0:58690 to 127.0.0.1:1813 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient 127.0.0.1 auth testing123 Sent Access-Request Id 92 from 0.0.0.0:60291 to 127.0.0.1:1812 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient 127.0.0.1:1812 auth testing123 Sent Access-Request Id 35 from 0.0.0.0:61014 to 127.0.0.1:1812 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient google.com:1813 auth testing123 Sent Access-Request Id 188 from 0.0.0.0:64130 to 74.125.226.101:1813 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -6 google.com:1813 auth testing123 Sent Access-Request Id 71 from [::]:49345 to [2607:f8b0:400b:80a::1002]:1813 length 25
echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -4 google.com:1813 auth testing123 Sent Access-Request Id 121 from 0.0.0.0:58580 to 74.125.226.98:1813 length 25
crashant:freeradius-server-fork arr2036$ echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -4 [google.com]:1813 auth testing123 radclient: Failed to parse IPv6 address string "google.com"
echo "User-Name == foo" | /usr/local/freeradius/bin/radclient -4 ::1:1813 auth testing123 (0) Failed to send packet for ID 51: sendto failed: No route to host
echo "User-Name == foo" | /usr/local/freeradius/bin/radclient [::1]: auth testing123 radclient: Port 0 outside valid port range 1-65535
(I guess that could use a better message)
I also fixed the address printing code to surround v6 addresses in brackets :)
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 21, 2015, at 2:29 PM, Samir Patel <samir198@gmail.com> wrote:
My issue is resolved but just adding further details:
[root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa -6 [2020::10]:1700 coa cisco Sending CoA-Request of id 76 to 2020::10 port 1700 Calling-Station-Id = "c414.3c52.900e" Acct-Session-Id = "0x00000FAA" Cisco-AVPair += "subscriber:command=reauthenticate" rad_recv: CoA-ACK packet from host 2020::10 port 1700, id=76, length=42 Calling-Station-Id = "c414.3c52.900e" Error-Cause = 200 [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa [2020::10]:1700 coa cisco radclient: Failed to find IP address for host 2020::10: Success [root@ott-freerad-7a raddb]#
That works fine in v3.0.x and v3.1.x and v2.x.x is EOL now, so there's nothing we're going to do to fix that. -Arran
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Samir Patel