Hi Folks, I'm in the process to setup a WPA(2)-Enterprise (IEEE 802.1X) protected WLAN. I choose FreeRADIUS (2.1.10) with a EAP-TLS to authenticate and control the access to the network. While everything works so far, I just can't get the Session-Timeout to work. If I start 'freeradius -X' I can see that FreeRADIUS sends the Session-Timeout information with the Access-Accept message. Also if I limit the Login-Time (e.g. Login-Time := "Wk0000-1500") and the remaining time is less then the Session-Timeout, the remaining time is send as a Session-Timeout. Nevertheless, after the session times out, no reauthentication takes place and the client stays connected to the network. As this behavior happens with all (two) APs I've got, I'm not sure where to locate the problem.(FreeRADIUS, AP or Client (Debian Squeeze with wpa_supplicant)) Any idea how I could pinpoint the problem either from the FreeRADIUS or the client side? Thanks, Klaus
On Thu, Jul 26, 2012 at 04:08:04PM +0200, Klaus Klein wrote:
While everything works so far, I just can't get the Session-Timeout to work. ... Any idea how I could pinpoint the problem either from the FreeRADIUS or the client side?
If FreeRADIUS is sending the AVP back to the NAS (which you state it is), it's the job of the NAS (the AP) to disconnect the user at the specified time. The user will keep working until the NAS kicks them off. As the user isn't being disconnected, it's the NAS that needs investigating. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Am 26.07.2012 16:16, schrieb Matthew Newton:
On Thu, Jul 26, 2012 at 04:08:04PM +0200, Klaus Klein wrote:
While everything works so far, I just can't get the Session-Timeout to work. If FreeRADIUS is sending the AVP back to the NAS (which you state it is), it's the job of the NAS (the AP) to disconnect the user at the specified time. The user will keep working until the NAS kicks them off. As the user isn't being disconnected, it's the NAS that needs investigating. I was afraid it would go down that road. :-(
Any idea how I could pinpoint the problem either from the FreeRADIUS or the client side? I'm just tracing the wpa_supplicant and noticed a message "Cancelling authentication timeout" Unfortunately, it's not clear what or which side (AP or Client) is causing this message.
Is there any way a client could cancel a session timeout? Or why would a AP do so? Cheers, Klaus
Am 26.07.2012 17:20, schrieb Klaus Klein:
Am 26.07.2012 16:16, schrieb Matthew Newton:
On Thu, Jul 26, 2012 at 04:08:04PM +0200, Klaus Klein wrote:
While everything works so far, I just can't get the Session-Timeout to work. If FreeRADIUS is sending the AVP back to the NAS (which you state it is), it's the job of the NAS (the AP) to disconnect the user at the specified time. The user will keep working until the NAS kicks them off. As the user isn't being disconnected, it's the NAS that needs investigating. I was afraid it would go down that road. :-(
And it did. But not too far. A newer firmware (BETA, hmm...) fix the problem. Cheers, Klaus
Then AP probably doesn't "understand" Session-Timeout attribute... (not implemented for example) It would be helpful to tell us what are you using as AP.... On 26.7.2012 16:08, Klaus Klein wrote:
Hi Folks,
I'm in the process to setup a WPA(2)-Enterprise (IEEE 802.1X) protected WLAN.
I choose FreeRADIUS (2.1.10) with a EAP-TLS to authenticate and control the access to the network.
While everything works so far, I just can't get the Session-Timeout to work.
If I start 'freeradius -X' I can see that FreeRADIUS sends the Session-Timeout information with the Access-Accept message. Also if I limit the Login-Time (e.g. Login-Time := "Wk0000-1500") and the remaining time is less then the Session-Timeout, the remaining time is send as a Session-Timeout.
Nevertheless, after the session times out, no reauthentication takes place and the client stays connected to the network.
As this behavior happens with all (two) APs I've got, I'm not sure where to locate the problem.(FreeRADIUS, AP or Client (Debian Squeeze with wpa_supplicant))
Any idea how I could pinpoint the problem either from the FreeRADIUS or the client side?
Thanks, Klaus - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Am 26.07.2012 16:29, schrieb Marinko Tarlać:
Then AP probably doesn't "understand" Session-Timeout attribute... (not implemented for example)
It would be helpful to tell us what are you using as AP....
AP No.1 Netgear WG602v3 with dd-wrt v24_micro_generic.bin AP No.2 Siemens Gigaset SE515dsl Cheers, Klaus
participants (3)
-
Klaus Klein -
Marinko Tarlać -
Matthew Newton