I've setup a NAS client that being a cisco7301 and have entered this into clients.conf. When I run radiusd -X and do the following radtest eftel-test test123 27.34.225.253 1812 testing123, it fails, I don't get anything appearing on my debug radiusd -X screen. If I change the clients.conf back to the localhost client and do radtest eftel-test test123 27.34.225.33 1812 testing123 I get the below. 27.34.225.33 is the IP of my radius box. I'm pretty sure I'm doing something wrong or missing something, but would appreciate your help in telling me what I need to do Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. The NAS table has the following entry mysql> select * from nas; +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ | 2 | cisco7301 | C7301 | cisco | 1812 | ivox-radius | IVOX-RO | | +----+-----------+-----------+-------+-------+-------------+-----------+-------------+ 1 row in set (0.00 sec) My iptables firewall is disabled. [root@radius raddb]# netstat -antup | grep rad tcp 0 0 27.34.225.33:54306 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54307 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54310 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54308 27.34.225.33:3306 ESTABLISHED 4605/radiusd tcp 0 0 27.34.225.33:54309 27.34.225.33:3306 ESTABLISHED 4605/radiusd udp 0 0 0.0.0.0:1812 0.0.0.0:* 4605/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 4605/radiusd udp 0 0 0.0.0.0:1814 0.0.0.0:* 4605/radiusd Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.
On Mon, May 7, 2012 at 2:08 PM, Shawky Skaff <shawkys@ivox.com.au> wrote:
I’ve setup a NAS client that being a cisco7301 and have entered this into clients.conf. When I run radiusd –X and do the following radtest eftel-test test123 27.34.225.253 1812 testing123, it fails, I don’t get anything appearing on my debug radiusd –X screen.
The usual suspect would be firewall (e.g. iptables). Try disabling it temporarily, and make sure basic connectivity (e.g. ping) works. -- Fajar
IP tables is disabled and I can ping the NAS server bring the Radius client - Cisco 7301 successfully Is there anything else that I can check? -----Original Message----- From: freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org [mailto:freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Monday, 7 May 2012 5:21 PM To: FreeRadius users mailing list Subject: Re: NAS Client On Mon, May 7, 2012 at 2:08 PM, Shawky Skaff <shawkys@ivox.com.au> wrote:
I've setup a NAS client that being a cisco7301 and have entered this into clients.conf. When I run radiusd -X and do the following radtest eftel-test test123 27.34.225.253 1812 testing123, it fails, I don't get anything appearing on my debug radiusd -X screen.
The usual suspect would be firewall (e.g. iptables). Try disabling it temporarily, and make sure basic connectivity (e.g. ping) works. -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, May 7, 2012 at 2:24 PM, Shawky Skaff <shawkys@ivox.com.au> wrote:
IP tables is disabled and I can ping the NAS server bring the Radius client - Cisco 7301 successfully
Is there anything else that I can check?
Sorry, my fault, I didn't read your message thoroughly :)
From your logs:
Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242 Ready to process requests. It pretty much says it all: the client is unknown. I suggest you start testing by putting the NAS in clients.conf first, since it's easier to debug. After that works, then try using nas table. Remove the entry from clients.conf, uncomment "readclients" from sql.conf, and verify that is read on debug log. -- Fajar
Hi, On 07.05.2012 09:08, Shawky Skaff wrote:
Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242
please correct your nas-entry (ip-addr should be in the field nasname) and read_clients set to yes.. -- Jens Weibler IT-Services Hochschule Darmstadt www.h-da.de University of Applied Sciences Fachbereich Informatik www.fbi.h-da.de Schöfferstr. 8b D-64295 Darmstadt Tel +49 6151 16-8425 Fax +49 6151 16-8935 jens.weibler@h-da.de
Thanks for that, debug is now reading the client as per below. rlm_sql (sql): Read entry nasname=27.34.225.253,shortname=cisco7301,secret=XXXXXX rlm_sql (sql): Adding client 27.34.225.253 (cisco7301, server=<none>) to clients list However still don't get any output when I run radtest from another window. radtest eftel-test test123 27.34.225.253 1812 testing123. What I do get is below [root@radius raddb]# radtest eftel-test test123 27.34.225.253 1812 testing123 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 radclient: no response from server for ID 156 socket 3 What I don't understand is it's saying the NAS-IP-Address = 27.34.225.33, shouldn't this be 27.34.225.253? If so, how do I fix it? -----Original Message----- From: freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org [mailto:freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org] On Behalf Of Jens Weibler Sent: Monday, 7 May 2012 5:45 PM To: freeradius-users@lists.freeradius.org Subject: Re: NAS Client Hi, On 07.05.2012 09:08, Shawky Skaff wrote:
Ignoring request to authentication address * port 1812 from unknown client 27.34.225.33 port 60242
please correct your nas-entry (ip-addr should be in the field nasname) and read_clients set to yes.. -- Jens Weibler IT-Services Hochschule Darmstadt www.h-da.de University of Applied Sciences Fachbereich Informatik www.fbi.h-da.de Schöfferstr. 8b D-64295 Darmstadt Tel +49 6151 16-8425 Fax +49 6151 16-8935 jens.weibler@h-da.de
On Tue, May 8, 2012 at 6:50 AM, Shawky Skaff <shawkys@ivox.com.au> wrote:
Thanks for that, debug is now reading the client as per below.
rlm_sql (sql): Read entry nasname=27.34.225.253,shortname=cisco7301,secret=XXXXXX rlm_sql (sql): Adding client 27.34.225.253 (cisco7301, server=<none>) to clients list
However still don't get any output when I run radtest from another window. radtest eftel-test test123 27.34.225.253 1812 testing123. What I do get is below
[root@radius raddb]# radtest eftel-test test123 27.34.225.253 1812 testing123 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 radclient: no response from server for ID 156 socket 3
What I don't understand is it's saying the NAS-IP-Address = 27.34.225.33, shouldn't this be 27.34.225.253? If so, how do I fix it?
NAS-IP-Address is whatever the client decides to send. With radclient/radtest, it's whatever the IP address that resolves to the client's hostname (usually in client's /etc/hosts). What does the debug log on the server says when the client sends those packets? Does it say unknown client, or it doesn't print anything (in other words, it might be blocked by firewall or something)? -- Fajar
My etc/hosts file contains the following # Do not remove the following line, or various programs # that require network functionality will fail. 127.0.0.1 localhost.localdomain localhost 27.34.225.33 radius radius ::1 localhost6.localdomain6 localhost6 When I run radiusd -X and radtest on another screen, on the radiusd -X debug it doesn't print anything, the last lines say ready to process requests, that's it My iptables have been turned off, so don't think it's firewall -----Original Message----- From: freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org [mailto:freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Tuesday, 8 May 2012 10:45 AM To: FreeRadius users mailing list Subject: Re: NAS Client On Tue, May 8, 2012 at 6:50 AM, Shawky Skaff <shawkys@ivox.com.au> wrote:
Thanks for that, debug is now reading the client as per below.
rlm_sql (sql): Read entry nasname=27.34.225.253,shortname=cisco7301,secret=XXXXXX rlm_sql (sql): Adding client 27.34.225.253 (cisco7301, server=<none>) to clients list
However still don't get any output when I run radtest from another window. radtest eftel-test test123 27.34.225.253 1812 testing123. What I do get is below
[root@radius raddb]# radtest eftel-test test123 27.34.225.253 1812 testing123 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 Sending Access-Request of id 156 to 27.34.225.253 port 1812 User-Name = "eftel-test" User-Password = "test123" NAS-IP-Address = 27.34.225.33 NAS-Port = 1812 radclient: no response from server for ID 156 socket 3
What I don't understand is it's saying the NAS-IP-Address = 27.34.225.33, shouldn't this be 27.34.225.253? If so, how do I fix it?
NAS-IP-Address is whatever the client decides to send. With radclient/radtest, it's whatever the IP address that resolves to the client's hostname (usually in client's /etc/hosts). What does the debug log on the server says when the client sends those packets? Does it say unknown client, or it doesn't print anything (in other words, it might be blocked by firewall or something)? -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, May 8, 2012 at 7:44 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, May 8, 2012 at 6:50 AM, Shawky Skaff <shawkys@ivox.com.au> wrote:
Thanks for that, debug is now reading the client as per below.
rlm_sql (sql): Read entry nasname=27.34.225.253,shortname=cisco7301,secret=XXXXXX rlm_sql (sql): Adding client 27.34.225.253 (cisco7301, server=<none>) to clients list
However still don't get any output when I run radtest from another window. radtest eftel-test test123 27.34.225.253 1812 testing123. What I do get is below
Reading your mail again, I think you're confusing something. Are you running radtest on the RADIUS SERVER and sending access-request packets to the NAS (i.e. cisco)? It doesn't work that way. radtest and radclient is just another NAS. NAS sends access-request packets to radius server, not the other way around. -- Fajar
Ok I see, if I wanted to test a user on the radius client (cisco), am I not able to use radtest? Sorry if the questions seem silly, I'm new to this -----Original Message----- From: freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org [mailto:freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Tuesday, 8 May 2012 11:18 AM To: FreeRadius users mailing list Subject: Re: NAS Client On Tue, May 8, 2012 at 7:44 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, May 8, 2012 at 6:50 AM, Shawky Skaff <shawkys@ivox.com.au> wrote:
Thanks for that, debug is now reading the client as per below.
rlm_sql (sql): Read entry nasname=27.34.225.253,shortname=cisco7301,secret=XXXXXX rlm_sql (sql): Adding client 27.34.225.253 (cisco7301, server=<none>) to clients list
However still don't get any output when I run radtest from another window. radtest eftel-test test123 27.34.225.253 1812 testing123. What I do get is below
Reading your mail again, I think you're confusing something. Are you running radtest on the RADIUS SERVER and sending access-request packets to the NAS (i.e. cisco)? It doesn't work that way. radtest and radclient is just another NAS. NAS sends access-request packets to radius server, not the other way around. -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, May 8, 2012 at 8:24 AM, Shawky Skaff <shawkys@ivox.com.au> wrote:
Ok I see, if I wanted to test a user on the radius client (cisco), am I not able to use radtest?
If by "test user" you mean "you've created a user on db/users file, and want to test if the user is correctly setup (e.g.whether the password is correct)", then you can use radtest to localhost. By default 127.0.0.1 is already setup as client NAS on clients.conf. Note that it doesn't really have anything to do with "cisco": the same user will be usable on any NAS that authenticates to the radius server. If by "test user" you mean you want to check whether the cisco box is setup correctly, and whether you can login on that NAS, then you can't use radtest. You need to actually login on that NAS (e.g. using 802.1x wired/wireless, or whatever). -- Fajar
Ok, no problem, I understand. Finally when I go to the 'check server' page on the dialup admin page, what am I meant to see? The only thing I see is below Tuesday, 8 May 2012, 11:28:20 EST Server: radius:1812 (test user test) -----Original Message----- From: freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org [mailto:freeradius-users-bounces+shawkys=ivox.com.au@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Tuesday, 8 May 2012 11:40 AM To: FreeRadius users mailing list Subject: Re: NAS Client On Tue, May 8, 2012 at 8:24 AM, Shawky Skaff <shawkys@ivox.com.au> wrote:
Ok I see, if I wanted to test a user on the radius client (cisco), am I not able to use radtest?
If by "test user" you mean "you've created a user on db/users file, and want to test if the user is correctly setup (e.g.whether the password is correct)", then you can use radtest to localhost. By default 127.0.0.1 is already setup as client NAS on clients.conf. Note that it doesn't really have anything to do with "cisco": the same user will be usable on any NAS that authenticates to the radius server. If by "test user" you mean you want to check whether the cisco box is setup correctly, and whether you can login on that NAS, then you can't use radtest. You need to actually login on that NAS (e.g. using 802.1x wired/wireless, or whatever). -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Fajar A. Nugraha -
Jens Weibler -
Shawky Skaff