Re: FreeRadius going through ISA to reach federation
Date: Fri, 16 Dec 2011 16:39:07 +0000 From: Phil Mayers <p.mayers@imperial.ac.uk> Subject: Re: FreeRadius going through ISA to reach federation To: freeradius-users@lists.freeradius.org Message-ID: <4EEB742B.50302@imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 16/12/11 14:29, Rui Ribeiro wrote:
Hi all,
I have configuring a FreeRadius, and I need to go through a IAS to reach the
Ugh. Nasty. IAS as an eduroam proxy!
Actually is just for testing, will talk with the responsible entity next week, but with the festivities at the door, roaming through IAS would probably allow me to switch to freeradius sooner.
eduroam federation. I created a realm for our local domain, created a DEFAULT proxy for users with other domains pointing to the IAS server, both are as clients of each other, share the same secret, and also defined a Remote access policy in IAS.
Tried already some alternatives, and inserted Reply-Message = "Yes", as suggested on another post in the list.
Eh? Who suggested that?
Another freeradius<->IAS thread in this list.
Despite all the efforts, when talking with the IAS, I receive back the error Proxy-State = 0x3137.
That's not an error; it's just a radius attribute.
In the debug logs, I have: ad_recv: Access-Reject packet from host 10.10.66.18 port 1812, id=251, length=24 Proxy-State = 0x3137
Any advice?
You will need to debug this on the IAS server, since it is sending (or proxying) the reject. My guess is the policies in IAS are wrong.
Tried to see the IAS logs, they didn't much sense. Will have a look at system events.
------------------------------
On 12/16/2011 09:20 PM, Rui Ribeiro wrote:
Eh? Who suggested that? Another freeradius<->IAS thread in this list.
Well, it's not a very useful suggestion in this instance. Setting Reply-Message won't magically make something work. Perhaps the original thread had some context that explains why the person thought it was useful at that juncture.
Despite all the efforts, when talking with the IAS, I receive back the error Proxy-State = 0x3137.
That's not an error; it's just a radius attribute.
In the debug logs, I have: ad_recv: Access-Reject packet from host 10.10.66.18 port 1812, id=251, length=24 Proxy-State = 0x3137
Yes, I know. What I'm trying to tell you is that "Proxy-State" is just a radius attribute related to proxying. It would be present in any packet, accept, challenge or reject, from the upstream server. Ignore the Proxy-State. What matters is that the "code" is Access-Reject. The upstream server either rejected the packet itself, or forwarded a reject from the wider eduroam proxy hierarchy.
Any advice?
You will need to debug this on the IAS server, since it is sending (or proxying) the reject. My guess is the policies in IAS are wrong.
Tried to see the IAS logs, they didn't much sense. Will have a look at system events.
Which version of "IAS" is this? i.e. which version of windows are you on? If you're on NPS (Win2k8 or Win2k8R2) then event viewer is where all the useful stuff is. Do you control the IAS/NPS server? I have (sadly) spent a bit of time with NPS learning how it works so I can explain its awfulness - if you want to contact me off-list with the policies & config, I'll take a look. Cheers, Phil
Hi,
In the debug logs, I have:Â ad_recv: Access-Reject packet from host 10.10.66.18 port 1812, id=251, length=24 Â Â Â ÂProxy-State = 0x3137
reject is reject - you need to check the logs of the IAS to see what it thought it was doing (event viewer - IAS events) - you may also need to ask the other end what they saw. a reject is usually a sign that things got proxie but the other end didnt like it (incorrect password, user not present, incorrect shared secrets which munged the packet.
Tried to see the IAS logs, they didn't much sense. Will have a look at system events.
what do you mean by 'didnt make much sense' ? what do they say? alan
participants (3)
-
Alan Buxey -
Phil Mayers -
Rui Ribeiro