PEAP Inner-tunnel can't match a user in the "users" file with some check attributes
Hi gents, I have an issue that whenever I have check attributes such as NAS-IP-Address or NAS-Port-Type, my PEAP fails... The same config works for MD5... I'm running FreeRADIUS Version 2.1.7. --- users --- "phone" User-Name =~ "phone", Cleartext-Password := "mykey", NAS-IP-Address == "10.143.115.14" Tunnel-Private-Group-Id := "654", Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", Tunnel-Preference := "0" All other configs are mostly default. Everything works once I removed NAS-IP-Address == "10.143.115.14". However I do need to check against from which switch/NAS the request is coming from... It seems that those attributes are outside of the "tunnel". How can I copy them in the "tunnel" (does this make sense to you guys)?? My debug output is attached. Thank you and have a good weekend! Difan
Difan Zhao wrote:
I have an issue that whenever I have check attributes such as NAS-IP-Address or NAS-Port-Type, my PEAP fails…
Read raddb/eap.conf. Look for "copy_request_to_tunnel"
Everything works once I removed *NAS-IP-Address == "10.143.115.14"*. However I do need to check against from which switch/NAS the request is coming from… It seems that those attributes are outside of the “tunnel”. How can I copy them in the “tunnel” (does this make sense to you guys)??
Read the configuration files. This is documented. Alan DeKok.
Absolutely no excuse... I should have read about it... Next time I will read more carefully. Anyway everything works now! Thank you very much Alan Dekok! Difan -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: November-19-11 1:37 AM To: FreeRadius users mailing list Subject: Re: PEAP Inner-tunnel can't match a user in the "users" file with some check attributes Difan Zhao wrote:
I have an issue that whenever I have check attributes such as NAS-IP-Address or NAS-Port-Type, my PEAP fails…
Read raddb/eap.conf. Look for "copy_request_to_tunnel"
Everything works once I removed *NAS-IP-Address == "10.143.115.14"*. However I do need to check against from which switch/NAS the request is coming from… It seems that those attributes are outside of the “tunnel”. How can I copy them in the “tunnel” (does this make sense to you guys)??
Read the configuration files. This is documented. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Difan Zhao