Error: rlm_eap: No EAP session matching the State variable.
Hi, I am using latest freeradius server (version 2.1.8). I have two authenticated sessions established with radius server and when disable and reenable the dot1x sessions, then I am seeing the following error and one request is getting Reject message from the server. Info: Found Auth-Type = EAP Info: +- entering group authenticate {...} Error: rlm_eap: No EAP session matching the State variable. Info: [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request Info: [eap] Failed in handler Info: ++[eap] returns invalid I have seen the archive and found there are some old issues related to this error. Is it a known issue in radius server or what is the root cause of it. I have attached radius server failure log messages Thanks in advance ! Cheers Rupesh
Rupesh Kumar wrote:
I am using latest freeradius server (version 2.1.8).
Which AP && supplicant (client PC) are you using?
I have two authenticated sessions established with radius server and when disable and reenable the dot1x sessions, then I am seeing the following error and one request is getting Reject message from the server. ... Is it a known issue in radius server or what is the root cause of it.
The supplicant and/or the Access Point is broken.
I have attached radius server failure log messages
The supplicant starts EAP, and the server responds with a request for EAP-TLS. The supplicant NAKs it, and asks for EAP-MD5. The server responds with EAP-MD5. The supplicant then responds with a NAK for EAP-MD5. This packet from the AP contains the *old* State variable from the previous NAK. A close look at the packet traces shows that either the supplicant is re-using the old NAK (and confusing the AP), or the AP is re-using an old packet (and confusing the supplicant). Either way, the packet traces on the server show that the server is behaving correctly. The error message about "no matching state" is because the server has moved on to the *next* step of EAP, and it receives a packet from the *previous* step. So there really is "no matching state". Try using another supplicant and/or AP. You won't be able to fix this by editing the server configuration. Alan DeKok.
I have attached radius server failure log messages
The supplicant starts EAP, and the server responds with a request for EAP-TLS. The supplicant NAKs it, and asks for EAP-MD5. The server responds with EAP-MD5.
The supplicant then responds with a NAK for EAP-MD5. This packet from the AP contains the *old* State variable from the previous NAK.
A close look at the packet traces shows that either the supplicant is re-using the old NAK (and confusing the AP), or the AP is re-using an old packet (and confusing the supplicant).
Either way, the packet traces on the server show that the server is behaving correctly. The error message about "no matching state" is because the server has moved on to the *next* step of EAP, and it receives a packet from the *previous* step. So there really is "no matching state".
Try using another supplicant and/or AP. You won't be able to fix this by editing the server configuration.
Alan DeKok.
Thanks Alan, I got the problem. The Access point was corrupting the state variable and sending same state for both the sessions. Thanks Rupesh
hello.. he wanted to know if they can help me with the configuration of a servant radius in centus 5, what happens is that I am beginner in this. already and installed the system centus, the packages radius and openssl that biene in the dvd of intalacion of the centus, configure the radius files eap.config, radiusd.config, client.config and user, but when lifting the servant it leaves me failure when lifting the service. the authentification way that I am using is eap-peap with the incriptacion wpa2 aes. here sends them the files that it configures. Atentamente: Marco Zamora Date: Mon, 12 Apr 2010 10:07:26 +0530 Subject: Error: rlm_eap: No EAP session matching the State variable. From: a.rupesh.k@gmail.com To: freeradius-users@lists.freeradius.org Hi, I am using latest freeradius server (version 2.1.8). I have two authenticated sessions established with radius server and when disable and reenable the dot1x sessions, then I am seeing the following error and one request is getting Reject message from the server. Info: Found Auth-Type = EAP Info: +- entering group authenticate {...} Error: rlm_eap: No EAP session matching the State variable. Info: [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request Info: [eap] Failed in handler Info: ++[eap] returns invalid I have seen the archive and found there are some old issues related to this error. Is it a known issue in radius server or what is the root cause of it. I have attached radius server failure log messages Thanks in advance ! Cheers Rupesh _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&...
participants (3)
-
Alan DeKok -
marco zamora -
Rupesh Kumar