Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950 I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap) The local tests are ok ! Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge Thanks, Rafael.
On Monday 08 August 2005 03:54, Rafael DiazMaurin wrote:
Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950
I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap)
The Cisco 2950 is the client (or NAS). Is it configured? XP is the supplicant. If the Cisco 2950 (client) doesn't require login, then the supplicant will simply connect without any authentication dialog.
The local tests are ok !
Then server is probably working just fine.
Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User
Don't set the Auth-Type in users file.
On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge
That is the supplicant. Now, configure the client. Zoltan
Thank you Zoltan, I made some modification but nothing changed. When I tested the configuration from with radping on the supplicant, it worked fine. But with my configuration md5, nothing occures at the radius server (no packets sent, no logs). I answer you at each point, and give the configurations on the client. Zoltan A. Ori a écrit :
On Monday 08 August 2005 03:54, Rafael DiazMaurin wrote:
Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950
I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap)
The Cisco 2950 is the client (or NAS). Is it configured?
Yes it's configured : IOS version : 12.1(22)EA4 General configuration : aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host IP-Adress auth-port 1812 acct-port 1813 key XXX radius-server retransmit 3 Here is the configuration of the port where the Supplicant (XP SP 2) is connected : interface FastEthernet0/2 description supplicant switchport access vlan XXX switchport mode access duplex full dot1x port-control auto dot1x timeout reauth-period 300 dot1x reauthentication spanning-tree portfast This switch is connected to another switch with a Trunk link, and another trunk link until the radius server. Here is the configuration of the port where the radius server is connected : interface FastEthernet2/11 description RadiusServer switchport access vlan 260 Do I need to configure the 2 last switchs with authentification dot1x ? I didn't configure anything on these switch, even the one where the radius server is plugged. I only configure the switch where the supplicant is conected.
XP is the supplicant. If the Cisco 2950 (client) doesn't require login, then the supplicant will simply connect without any authentication dialog.
How can I make the connection of the supplicant with an authentification dialog ?
The local tests are ok !
Then server is probably working just fine.
Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User
Don't set the Auth-Type in users file.
I deleted it, but nothing changed.
On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge
That is the supplicant. Now, configure the client.
Zoltan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Rafael.
Hi How can I return multiple ldap attributes which have a same name? For example, I want to get the 'Filter-ID' list from ldap. Any idea? Kevin
Hi
How can I return multiple ldap attributes which have a same name? For example, I want to get the 'Filter-ID' list from ldap. Any idea?
Kevin
I believe you have to put them in ldap with the += value in it. For example, radiusFilterId: "+= something" radiusFilterId: "+= somethingelse" I can't remember the exact syntax, perhaps someone else can help.
I think so, let me see if I can find a test machine around here and try it. I might need that some day too. On Tue, 9 Aug 2005, kevin wrote:
What? So, should I change the ldap attribute values with "+=" ??? Any other way?
kevin
Dusty Doris wrote:
Hi
How can I return multiple ldap attributes which have a same name? For example, I want to get the 'Filter-ID' list from ldap. Any idea?
Kevin
I believe you have to put them in ldap with the += value in it.
For example,
radiusFilterId: "+= something" radiusFilterId: "+= somethingelse"
I can't remember the exact syntax, perhaps someone else can help.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, 9 Aug 2005, kevin wrote:
What? So, should I change the ldap attribute values with "+=" ??? Any other way?
Yep, it works. I did a test, with this DN only one filter-id was returned. dn: uid=dustytest,ou=users,ou=radius,dc=test,dc=com objectClass: radiusprofile userPassword:: ZHVzdHl0ZXN0 radiusGroupName: dial radiusGroupName: adsl uid: dustytest radiusFilterId: filter1 radiusFilterId: filter2 Received response ID 210, code 2, length = 59 Framed-Routing = None Framed-IP-Netmask = 255.255.255.0 Framed-Protocol = PPP Service-Type = Framed-User Filter-Id = "filter1" With this dn, both were returned (note there were no quotes in it - that didn't work) dn: uid=dustytest,ou=users,ou=radius,dc=test,dc=com objectClass: radiusprofile userPassword:: ZHVzdHl0ZXN0 radiusGroupName: dial radiusGroupName: adsl uid: dustytest radiusFilterId: += filter1 radiusFilterId: += filter2 Received response ID 214, code 2, length = 68 Framed-Routing = None Framed-IP-Netmask = 255.255.255.0 Framed-Protocol = PPP Service-Type = Framed-User Filter-Id = "filter1" Filter-Id = "filter2"
But, I am still interested in the way returning multiple attributes without changing ldap data. I thought there must be a way. kevin Dusty Doris wrote:
On Tue, 9 Aug 2005, kevin wrote:
What? So, should I change the ldap attribute values with "+=" ??? Any other way?
Yep, it works.
I did a test, with this DN only one filter-id was returned.
dn: uid=dustytest,ou=users,ou=radius,dc=test,dc=com objectClass: radiusprofile userPassword:: ZHVzdHl0ZXN0 radiusGroupName: dial radiusGroupName: adsl uid: dustytest radiusFilterId: filter1 radiusFilterId: filter2
Received response ID 210, code 2, length = 59 Framed-Routing = None Framed-IP-Netmask = 255.255.255.0 Framed-Protocol = PPP Service-Type = Framed-User Filter-Id = "filter1"
With this dn, both were returned (note there were no quotes in it - that didn't work)
dn: uid=dustytest,ou=users,ou=radius,dc=test,dc=com objectClass: radiusprofile userPassword:: ZHVzdHl0ZXN0 radiusGroupName: dial radiusGroupName: adsl uid: dustytest radiusFilterId: += filter1 radiusFilterId: += filter2
Received response ID 214, code 2, length = 68 Framed-Routing = None Framed-IP-Netmask = 255.255.255.0 Framed-Protocol = PPP Service-Type = Framed-User Filter-Id = "filter1" Filter-Id = "filter2"
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I think you haven't put the NAS ip address in clients.conf. ----- Original Message ----- From: Rafael DiazMaurin To: z.ori@morehead-st.edu ; FreeRadius users mailing list Sent: Monday, August 08, 2005 22:44 Subject: Re: Pb with EAP/MD5 Thank you Zoltan, I made some modification but nothing changed. When I tested the configuration from with radping on the supplicant, it worked fine. But with my configuration md5, nothing occures at the radius server (no packets sent, no logs). I answer you at each point, and give the configurations on the client. Zoltan A. Ori a écrit : On Monday 08 August 2005 03:54, Rafael DiazMaurin wrote: Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950 I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap) The Cisco 2950 is the client (or NAS). Is it configured? Yes it's configured : IOS version : 12.1(22)EA4 General configuration : aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host IP-Adress auth-port 1812 acct-port 1813 key XXX radius-server retransmit 3 Here is the configuration of the port where the Supplicant (XP SP 2) is connected : interface FastEthernet0/2 description supplicant switchport access vlan XXX switchport mode access duplex full dot1x port-control auto dot1x timeout reauth-period 300 dot1x reauthentication spanning-tree portfast This switch is connected to another switch with a Trunk link, and another trunk link until the radius server. Here is the configuration of the port where the radius server is connected : interface FastEthernet2/11 description RadiusServer switchport access vlan 260 Do I need to configure the 2 last switchs with authentification dot1x ? I didn't configure anything on these switch, even the one where the radius server is plugged. I only configure the switch where the supplicant is conected. XP is the supplicant. If the Cisco 2950 (client) doesn't require login, then the supplicant will simply connect without any authentication dialog. How can I make the connection of the supplicant with an authentification dialog ? The local tests are ok ! Then server is probably working just fine. Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User Don't set the Auth-Type in users file. I deleted it, but nothing changed. On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge That is the supplicant. Now, configure the client. Zoltan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Rafael. ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jefri bin Dahari a écrit :
I think you haven't put the NAS ip address in clients.conf.
Yes I did it : client xxx.xxx.xxx.xxx { secret = XXX shortname = Switch nastype = cisco }
----- Original Message ----- *From:* Rafael DiazMaurin <mailto:Rafael.DiazMaurin@cnrs-bellevue.fr> *To:* z.ori@morehead-st.edu <mailto:z.ori@morehead-st.edu> ; FreeRadius users mailing list <mailto:freeradius-users@lists.freeradius.org> *Sent:* Monday, August 08, 2005 22:44 *Subject:* Re: Pb with EAP/MD5
Thank you Zoltan, I made some modification but nothing changed. When I tested the configuration from with radping on the supplicant, it worked fine. But with my configuration md5, nothing occures at the radius server (no packets sent, no logs).
I answer you at each point, and give the configurations on the client.
Zoltan A. Ori a écrit :
On Monday 08 August 2005 03:54, Rafael DiazMaurin wrote:
Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950
I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap)
The Cisco 2950 is the client (or NAS). Is it configured?
Yes it's configured : IOS version : 12.1(22)EA4 General configuration : aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host IP-Adress auth-port 1812 acct-port 1813 key XXX radius-server retransmit 3
Here is the configuration of the port where the Supplicant (XP SP 2) is connected : interface FastEthernet0/2 description supplicant switchport access vlan XXX switchport mode access duplex full dot1x port-control auto dot1x timeout reauth-period 300 dot1x reauthentication spanning-tree portfast
This switch is connected to another switch with a Trunk link, and another trunk link until the radius server. Here is the configuration of the port where the radius server is connected : interface FastEthernet2/11 description RadiusServer switchport access vlan 260
Do I need to configure the 2 last switchs with authentification dot1x ? I didn't configure anything on these switch, even the one where the radius server is plugged. I only configure the switch where the supplicant is conected.
XP is the supplicant. If the Cisco 2950 (client) doesn't require login, then the supplicant will simply connect without any authentication dialog.
How can I make the connection of the supplicant with an authentification dialog ?
The local tests are ok !
Then server is probably working just fine.
Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User
Don't set the Auth-Type in users file.
I deleted it, but nothing changed.
On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge
That is the supplicant. Now, configure the client.
Zoltan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Rafael.
Use 'debug radius authentication' command on your switch and run radiusd -X and see the output. Check whether the vlan you configure on the port is supported on the switch. ----- Original Message ----- From: "Rafael DiazMaurin" <Rafael.DiazMaurin@cnrs-bellevue.fr> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, August 09, 2005 15:44 Subject: Re: Pb with EAP/MD5
Jefri bin Dahari a écrit :
I think you haven't put the NAS ip address in clients.conf.
Yes I did it :
client xxx.xxx.xxx.xxx { secret = XXX shortname = Switch nastype = cisco }
----- Original Message ----- *From:* Rafael DiazMaurin <mailto:Rafael.DiazMaurin@cnrs-bellevue.fr> *To:* z.ori@morehead-st.edu <mailto:z.ori@morehead-st.edu> ; FreeRadius users mailing list <mailto:freeradius-users@lists.freeradius.org> *Sent:* Monday, August 08, 2005 22:44 *Subject:* Re: Pb with EAP/MD5
Thank you Zoltan, I made some modification but nothing changed. When I tested the configuration from with radping on the supplicant, it worked fine. But with my configuration md5, nothing occures at the radius server (no packets sent, no logs).
I answer you at each point, and give the configurations on the client.
Zoltan A. Ori a écrit :
On Monday 08 August 2005 03:54, Rafael DiazMaurin wrote:
Hello, Cna someone help me ? I use : freeradius 1.0.4, and a switch CISCO 2950
I'm trying to configure EAP/MD5, but the client can't show the window of login/password, it's connected to the network without asking for the login/password, and the freeradius daemon is still : Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. A part of the log of the freeradius : Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 Module: Instantiated eap (eap)
The Cisco 2950 is the client (or NAS). Is it configured?
Yes it's configured : IOS version : 12.1(22)EA4 General configuration : aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host IP-Adress auth-port 1812 acct-port 1813 key XXX radius-server retransmit 3
Here is the configuration of the port where the Supplicant (XP SP 2) is connected : interface FastEthernet0/2 description supplicant switchport access vlan XXX switchport mode access duplex full dot1x port-control auto dot1x timeout reauth-period 300 dot1x reauthentication spanning-tree portfast
This switch is connected to another switch with a Trunk link, and another trunk link until the radius server. Here is the configuration of the port where the radius server is connected : interface FastEthernet2/11 description RadiusServer switchport access vlan 260
Do I need to configure the 2 last switchs with authentification dot1x ? I didn't configure anything on these switch, even the one where the radius server is plugged. I only configure the switch where the supplicant is conected.
XP is the supplicant. If the Cisco 2950 (client) doesn't require login, then the supplicant will simply connect without any authentication dialog. How can I make the connection of the supplicant with an authentification dialog ?
The local tests are ok !
Then server is probably working just fine.
Here is the configurations I tested : raddb/users : test Auth-Type := EAP, User-Password == "test" Service-Type = Framed-User
Don't set the Auth-Type in users file.
I deleted it, but nothing changed.
On the client (windows XP sp2) I configure the 802.1x properties on Type EAP : MD5-Challenge
That is the supplicant. Now, configure the client.
Zoltan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Rafael.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jefri bin Dahari a écrit :
Use 'debug radius authentication' command on your switch and run radiusd -X and see the output. Check whether the vlan you configure on the port is supported on the switch.
I've got 2 errors in my logs from the switch CISCO 2950 IOS : version : 12.1(22)EA4 AAA/AUTHOR: config command authorization not enable dot1x-err:Unable to send a message to the Dot1x Authenticator process. If someone has an idea...
----- Original Message ----- From: "Rafael DiazMaurin" <Rafael.DiazMaurin@cnrs-bellevue.fr> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, August 09, 2005 15:44 Subject: Re: Pb with EAP/MD5
Jefri bin Dahari a écrit :
I think you haven't put the NAS ip address in clients.conf.
Yes I did it :
client xxx.xxx.xxx.xxx { secret = XXX shortname = Switch nastype = cisco }
----- Original Message -----
The Cisco 2950 is the client (or NAS). Is it configured?
Yes it's configured : IOS version : 12.1(22)EA4 General configuration : aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host IP-Adress auth-port 1812 acct-port 1813 key XXX radius-server retransmit 3
Here is the configuration of the port where the Supplicant (XP SP 2) is connected : interface FastEthernet0/2 description supplicant switchport access vlan XXX switchport mode access duplex full dot1x port-control auto dot1x timeout reauth-period 300 dot1x reauthentication spanning-tree portfast
This switch is connected to another switch with a Trunk link, and another trunk link until the radius server. Here is the configuration of the port where the radius server is connected : interface FastEthernet2/11 description RadiusServer switchport access vlan XXX
Rafael.
Add command 'dot1x system-auth-control' for the switch. ----- Original Message ----- From: "Rafael DiazMaurin" <Rafael.DiazMaurin@cnrs-bellevue.fr> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Cc: <jeff@mimos.my> Sent: Tuesday, August 09, 2005 22:41 Subject: Re: Pb with EAP/MD5
Jefri bin Dahari a écrit :
Use 'debug radius authentication' command on your switch and run radiusd -X and see the output. Check whether the vlan you configure on the port is supported on the switch.
I've got 2 errors in my logs from the switch CISCO 2950 IOS : version : 12.1(22)EA4
AAA/AUTHOR: config command authorization not enable dot1x-err:Unable to send a message to the Dot1x Authenticator process.
If someone has an idea...
----- Original Message ----- From: "Rafael DiazMaurin" <Rafael.DiazMaurin@cnrs-bellevue.fr> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, August 09, 2005 15:44 Subject: Re: Pb with EAP/MD5
Jefri bin Dahari a écrit :
I think you haven't put the NAS ip address in clients.conf.
Yes I did it :
client xxx.xxx.xxx.xxx { secret = XXX shortname = Switch nastype = cisco }
----- Original Message -----
The Cisco 2950 is the client (or NAS). Is it configured?
Yes it's configured : IOS version : 12.1(22)EA4 General configuration : aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host IP-Adress auth-port 1812 acct-port 1813 key XXX radius-server retransmit 3
Here is the configuration of the port where the Supplicant (XP SP 2) is connected : interface FastEthernet0/2 description supplicant switchport access vlan XXX switchport mode access duplex full dot1x port-control auto dot1x timeout reauth-period 300 dot1x reauthentication spanning-tree portfast
This switch is connected to another switch with a Trunk link, and another trunk link until the radius server. Here is the configuration of the port where the radius server is connected : interface FastEthernet2/11 description RadiusServer switchport access vlan XXX
Rafael.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jefri bin Dahari a écrit :
Add command 'dot1x system-auth-control' for the switch.
Thank you, that was the solution ! But before adding this command, we need to delete all the dot1x parameters on each port of the switch, if not the IOS, refuse to add this command. Thanks eveyone helps me. Rafael.
participants (5)
-
Dusty Doris -
Jefri bin Dahari -
kevin -
Rafael DiazMaurin -
Zoltan A. Ori