Help - ASN-GW throwing error - Validation of attributes failed
Dear All, I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details. 1. TATA ELXSI - WIMAX MS 2. TATA ELXSI - WIMAX BS 3. ARICENT ASN-GW version 4.2 4. Free Radius AAA server version 2.1.3 Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed" Wireshark logs @ ASN-GW I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word. What are the mandatory fields in Access-Accept and their valid values? Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS? I am guessing this should be 8. I don't have control over ASN-GW parameters modification. Please let me know what fields are invalid in above ACCESS-ACCEPT. Thanks ! Rathod.
On Thu, Mar 15, 2012 at 12:21 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
While that information might be interesting for ASN support/list/forum, this list is not it.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don’t have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Did you try asking the NAS vendor? If you know what attributes are needed, you can configure FR to send it. If you don't know what they are, then you should ask the NAS vendor, or at least read its documentation. -- Fajar
Dear Fajar, I went through the documentation of ASN-GW. I could not find configuring AAA parameters except AAA IP address. I am not quite clear which attribute is causing the problem. For EAP-TTLS, almost same ACCESS-ACCEPT attributes are through. But for EAP-TLS I am facing this issue. I am attaching the AAA wireshark logs. Please let me know your valuable feedback. Thanks ! Rathod. -----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Thursday, March 15, 2012 11:00 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed On Thu, Mar 15, 2012 at 12:21 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
While that information might be interesting for ASN support/list/forum, this list is not it.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don't have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Did you try asking the NAS vendor? If you know what attributes are needed, you can configure FR to send it. If you don't know what they are, then you should ask the NAS vendor, or at least read its documentation. -- Fajar
Hi, ask ASN-GW vendor if it passed IOT with FR. 15 марта 2012, 09:58 от Rathod Subhashchandra <rathod@tataelxsi.co.in>:
Dear Fajar,
I went through the documentation of ASN-GW. I could not find configuring AAA parameters except AAA IP address.
I am not quite clear which attribute is causing the problem. For EAP-TTLS, almost same ACCESS-ACCEPT attributes are through. But for EAP-TLS I am facing this issue.
I am attaching the AAA wireshark logs. Please let me know your valuable feedback.
Thanks ! Rathod.
-----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Thursday, March 15, 2012 11:00 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed
On Thu, Mar 15, 2012 at 12:21 PM, Rathod Subhashchandra <rathod@tataelxsi.co.in> wrote:
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
While that information might be interesting for ASN support/list/forum, this list is not it.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don't have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Did you try asking the NAS vendor?
If you know what attributes are needed, you can configure FR to send it. If you don't know what they are, then you should ask the NAS vendor, or at least read its documentation.
-- Fajar
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
There is no WiMAX-MSK attribute in Access-Accept. You need to call rlm_wimax module from post-auth section of default virtual server: # raddb/sites-enabled/default post-auth { ... wimax ... } This module will add WiMAX-MSK and remove MS-MPPE-Send-Key and MS-MPPE-Recv-Key. Rathod Subhashchandra wrote:
Dear All,
I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details.
1. TATA ELXSI - WIMAX MS
2. TATA ELXSI - WIMAX BS
3. ARICENT ASN-GW version 4.2
4. Free Radius AAA server version 2.1.3
Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed"
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don’t have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Thanks !
Rathod.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear Iliya, Thanks for your valuable suggestion. Rlm_wimax module was not building. I enabled and now it is building. As per your suggestion, I have added "wimax" in file raddb/sites-enabled/default Still I am not getting WiMAX-MSK in Access-Accept. Could you please help me in this? Thanks ! Rathod. -----Original Message----- From: Iliya Peregoudov [mailto:iperegudov@cboss.ru] Sent: Thursday, March 15, 2012 11:41 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed There is no WiMAX-MSK attribute in Access-Accept. You need to call rlm_wimax module from post-auth section of default virtual server: # raddb/sites-enabled/default post-auth { ... wimax ... } This module will add WiMAX-MSK and remove MS-MPPE-Send-Key and MS-MPPE-Recv-Key. Rathod Subhashchandra wrote:
Dear All,
I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details.
1. TATA ELXSI - WIMAX MS
2. TATA ELXSI - WIMAX BS
3. ARICENT ASN-GW version 4.2
4. Free Radius AAA server version 2.1.3
Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed"
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don't have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Thanks !
Rathod.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Run freeradius in debug mode (-X). Look for eap module debug messages. Look for wimax module debug messages. Try to understand. Rathod Subhashchandra wrote:
Dear Iliya,
Thanks for your valuable suggestion. Rlm_wimax module was not building. I enabled and now it is building. As per your suggestion, I have added "wimax" in file raddb/sites-enabled/default Still I am not getting WiMAX-MSK in Access-Accept. Could you please help me in this?
Thanks ! Rathod.
-----Original Message----- From: Iliya Peregoudov [mailto:iperegudov@cboss.ru] Sent: Thursday, March 15, 2012 11:41 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed
There is no WiMAX-MSK attribute in Access-Accept. You need to call rlm_wimax module from post-auth section of default virtual server:
# raddb/sites-enabled/default post-auth { ... wimax ... }
This module will add WiMAX-MSK and remove MS-MPPE-Send-Key and MS-MPPE-Recv-Key.
Rathod Subhashchandra wrote:
Dear All,
I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details.
1. TATA ELXSI - WIMAX MS
2. TATA ELXSI - WIMAX BS
3. ARICENT ASN-GW version 4.2
4. Free Radius AAA server version 2.1.3
Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed"
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don't have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Thanks !
Rathod.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear Iliya, Do I need to modify the code to call rlm_wimax functions for generating the keys? By default, it is invoking eaptls_gen_mppe_keys functions. This function is generating MS-MPPE-Recv-Keys.
From your first mail, I understood that only modifying raddb/sites-enabled/default, will take care of everything.
Thanks ! Rathod. -----Original Message----- From: freeradius-users-bounces+rathod=tataelxsi.co.in@lists.freeradius.org [mailto:freeradius-users-bounces+rathod=tataelxsi.co.in@lists.freeradius.org ] On Behalf Of Iliya Peregoudov Sent: Thursday, March 15, 2012 2:51 PM To: 'FreeRadius users mailing list' Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed Run freeradius in debug mode (-X). Look for eap module debug messages. Look for wimax module debug messages. Try to understand. Rathod Subhashchandra wrote:
Dear Iliya,
Thanks for your valuable suggestion. Rlm_wimax module was not building. I enabled and now it is building. As per your suggestion, I have added "wimax" in file raddb/sites-enabled/default Still I am not getting WiMAX-MSK in Access-Accept. Could you please help me in this?
Thanks ! Rathod.
-----Original Message----- From: Iliya Peregoudov [mailto:iperegudov@cboss.ru] Sent: Thursday, March 15, 2012 11:41 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed
There is no WiMAX-MSK attribute in Access-Accept. You need to call rlm_wimax module from post-auth section of default virtual server:
# raddb/sites-enabled/default post-auth { ... wimax ... }
This module will add WiMAX-MSK and remove MS-MPPE-Send-Key and MS-MPPE-Recv-Key.
Rathod Subhashchandra wrote:
Dear All,
I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details.
1. TATA ELXSI - WIMAX MS
2. TATA ELXSI - WIMAX BS
3. ARICENT ASN-GW version 4.2
4. Free Radius AAA server version 2.1.3
Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed"
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don't have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Thanks !
Rathod.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Iliya, It is working now. Thanks for your help. Thanks ! Rathod. -----Original Message----- From: freeradius-users-bounces+rathod=tataelxsi.co.in@lists.freeradius.org [mailto:freeradius-users-bounces+rathod=tataelxsi.co.in@lists.freeradius.org ] On Behalf Of Iliya Peregoudov Sent: Thursday, March 15, 2012 2:51 PM To: 'FreeRadius users mailing list' Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed Run freeradius in debug mode (-X). Look for eap module debug messages. Look for wimax module debug messages. Try to understand. Rathod Subhashchandra wrote:
Dear Iliya,
Thanks for your valuable suggestion. Rlm_wimax module was not building. I enabled and now it is building. As per your suggestion, I have added "wimax" in file raddb/sites-enabled/default Still I am not getting WiMAX-MSK in Access-Accept. Could you please help me in this?
Thanks ! Rathod.
-----Original Message----- From: Iliya Peregoudov [mailto:iperegudov@cboss.ru] Sent: Thursday, March 15, 2012 11:41 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed
There is no WiMAX-MSK attribute in Access-Accept. You need to call rlm_wimax module from post-auth section of default virtual server:
# raddb/sites-enabled/default post-auth { ... wimax ... }
This module will add WiMAX-MSK and remove MS-MPPE-Send-Key and MS-MPPE-Recv-Key.
Rathod Subhashchandra wrote:
Dear All,
I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details.
1. TATA ELXSI - WIMAX MS
2. TATA ELXSI - WIMAX BS
3. ARICENT ASN-GW version 4.2
4. Free Radius AAA server version 2.1.3
Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed"
Wireshark logs @ ASN-GW
I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word.
What are the mandatory fields in Access-Accept and their valid values?
Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS?
I am guessing this should be 8. I don't have control over ASN-GW parameters modification.
Please let me know what fields are invalid in above ACCESS-ACCEPT.
Thanks !
Rathod.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Rathod Subhashchandra wrote:
Rlm_wimax module was not building. I enabled and now it is building. As per your suggestion, I have added "wimax" in file raddb/sites-enabled/default Still I am not getting WiMAX-MSK in Access-Accept. Could you please help me in this?
Read the debug output to see why. And ask your NAS vendor why their equipment is broken. They need to supply a *useful* error message. Alan DeKok.
Quite often you need to change whether or not the response goes via the inner-tunnel. Work with your EAP settings to see if that will change the behavior. David -----Original Message----- From: freeradius-users-bounces+davidp=wirelessconnections.net@lists.freeradius.org [mailto:freeradius-users-bounces+davidp=wirelessconnections.net@lists.freera dius.org] On Behalf Of Alan DeKok Sent: Thursday, March 15, 2012 7:49 AM To: rathod@tataelxsi.co.in; FreeRadius users mailing list Subject: Re: Help - ASN-GW throwing error - Validation of attributes failed Rathod Subhashchandra wrote:
Rlm_wimax module was not building. I enabled and now it is building. As per your suggestion, I have added "wimax" in file raddb/sites-enabled/default Still I am not getting WiMAX-MSK in Access-Accept. Could you please help me in this?
Read the debug output to see why. And ask your NAS vendor why their equipment is broken. They need to supply a *useful* error message. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (6)
-
Alan DeKok -
David Peterson -
Fajar A. Nugraha -
Iliya Peregoudov -
Rathod Subhashchandra -
Толик Шавловский