We have successfully installed and enjoying ( really ) freeradius eap-tls setup for our secure wifi, in an environment that looks like Client-> Proxim-AP -> FW -> Internet -> FW -> Freeradius server 1.1.7 One issue that we observed was that after some idle time on the client, the client gets disconected and it fails to auto-re-authorize. Then one has to disconect manually and reauthorize ... ( nothing in the logs of freeradius indicates that .. ) My questions are: a) Is this a normal behavior ? ( I suspect not ) b) Is it a windows XP/driver etc issue? c) AP issue ( rekeying interval = 900 and no accounting profile enabled ) d) Firewall Issue ( ports 1812:1813 are wide open for access on the radius side ) ? e) Freeradius issue ??? ( The only attribute set in mysql radgroupcheck is GROUPNAME=prv-net , Attribute=Auth-Type,op=':=' , VALUE=EAP ) Any help/Hints would be very much appreciated Kind Regards, Harry
Harry Lachanas wrote:
One issue that we observed was that after some idle time on the client, the client gets disconected and it fails to auto-re-authorize. Then one has to disconect manually and reauthorize ... ( nothing in the logs of freeradius indicates that .. )
If there is no RADIUS traffic when the client fails to auto-re-authorize, then the problem is a) the client b) the AP Pick one or both.
My questions are:
a) Is this a normal behavior ? ( I suspect not )
No.
b) Is it a windows XP/driver etc issue?
No idea.
c) AP issue ( rekeying interval = 900 and no accounting profile enabled )
Very likely. I'd bet that Windows would be more stable than AP's from random vendors.
d) Firewall Issue ( ports 1812:1813 are wide open for access on the radius side ) ?
No. If they get authenticated once, there's no problem.
e) Freeradius issue ??? ( The only attribute set in mysql radgroupcheck is GROUPNAME=prv-net , Attribute=Auth-Type,op=':=' , VALUE=EAP )
No. If there's no RADIUS traffic the second time, there's no problem.
Any help/Hints would be very much appreciated
Buy a $40 access point that does RADIUS, and see if it works. If it does, throw the Proxim AP in the garbage, or see of you can get your money back. Alan DeKok.
participants (2)
-
Alan DeKok -
Harry Lachanas