We are trying to use vendor specific attributes to provide different services to users authenticating to our local radius system, rather than users authenticating via proxy'd eduraom systems. we are using freeradius version 2.1.10 and have added the below to the users file DEFAULT Suffix == "@port.ac.uk" Aruba-User-Role = ROLE-EDUROAM-INT, Aruba-User-Vlan = 128, Class = ROLE-EDUROAM-INT, Fall-Through = Yes As far as I can tell, from the reply-detail log below & wirehark, Radius is returning the values. But the support guy is not seeing them on his wireless server. The first packets he sees are the MS-MPPE- packets. Can anyone advise as to to get this working. Packet-Type = Access-Accept Aruba-User-Role = "ROLE-EDUROAM-INT" Aruba-User-Vlan = 128 Class = 0x524f4c452d454455524f414d2d494e54 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xd1b37a684ca34b56aac068907f687067 MS-MPPE-Recv-Key = 0x0bb8b13849577453ba36e4de9dd7aafc EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "knighta" Thu Jul 14 10:30:31 2011 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0xf83b0cc1823377adaf6a4439054fd198eb9fb762b47dd4eaea5c8a90383af353 MS-MPPE-Send-Key = 0x98085e780f78ef5837581667c796ddbf3d8c317cdcd1c7b4b5b9742091b84253 EAP-MSK = 0xf83b0cc1823377adaf6a4439054fd198eb9fb762b47dd4eaea5c8a90383af35398085e780f78ef5837581667c796ddbf3d8c317cdcd1c7b4b5b9742091b84253 EAP-EMSK = 0x4268b7d02ec96bd566a0bb48ae21733f55f1da5ec296f959c84a83bd67a2cc45ce19f0c69924b9e9ed034f74eac19c8d904efbd4279b31499df4366ab6bbcf11 EAP-Message = 0x030d0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "monkey"
On 14/07/11 13:34, Phil Brown wrote:
As far as I can tell, from the reply-detail log below& wirehark, Radius is returning the values. But the support guy is not seeing them on his wireless server. The first packets he sees are the MS-MPPE- packets. Can anyone advise as to to get this working.
A full debug is needed to advise really. Wild guess; you are setting these attributes in "inner-tunnel" server, and you don't have: peap { use_tunneled_reply = yes } ttls { use_tunneled_reply = yes }
Packet-Type = Access-Accept Aruba-User-Role = "ROLE-EDUROAM-INT" Aruba-User-Vlan = 128 Class = 0x524f4c452d454455524f414d2d494e54 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xd1b37a684ca34b56aac068907f687067 MS-MPPE-Recv-Key = 0x0bb8b13849577453ba36e4de9dd7aafc EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "knighta"
Thu Jul 14 10:30:31 2011 Packet-Type = Access-Accept MS-MPPE-Recv-Key =
Where did the above output come from? As in, where did you capture the packet?
participants (2)
-
Phil Brown -
Phil Mayers