Cisco Access Points

Mon May 14 18:29:48 CEST 2007

Hello to all

I'm very new at this whole radius deal so I hope I can find a kind soul that
could help me with this setup.

I'm sorry if this is described somewhere I've been looking around and I
don't seem to find this.

For now i'm trying to get a very simple setup to work

I have a Cisco 1121G AP which I want to use with my freeeradius server
EAP/PEAP

Nothing fancy just a user local on the freeradius server

I can't get the user credentials to authenticate

It's a Windows machine that I trying to authenticate with and the wireless
netcard is set to use EAP (PEAP), no certificates and EAP-MSCHAPv2 as
authentication method.

I have a user in the radius users file called

wifiuser   User-Password := "SomePasswordHere"

           MS-CHAP-Use-NTLM-Auth := 0

In the clients.conf I have

client 192.168.150.250 {

        secret = SomePasswordHere

        shortname = CiscoAP1121

        nastype = cisco

}

In the eap.conf I unmarked

default_eap_type = mschapv2

Then I read this in the eap.conf

#  This module is the *Microsoft* implementation of MS-CHAPv2

#  in EAP.  There is another (incompatible) implementation

#  of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not

#  currently support.

#

mschapv2 {

}

Does this apply to my setup and if so what is an alternative to what I'm
trying todo?

When I debug on the cisco AP I get the following lines that are odd (Full
log in bottom of the mail)

*Apr 23 19:50:57.298: RADIUS:  AAA Unsupported     [263] 12

*Apr 23 19:50:57.299: RADIUS:   57 49 46 49 5F 50 52 49 56 41
[WIFI_PRIVA]

*Apr 23 19:50:57.299: RADIUS:  AAA Unsupported     [156] 3

*Apr 23 19:50:57.299: RADIUS:   33

It's a pretty standard Freeradius config havn't done anything to it but
added some users and one other client.

Thank you in advance

Christian

-------- LOGS BELOW ---------

All I get in radius.log is

Mon May 14 19:50:20 2007 : Info: rlm_eap_md5: Issuing Challenge

--------------- CISCO DEBUG RADIUS -----------------------

*Apr 23 19:50:57.288: RADIUS/ENCODE(000000D3):Orig. component type = DOT11

*Apr 23 19:50:57.288: RADIUS:  AAA Unsupported     [263] 12

*Apr 23 19:50:57.288: RADIUS:   57 49 46 49 5F 50 52 49 56 41
[WIFI_PRIVA]

*Apr 23 19:50:57.288: RADIUS:  AAA Unsupported     [156] 3

*Apr 23 19:50:57.288: RADIUS:   33
[3]

*Apr 23 19:50:57.288: RADIUS(000000D3): Storing nasport 336 in rad_db

*Apr 23 19:50:57.289: RADIUS(000000D3): Config NAS IP: 192.168.150.250

*Apr 23 19:50:57.289: RADIUS/ENCODE(000000D3): acct_session_id: 82

*Apr 23 19:50:57.289: RADIUS(000000D3): Config NAS IP: 192.168.150.250

*Apr 23 19:50:57.289: RADIUS(000000D3): sending

*Apr 23 19:50:57.290: RADIUS(000000D3): Send Access-Request to
192.168.150.1:1812 id 1645/33, len 135

*Apr 23 19:50:57.290: RADIUS:  authenticator EA B6 33 72 6C 09 8E CF - 84 B1
60 BB 54 B8 55 BF

*Apr 23 19:50:57.290: RADIUS:  User-Name           [1]   10  "wifiuser"

*Apr 23 19:50:57.290: RADIUS:  Framed-MTU          [12]  6   1400

*Apr 23 19:50:57.290: RADIUS:  Called-Station-Id   [30]  16
"0017.0e86.2cb0"

*Apr 23 19:50:57.290: RADIUS:  Calling-Station-Id  [31]  16
"000e.35e6.0bd0"

*Apr 23 19:50:57.290: RADIUS:  Service-Type        [6]   6   Login
[1]

*Apr 23 19:50:57.291: RADIUS:  Message-Authenticato[80]  18  *

*Apr 23 19:50:57.291: RADIUS:  EAP-Message         [79]  15

*Apr 23 19:50:57.291: RADIUS:   02 02 00 0D 01 77 69 66 69 75 73 65 72
[?????wifiuser]

*Apr 23 19:50:57.291: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless
[19]

*Apr 23 19:50:57.292: RADIUS:  NAS-Port            [5]   6   336

*Apr 23 19:50:57.292: RADIUS:  NAS-IP-Address      [4]   6   192.168.150.250

*Apr 23 19:50:57.292: RADIUS:  Nas-Identifier      [32]  10  "VOICE-AP"

*Apr 23 19:50:57.293: RADIUS: Received from id 1645/33 192.168.150.1:1812,
Access-Challenge, len 80

*Apr 23 19:50:57.294: RADIUS:  authenticator F9 A4 EE 6B E1 5A 8A AB - F5 BD
19 CA 96 33 48 CA

*Apr 23 19:50:57.294: RADIUS:  EAP-Message         [79]  24

*Apr 23 19:50:57.294: RADIUS:   01 03 00 16 04 10 41 8F DB 50 B7 94 9A 30 DF
CE  [??????A??P???0??]

*Apr 23 19:50:57.294: RADIUS:   60 DA D1 51 EB 08
[`??Q??]

*Apr 23 19:50:57.294: RADIUS:  Message-Authenticato[80]  18  *

*Apr 23 19:50:57.294: RADIUS:  State               [24]  18

*Apr 23 19:50:57.295: RADIUS:   DE 53 56 01 A4 DC 17 CD C0 B9 E0 46 DF 21 54
FB  [?SV????????F?!T?]

*Apr 23 19:50:57.295: RADIUS(000000D3): Received from id 1645/33

*Apr 23 19:50:57.296: RADIUS/DECODE: EAP-Message fragments, 22, total 22
bytes

*Apr 23 19:50:57.298: RADIUS/ENCODE(000000D3):Orig. component type = DOT11

*Apr 23 19:50:57.298: RADIUS:  AAA Unsupported     [263] 12

*Apr 23 19:50:57.299: RADIUS:   57 49 46 49 5F 50 52 49 56 41
[WIFI_PRIVA]

*Apr 23 19:50:57.299: RADIUS:  AAA Unsupported     [156] 3

*Apr 23 19:50:57.299: RADIUS:   33
[3]

*Apr 23 19:50:57.299: RADIUS(000000D3): Using existing nas_port 336

*Apr 23 19:50:57.300: RADIUS(000000D3): Config NAS IP: 192.168.150.250

*Apr 23 19:50:57.300: RADIUS/ENCODE(000000D3): acct_session_id: 82

*Apr 23 19:50:57.300: RADIUS(000000D3): Config NAS IP: 192.168.150.250

*Apr 23 19:50:57.300: RADIUS(000000D3): sending

*Apr 23 19:50:57.300: RADIUS(000000D3): Send Access-Request to
192.168.150.1:1812 id 1645/34, len 146

*Apr 23 19:50:57.300: RADIUS:  authenticator 56 F3 92 78 A7 7A 09 FA - 99 29
51 99 7D E0 9F B3

*Apr 23 19:50:57.301: RADIUS:  User-Name           [1]   10  "wifiuser"

*Apr 23 19:50:57.301: RADIUS:  Framed-MTU          [12]  6   1400

*Apr 23 19:50:57.301: RADIUS:  Called-Station-Id   [30]  16
"0017.0e86.2cb0"

*Apr 23 19:50:57.301: RADIUS:  Calling-Station-Id  [31]  16
"000e.35e6.0bd0"

*Apr 23 19:50:57.301: RADIUS:  Service-Type        [6]   6   Login
[1]

*Apr 23 19:50:57.302: RADIUS:  Message-Authenticato[80]  18  *

*Apr 23 19:50:57.302: RADIUS:  EAP-Message         [79]  8

*Apr 23 19:50:57.302: RADIUS:   02 03 00 06 03 19
[??????]

*Apr 23 19:50:57.302: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless
[19]

*Apr 23 19:50:57.302: RADIUS:  NAS-Port            [5]   6   336

*Apr 23 19:50:57.302: RADIUS:  State               [24]  18

*Apr 23 19:50:57.302: RADIUS:   DE 53 56 01 A4 DC 17 CD C0 B9 E0 46 DF 21 54
FB  [?SV????????F?!T?]

*Apr 23 19:50:57.302: RADIUS:  NAS-IP-Address      [4]   6   192.168.150.250

*Apr 23 19:50:57.303: RADIUS:  Nas-Identifier      [32]  10  "VOICE-AP"

*Apr 23 19:51:02.527: RADIUS: no sg in radius-timers: ctx 0xC2506C sg 0x0000

*Apr 23 19:51:02.527: RADIUS: Retransmit to (192.168.150.1:1812,1813) for id
1645/34

*Apr 23 19:51:02.527: RADIUS: Received from id 1645/34 192.168.150.1:1812,
Access-Reject, len 44

*Apr 23 19:51:02.528: RADIUS:  authenticator 27 C2 B4 DD 14 F9 C3 C0 - DF 88
BD B5 DC 0D 6C 63

*Apr 23 19:51:02.528: RADIUS:  EAP-Message         [79]  6

*Apr 23 19:51:02.528: RADIUS:   04 03 00 04
[????]

*Apr 23 19:51:02.528: RADIUS:  Message-Authenticato[80]  18  *

*Apr 23 19:51:02.529: RADIUS(000000D3): Received from id 1645/34

*Apr 23 19:51:02.529: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes

------------------------ CISCO DEBUG RADIUS END ---------------------

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20070514/aa5797e9/attachment.html>