"Invalid packet code 11 sent to authentication port from client" error

[Alan DeKok]

Rob Brickhouse wrote:
> I hope someone can help me with this. I tested setting up freeradius
> 2.1.6 on an opensuse 10.2 box and was able to get everything
> authenticating against novell edirectory. Now that I'm finally ready to
> put it on my production box, only 2.1.8 is available but I figure no big
> deal since it appeared to have alot of fixes. After going through and
> setting everything up like I did before, I can use my test utility to
> verify that I can successfully read the username and password from
> edirectory but I get the message "Invalid packet code 11 sent to
> authentication port from client TESAP8 port 1041 : IGNORED" when my
> Netgear access point connects.

  The AP is broken.  Throw it in the garbage and buy one that implements
RADIUS.

> I can change the ip to my 2.1.6
> freeradius box and it works so I don't think the issue is with my AP
> even though that is what the message seems to indicate.

  I don't see why that would make any difference.  What does the debug
log from 2.1.6 look like?

...
> Sending Access-Challenge of id 20 to 10.6.4.108 port 1041
>  EAP-Message = 0x010100160410eae98bafd4b076dcf8b6341b415000fe
>  Message-Authenticator = 0x00000000000000000000000000000000
>  State = 0x731ac834731bcca6975b39a87528fad1
> Finished request 1.
> Going to the next request
> Waking up in 4.9 seconds.
> Invalid packet code 11 sent to authentication port from client TESAP8
> port 1041 : IGNORED

  IIRC, this is similar to a bug seen before.  If it sees an
Access-Challenge with State *after* Message-Authenticator, it "bounces"
the packet back to the RADIUS server.  This is two errors:

 1) order of attributes does not matter
 2) clients do not send Access-Challenge to a server.

  There is NO WAY that an AP should send an Access-Challenge to a
server.  If it does, then the AP is horribly broken.

  My guess is that this is a very old AP using a broken firmware image.
 Or, it's a new one, and the vendor didn't bother to implement RADIUS
correctly.

  Alan DeKok.