Hi,
we have FreeRADIUS server which after authentication send reply with VSA attributes, but AP don't accept them and set default/implicit data rate to authenticated SM - see picture.
"RADIUS Authentication reply" section on AP is blank (don't see reply!?)
Full RADIUS debug is in attachment, bellow is little cut:
(399) sql : EXPAND %{User-Name}
(399) sql : --> 0a-00-3e-40-9c-32
(399) sql : SQL-User-Name set to '0a-00-3e-40-9c-32'
rlm_sql (sql): Reserved connection (256)
(399) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(399) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0a-00-3e-40-9c-32' ORDER BY id
rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0a-00-3e-40-9c-32' ORDER BY id'
(399) sql : User found in radcheck table
(399) sql : Check items matched
(399) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(399) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '0a-00-3e-40-9c-32' ORDER BY id
rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = '0a-00-3e-40-9c-32' ORDER BY id'
(399) sql : User found in radreply table
(399) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(399) sql : --> SELECT groupname FROM radusergroup WHERE username = '0a-00-3e-40-9c-32' ORDER BY priority
rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = '0a-00-3e-40-9c-32' ORDER BY priority'
(399) sql : User not found in any groups
rlm_sql (sql): Released connection (256)
(399) [sql] = ok
(399) [expiration] = noop
(399) [logintime] = noop
(399) WARNING: pap : Auth-Type already set. Not setting to PAP
(399) [pap] = noop
(399) } # authorize = ok
(399) Found Auth-Type = MSCHAP
(399) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(399) Auth-Type MS-CHAP {
(399) mschap : Found Cleartext-Password, hashing to create LM-Password
(399) mschap : Found Cleartext-Password, hashing to create NT-Password
(399) mschap : Creating challenge hash with username: 0a-00-3e-40-9c-32
(399) mschap : Client is using MS-CHAPv2
(399) mschap : Adding MS-CHAPv2 MPPE keys
(399) [mschap] = ok
(399) } # Auth-Type MS-CHAP = ok
(399) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel
(399) post-auth {
(399) sql : EXPAND .query
(399) sql : --> .query
(399) sql : Using query template 'query'
rlm_sql (sql): Reserved connection (256)
(399) sql : EXPAND %{User-Name}
(399) sql : --> 0a-00-3e-40-9c-32
(399) sql : SQL-User-Name set to '0a-00-3e-40-9c-32'
(399) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
(399) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0a-00-3e-40-9c-32', '', 'Access-Accept', '2017-02-09 13:03:26')
rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0a-00-3e-40-9c-32', '', 'Access-Accept', '2017-02-09 13:03:26')'
rlm_sql (sql): Released connection (256)
(399) [sql] = ok
(399) } # post-auth = ok
(399) Reply:
Cambium-Canopy-HPENABLE = Enable
Cambium-Canopy-HPDLCIR = 500
Cambium-Canopy-HPULCIR = 500
Cambium-Canopy-LPDLCIR = 300
Cambium-Canopy-LPULCIR = 300
Cambium-Canopy-DLBR = 3000
Cambium-Canopy-ULBR = 1000
MS-CHAP2-Success = 0x38533d33324335454243323037463238333944333736334145444543313445353242413337333737323039
MS-MPPE-Recv-Key = 0x6e34e7646052c658a35efc1bbae64876
MS-MPPE-Send-Key = 0x2b7b0915e7fed650c0aa8f132dd942d2
MS-MPPE-Encryption-Policy = Encryption-Allowed
MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(399) } # server inner-tunnel
(399) eap_ttls : Got tunneled Access-Accept
(399) eap_ttls : Got MS-CHAP2-Success, tunneling it to the client in a challenge
(399) eap_ttls : sending tunneled reply attributes
MS-CHAP2-Success = 0x38533d33324335454243323037463238333944333736334145444543313445353242413337333737323039
(399) eap_ttls : end tunneled reply attributes
(399) eap : New EAP session, adding 'State' attribute to reply 0x78dc0ab07ddb1fe3
(399) [eap] = handled
(399) } # authenticate = handled
(399) Sending Access-Challenge packet to host 10.6.1.90 port 1236, id=0, length=0
(399) EAP-Message = 0x0107005f158000000055170301005091ab6a0ca8da7a4c9de8e06b63d9df2c0af84b771a8c39ac6997dafaf4fd8ea059d1662d4b4cc0626ffbb495fff79a432ca8001e85caa5572f335f8b8d97b7fdd32d4c4cfa2d78bacedf1452958fd1df
(399) Message-Authenticator = 0x00000000000000000000000000000000
(399) State = 0x78dc0ab07ddb1fe36f01bf10d02412ef
Sending Access-Challenge Id 0 from 89.190.92.142:1812 to 10.6.1.90:1236
EAP-Message = 0x0107005f158000000055170301005091ab6a0ca8da7a4c9de8e06b63d9df2c0af84b771a8c39ac6997dafaf4fd8ea059d1662d4b4cc0626ffbb495fff79a432ca8001e85caa5572f335f8b8d97b7fdd32d4c4cfa2d78bacedf1452958fd1df
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x78dc0ab07ddb1fe36f01bf10d02412ef
(399) Finished request
- RADIUS_debug.txt (40.6 KB)
- Screenshot from 2017-02-09 13-11-44.png (33.4 KB)
