Alan,
They most certainly do!
I just debugged a case where the Cisco 1200 takes the 30s Session-Timeout
that the Microsoft IAS server sends and treats it as a response timeout. (It
then aborts the authentication, which I believe is wrong, but that's another
story)
When doing a SecurID authentication with user input of a 60s token OTP, the
default 30s is "inadequate".
Cisco does document the way to extend or override this behavior.
The Session-Timeout on Access-Challenges for EAP should be a separate
"design" somehow.
In the older MS RasEap API, it was crudely based on on the type of Send action
the EAP server used.
In the newer MS EAPHost API, the EAP server code has direct control.
I don't know how your EAP modules interface to the RADIUS server proper, but a
method that is expecting interactive user control _will_ want to create some
slack here.
Not all EAP methods complete in short time.
Dave.
On Jul 8, 2009, [email protected] wrote:
Gong Cheng wrote:
> Hi,
> I wonder if there is a way
> - not to include "Session-Timeout" value intended for Access-Accept in
> Access-Challenge messages?
In 2.1.7, see raddb/sites-available/default. Look for
Access-Challenge. There is sample configuration.
> - or to configure a different Session-Timeout value for Access-Challenges
> (which contain EAP-Message)?
>
> This is about the following section in RFC3579 where Session-Timeout in
> Access-Challenge is used to influence EAP retransmission behavior.
I'm not sure any AP supports that.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
