Hi Fajar, Thanks for replying.. Really appreciate it.
> Ask the NAS vendor. It's CISCO.. I do see one Accounting-Request packet for Username="Ziggy" when I terminate the connection.. But no Accounting-Request packet for the Start of Username="ziggy" logging in. I do see Access-Request packets for Ziggy. I'll have to check on that with them. ??? > SQL should be faster, and easier to manage Great.. If I only want to use SQL for Simultaneous-Use checking (and not User Authentication), is that going to work? I want to use LDAP for Authenticaiton.. > Sure. >In fact, once I get EVERYTHING worked out just like I wanted, I >usually remove unnecessary components. >If your all your user configuration and acct data is on sql, then you> should be able to remove some configuration lines (e.g. unix, radutmp, > detail, etc.) I will disable RADUTMP & other stuff after I get this SQL working. Thanks. > If you have some clients that authenticate using PAP while others > using PEAP/802.1x, then yes. But if ALL your clients only use > PEAP/802.1x, then it shouldn't matter much what you put on > sites-available/default, as long as eap-related options are there. All our clients will be using PEAP/802.1x.. So does that mean only the eap.conf file matters? Do I need to make changes in the sites-available/default and the inner-tunnel files? > The image on > http://revolutionwifi.blogspot.com/2010/09/peapv0-packet-flow-reference.html > might give some illustration on the packets involved in EAP/MSCHAPv2 > works Thanks so much for the link.. It is great.. That explains why I have 8 Packets for the PEAP authentication for Ziggy.. :) The rest of the DEBUG logs contain Accounting-Request Packets.. On Thu, Jun 9, 2011 at 9:16 PM, Fajar A. Nugraha <[email protected]> wrote: > On Fri, Jun 10, 2011 at 2:26 AM, Ziggy Bopster <[email protected]> wrote: >> IV. Questions: >> 1) Why is the NAS sending so many randomly generated numeric >> "UserName" in the Accounting-Request? >> 2) How can I get the NAS to send the correct Username (Ziggy) instead >> of the randomly generated numbers in the Accounting-Request packets to >> update in SQL? > > Ask the NAS vendor. > >> 3) I'm confused, should I use radutmp or sql to get Simultaenous-Use >> to work? > > SQL should be faster, and easier to manage > >> If only sql, can I disable radutmp in configuration files? > > Sure. > > In fact, once I get EVERYTHING worked out just like I wanted, I > usually remove unnecessary components. > If your all your user configuration and acct data is on sql, then you > should be able to remove some configuration lines (e.g. unix, radutmp, > detail, etc.) > >> 4) What do I need to do to get Simultaneous-Use to work properly? > > As Alan ponted out, the included doc is a good start. > You need to have radcct table populated with correct values (which is > related to your question #1 and #2). > >> 5) Should the default & inner-tunnel files that have the same >> parameters match? (i.e. in authorize {sql} in the default file and the >> authorize {sql} in the inner-tunnel file) > > Depends. > > If you have some clients that authenticate using PAP while others > using PEAP/802.1x, then yes. But if ALL your clients only use > PEAP/802.1x, then it shouldn't matter much what you put on > sites-available/default, as long as eap-related options are there. > >> 6) Why do I see so many packets for Ziggy trying to authenticate just >> once.. It is not until about Line 1389 in the debug log (see below >> ITEM# 6) that the tunnel actually get's established and the next >> packet on Line 1453 has the Acct-Status-Type = Start? There is a >> total of about 3174 lines for just one login attempt. > > The image on > http://revolutionwifi.blogspot.com/2010/09/peapv0-packet-flow-reference.html > might give some illustration on the packets involved in EAP/MSCHAPv2 > works > > -- > Fajar > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
