auth: Failed to validate the user.

Hello! I got a following and do not know where erroare mistake. cylon2:/etc/freeradius# radtest test-user test-pass 192.168.1.1 10 danieladmin Sending Access-Request of id 198 to 192.168.1.1 port 1812 User-Name = test-user User-Password = test-pass NAS-IP-Address =

Re: how to get vendor specific attribute value

Hi but the issue is from free radius response why it send unknown attribute??? is there sometink that lack?? May be I have problem in adding new VSA dictionary file into Freeradius, I hope that you agree to help me solve my problem. Below you can find my dictionary VENDOR Ps BEGIN-VENDOR Ps

Re: how to get vendor specific attribute value

Noura Kossentini wrote: Hi but the issue is from free radius response why it send unknown attribute??? is there sometink that lack?? Yes. Wireshark doesn't have copies of the dictionary. The dictionaries are required to decode the attribute. This is how FreeRADIUS works. May be I have

Re: how to get vendor specific attribute value

Hi but why wireshark can see other attributes (like Idle-Timeout, service-type ...) without having dictionary.rfc2865?? 2010/10/8 Alan DeKok al...@deployingradius.com Noura Kossentini wrote: Hi but the issue is from free radius response why it send unknown attribute??? is there sometink

RE: Service-Logon

Hello, I am attempting to COA Service-Logon with Radclient and cisco av-pair attributes. I can perform other COA like tagged ACL or Named but so far not service-logon Local ACL IN_ACL_NAMED_v4_2 is on my ISG gateway (Cisco ASR1k). Have this cmd which I understand allows radius to define the

Re: Problemes with the mystic of freeradius configuration

On 08/10/10 10:36, Klaus Ethgen wrote: Hello newsgroup, hello Alan DeKok, I tried to solve my problem with Daniel Bertolo from Switch but was not success, so he told me to ask here. I want to configure a virtual server that always return ok to be used as probe for a load balancer (Cisco ACE).

Re: how to get vendor specific attribute value

Noura Kossentini wrote: Hi but why wireshark can see other attributes (like Idle-Timeout, service-type ...) without having dictionary.rfc2865?? Because the Wireshark software includes RADIUS dictionaries. Alan DeKok. - List info/subscribe/unsubscribe? See

Freeradius COA trigger

Hi, I have a freeradius setup generating COA successfully (when neccesary) after receiving accounting packets. This works well. Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking disconnect on a web page. I.e. I want to somehow trigger a

Re: Freeradius COA trigger

On 08/10/10 11:28, Johan Meiring wrote: Hi, I have a freeradius setup generating COA successfully (when neccesary) after receiving accounting packets. This works well. Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking disconnect on a web

Re: Problemes with the mystic of freeradius configuration

Hi, Another quest for me is to encapsulate the configuration for eduroam (including the users and proxy.conf(!)) into a complete independent configuration to use the radius server for more than eduroam. Unfortunately all tries to us a other file for users and proxy.conf only in the eduroam

Re: Freeradius COA trigger

Johan Meiring wrote: Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking disconnect on a web page. I.e. I want to somehow trigger a coa that is not caused by an update coa {} block, but by some external trigger. Is this possible in any

Problem with MSCHAP

This is my first post to this list, so first of all, hi! I'm new to freeradius, I'm working on setting it up to authenticate users to our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against Active Directory. I'm using samba and ntlm_auth.

Re: Problem with MSCHAP

On 08/10/10 14:24, Mark Holmes wrote: and I see the server returns Access-Accept. Firstly, don't set Auth-Type. It's almost always the wrong thing to do. Secondly, this is just testing PAP i.e. plain username/password auth. Wireless typically uses 802.1x via EAP. I then configure

RE: Problem with MSCHAP

[peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. You need to look earlier in your debug output to see why it was rejected (that's what this error message means) - List info/subscribe/unsubscribe? See

Re: Problem with MSCHAP

Hi, I'm new to freeradius, I'm working on setting it up to authenticate users to our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against Active Directory. I'm using samba and ntlm_auth. okay - a fairly standard setup for modern 802.1X Versions:freeradius2-2.1.7-7.el5

Re: Problemes with the mystic of freeradius configuration

Klaus Ethgen wrote: Phil Mayers p.may...@imperial.ac.uk schrieb: Try this: ... Doesn't work: server probes { +- entering group authorize {...} ++[ok] returns ok ++[handled] returns handled } # server probes The debug log shows that you did *not* try Phil's suggestion. I

Re: Question about NAS-Port attribute when using freeradiusclient

Ali Majdzadeh wrote: Hello All I am using freeradiusclient in combination with PPP in order to setup RADIUS authentication for PPTP users. Actually, I managed to authenticate users using RADIUS but I noticed that the NAS-Port attribute which is sent to RADIUS server is always 0. Is this

RE: Problem with MSCHAP

All, Many thanks for the replies. Firstly, don't set Auth-Type. It's almost always the wrong thing to do. Sure - I set that just to test the AD auth was working, and removed it again prior to configuring mschap. EAP is a multi-pass protocol; there will be 4-8 requests, and the actual

Re: Problem with MSCHAP

Mark Holmes wrote: I wasn't sure about posting the whole lot to this list as it runs to quite a few lines so posted it here http://www.nuffield.ox.ac.uk/scratch/logfile.txt Cut paste that into the form on this page: http://networkradius.com/freeradius.html Then, look for red /

RE: Freeradius COA trigger

Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking disconnect on a web page. I.e. I want to somehow trigger a coa that is not caused by an update coa {} block, but by some external trigger. Is this possible in any way? You

Re: Freeradius COA trigger

On 08/10/10 16:03, Tim Sylvester wrote: Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking disconnect on a web page. I.e. I want to somehow trigger a coa that is not caused by an update coa {} block, but by some external trigger. Is

Re: Question about NAS-Port attribute when using freeradiusclient

Alan, Thanks a lot. Warm Regards Ali Majdzadeh Kohbanani 2010/10/8 Alan DeKok al...@deployingradius.com Ali Majdzadeh wrote: Hello All I am using freeradiusclient in combination with PPP in order to setup RADIUS authentication for PPTP users. Actually, I managed to authenticate users

RE: Service-Logon

Do I need to define the service that I am referencing v4_POLICY elsewhere in freeradius? For example in a .conf file? Thanks, Jay -Original Message- From: freeradius-users-bounces+jkuhne=cisco@lists.freeradius.org

Re: Question about NAS-Port attribute when using freeradiusclient

Alan, Sorry for this extra post, but, what about Interim-Update attribute? Is there anyway to instruct the PPTP VPN connection to send interim accounting packets to the RADIUS server? Warm Regards Ali Majdzadeh Kohbanani 2010/10/8 Ali Majdzadeh ali.majdza...@gmail.com Alan, Thanks a lot.

Re: Problem with MSCHAP

do you REALLY want to accept what the user puts in as the gospel truth? ie, I wouldnt be comfirtable taking the user-supplied domain for the ntlm_auth - I'd set it manually (if it really was a local user!) Good point. Our existing setup uses IAS, and is configured to expect the domain to be

Re: Question about NAS-Port attribute when using freeradiusclient

Alan, Sorry for this third post, I managed to instruct PPTP VPN server (NAS) to send Interim-Update packet by adding the following line to /etc/radiusclient/dictionary: ATTRIBUTEAcct-Interim-Interval 85 integer Of course, I had set Acct-Interim-Interval attribute to 60 for the specific