Here's a weird one- wondering if anyone else may have experienced the
same using LWAPP, WiSMs, 802.1x, and Cisco ACS.
RADIUS Accounting log sample:
Client Calling ID
Framed IP Address
Controller
6/10/2008
10:43:03
User1
Default Group
128.230.190.150
Start
484e92f6/00:17:f2:ef:21:a8/480066
128.230.85.69
29
10.21.0.21
6/10/2008
10:43:10
User1
Default Group
128.230.190.150
Start
484e92f6/00:17:f2:ef:21:a8/480066
128.230.193.201
29
10.21.0.21
6/10/2008
10:43:17
User1
Default Group
128.230.190.150
Start
484e92f6/00:17:f2:ef:21:a8/480066
128.230.106.64
29
10.21.0.43
6/10/2008
10:43:24
User1
Default Group
128.230.190.150
Start
484e92f6/00:17:f2:ef:21:a8/480066
128.230.45.246
29
10.21.0.41
6/10/2008
10:43:31
User1
Default Group
128.230.190.150
Start
484e92f6/00:17:f2:ef:21:a8/480066
128.230.195.59
29
10.21.0.23
6/10/2008
10:43:38
User1
Default Group
128.230.190.150
Start
484e92f6/00:17:f2:ef:21:a8/480066
128.230.149.78
29
10.21.0.29
Single user, multiple RADIUS starts reported, seven seconds apart. User
IP (client calling ID) not matching Framed IP Address- and controllers
that have APs that can't possibly be within client earshot all claiming
to forward the RADIUS logging...
If you look at the end column, it shows what controller is sending the
RADIUS start. In this case, 6 different controllers are sending a
"start". In the framed IP address column, there is no real-world
indication that those addresses are being used in any shape or form- and
many of them are on a different network than the user address in the
Client Calling ID space. Sorta feels like corrupt data being reported.
We are seeing this frequently enough to be noteworthy- but clients are
sailing through the authentication process with absolutely no trouble or
signs of behind-the scenes weirdness. Have opened a TAC case- but
thought I'd float this to the group. (I can't tie this to any of the
150+ open caveats on the WiSMs).
Thanks-
Lee
Lee H. Badman
Wireless/Network Engineer
Information Technology and Services
Syracuse University
315 443-3003
**********
Participation and subscription information for this EDUCAUSE Constituent Group
discussion list can be found at http://www.educause.edu/groups/.
