Re: accounting-start proxy error

2002-08-13 Thread Josh . Howlett 

>> It works fine for authentication request/accept and accounting-stop, but
>> my  NAS complains about the accounting-start messages:
>
>   Then it's most likely a problem with the attributes in the
> accounting start packet.
>
>>  WARNING: Identifier does not match - ignoring response
>>  WARNING: Invalid response signature - check secret!
>
>   If the first message is true, then the second is a caused by the
> first.
>
>   You say that the NAS complains about the accounting-start packet,
> but FreeRADIUS never sends one to the NAS, it only sends an
> Accounting-Response packet.  So where does this message come from, and
> when does it happen?

Sorry, my mistake, I meant Accounting-Request.

   This is what Freeradius gets from the NAS:

rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx:, id=120, 
length=149
Acct-Delay-Time = 8
NAS-IP-Address = xxx.xxx.xxx.xxx
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Identifier = ""
Acct-Status-Type = Start
Acct-Session-Id = "3b7a0001"
Acct-Authentic = RADIUS
User-Name = "x"

   This is what Freeradius proxies to MS IAS:

Sending Accouting-Request of id 22 to xxx.xxx.xxx.xxx:
Acct-Delay-Time = 8
NAS-IP-Address = xxx.xxx.xxx.xxx
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Identifier = ""
Acct-Status-Type = Start
Acct-Session-Id = "3b7a0001"
Acct-Authentic = RADIUS
User-Name = "x"
Proxy-State = "120"

   Freeradius gets the following back from MS IAS:

rad_recv: Accouting-Response packet from xxx.xxx.xxx.xxx:, id=22, 
length=25
Proxy-State = 0x313230

   And sends it on to the NAS:

Sending Accouting-Response of id 120 to xxx.xxx.xxx.xxx:xx

   And the NAS generates the error:

WARNING: Identifier does not match - ignoring response
WARNING: Invalid response signature - check secret!

Josh Howlett, Networking and Digital Communications Group,
Information Systems & Computing, University of Bristol.
email: [EMAIL PROTECTED] | phone: +44 (0)117 928 7850

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: accounting-start proxy error

2002-08-11 Thread Alan DeKok 

[EMAIL PROTECTED] wrote:
> It works fine for authentication request/accept and accounting-stop, but my 
> NAS complains about the accounting-start messages:

  Then it's most likely a problem with the attributes in the
accounting start packet.
 
>   WARNING: Identifier does not match - ignoring response
>   WARNING: Invalid response signature - check secret!

  If the first message is true, then the second is a caused by the
first.

  You say that the NAS complains about the accounting-start packet,
but FreeRADIUS never sends one to the NAS, it only sends an
Accounting-Response packet.  So where does this message come from, and
when does it happen?

> It seems strange that freeradius is only complaining about accounting-stop, 
> so it looks to me like freeradius is mis-handling accounting-start when 
> proxying them.

  I don't see why it would be treated any differently than any other
accounting messages...

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

accounting-start proxy error

2002-08-11 Thread Josh . Howlett 

(apologies, re-sent with meaningful Subject field).

Hi,

I have freeradius 0.6 acting as a proxy for authentication and accounting.

It works fine for authentication request/accept and accounting-stop, but my 
NAS complains about the accounting-start messages:

WARNING: Identifier does not match - ignoring response
WARNING: Invalid response signature - check secret!

Freeradius does not generate any error messages in debug mode (-X).

It seems strange that freeradius is only complaining about accounting-stop, 
so it looks to me like freeradius is mis-handling accounting-start when 
proxying them.  Has anyone else seen this behaviour?

josh.

Josh Howlett, Networking and Digital Communications Group,
Information Systems & Computing, University of Bristol.
email: [EMAIL PROTECTED] | phone: +44 (0)117 928 7850

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html