Re: help

2013-05-28 Thread Giovanni Perna
Hi all, I use only radiusClient : radclient -xf test.tcs ip:port -r1 -s auth secret log received: rad_recv: Access-Accept packet from host IP port 28120, id=20, length=266 radclient: received response to request we did not send. (id=20 socket 3) radclient: no response from server for ID 20

Re: help

2013-05-27 Thread Alan DeKok
Giovanni Perna wrote: Can someone help me? Post the full debug log as suggested in the FAQ, README, man page, web pages, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: RE: Help with chap

2013-05-23 Thread Franks Andy (RLZ) IT Systems Engineer
=sath.nhs...@lists.freeradius.org] On Behalf Of Matthias Nagel Sent: 21 May 2013 23:23 To: freeradius-users@lists.freeradius.org Subject: AW: RE: Help with chap Hello, actually this behaviour is totally correct. The switch tries to authenticate a client, when the switch learns the clients MAC

RE: Help with chap

2013-05-21 Thread Franks Andy (RLZ) IT Systems Engineer
DeKok Sent: 21 May 2013 00:21 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems Engineer wrote: Thanks for the help. Anecdotally, before I get into serious discovery, I've been running the freeradius process in extra debugging mode -xx. I'd read

Re: Help with chap

2013-05-21 Thread Phil Mayers
On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: Can I just use the authorize section to set the password to be the same as the username, i.e. the mac address, after checking some basics like whether the user exists in ldap and perhaps the useraccountcontrol value, then in

RE: Help with chap

2013-05-21 Thread Franks Andy (RLZ) IT Systems Engineer
] On Behalf Of Phil Mayers Sent: 21 May 2013 08:06 To: freeradius-users@lists.freeradius.org Subject: Re: Help with chap On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: Can I just use the authorize section to set the password to be the same as the username, i.e. the mac address

RE: Help with chap

2013-05-21 Thread Franks Andy (RLZ) IT Systems Engineer
- From: freeradius-users-bounces+andy.franks=sath.nhs...@lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 21 May 2013 22:27 To: FreeRadius users mailing list Subject: RE: Help with chap

AW: RE: Help with chap

2013-05-21 Thread Matthias Nagel
-bounces+andy.franks=sath.nhs...@lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 21 May 2013 22:27 To: FreeRadius users mailing list Subject: RE: Help with chap Thanks Phil. I'll keep

Re: Help with chap

2013-05-20 Thread Alan DeKok
Franks Andy (RLZ) IT Systems Engineer wrote: Thanks Alan, It takes literary a second or so for a single client auth, but problems arise with multiple clients. I'll reset a card on the switch and capture the logs and see what's happening. Nothing as far as I remember pointed towards the

RE: Help with chap

2013-05-20 Thread Franks Andy (RLZ) IT Systems Engineer
- From: freeradius-users-bounces+andy.franks=sath.nhs...@lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 20 May 2013 14:01 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems

Re: Help with chap

2013-05-20 Thread Alan DeKok
Franks Andy (RLZ) IT Systems Engineer wrote: Thanks for the help. Anecdotally, before I get into serious discovery, I've been running the freeradius process in extra debugging mode -xx. I'd read somewhere that -X makes it run single threaded, but along those lines of thinking I wondered if

Re: Help with chap

2013-05-18 Thread Alan DeKok
Franks Andy (RLZ) IT Systems Engineer wrote: ... It worked brilliantly in testing, but come production, when i reboot the switch or clear the authentication on the ports it can take up to ten minutes for 10-15 clients to authenticate, That's bad. 10-15 clients should be done in a second or

Re: Help with chap

2013-05-18 Thread Matthias Nagel
Hello, I've recently got into mac based auth on a procurve 5406. [...] [...] when i reboot the switch or clear the authentication on the ports it can take up to ten minutes for 10-15 clients to authenticate, simply because the nas (i guess) gets overwhelmed and consequently I see loads of

RE: Help with chap

2013-05-18 Thread Franks Andy (RLZ) IT Systems Engineer
@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 18 May 2013 13:37 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems Engineer wrote: ... It worked brilliantly in testing, but come production, when i reboot the switch or clear the authentication

Re: [Help] radtest mschap problem

2013-04-27 Thread Andres
Thank you all for your replays, I used SLES 11 freeradius standard package and it was too old, and it was my mistake and took a few days off my life. Hopefully someone else does not make the same mistake Andres 2013/4/27 Alan DeKok al...@deployingradius.com Andres wrote: FreeRADIUS

Re: [Help] radtest mschap problem

2013-04-27 Thread Fajar A. Nugraha
On Sun, Apr 28, 2013 at 1:31 AM, Andres arvutihool...@gmail.com wrote: Thank you all for your replays, I used SLES 11 freeradius standard package and it was too old, and it was my mistake and took a few days off my life. Hopefully someone else does not make the same mistake If all you need

Re: [Help] radtest mschap problem

2013-04-26 Thread Chitrang Srivastava
Most likely your host file didnt have entry of your domain name, dump your hostname and /etc/hosts file here and then we can comment better On Thu, Apr 25, 2013 at 10:52 PM, Andres arvutihool...@gmail.com wrote: Hello All, I'm trying to test mschap with radtest but it gives me strange error

Re: [Help] radtest mschap problem

2013-04-26 Thread Andres
this way looks my hosts file: # IP-Address Full-Qualified-Hostname Short-Hostname # 127.0.0.1 localhost # special IPv6 addresses ::1 localhost ipv6-localhost ipv6-loopback fe00::0 ipv6-localnet ff00::0 ipv6-mcastprefix ff02::1 ipv6-allnodes ff02::2

Re: [Help] radtest mschap problem

2013-04-26 Thread Alan DeKok
Andres wrote: this way looks my hosts file: Well... something is wrong with DNS on your system. The only advantage to using radtest is that it's simpler than radclient. But it's just a wrapper around radclient. You can edit radtest to remove the DNS lookups, or write your own wrapper

Re: [Help] radtest mschap problem

2013-04-26 Thread Chitrang Srivastava
whats the hostname of ur system ? On Fri, Apr 26, 2013 at 6:30 PM, Andres arvutihool...@gmail.com wrote: this way looks my hosts file: # IP-Address Full-Qualified-Hostname Short-Hostname # 127.0.0.1 localhost # special IPv6 addresses ::1 localhost ipv6-localhost

Re: [Help] radtest mschap problem

2013-04-26 Thread Andres
host name is radius ip 10.58.5.58 Full Domain host name: radius.mydomain.com radius .. resolv.conf search mydomain.com nameserver 10.58.5.39 nameserver 10.58.5.45 /etc/hosts 127.0.0.1 localhost # special IPv6 addresses ::1 localhost ipv6-localhost

Re: [Help] radtest mschap problem

2013-04-26 Thread A . L . M . Buxey
Hi, what version of FreeRADIUS? are you sure you arent running old copies of radclient/radtest ie you THINK you can do -t mschap but the wrapper or binary doesnt radclient -v ? which radtest then cat the resulting file. alan - List info/subscribe/unsubscribe? See

Re: [Help] radtest mschap problem

2013-04-26 Thread A . L . M . Buxey
Hi, FreeRADIUS server Version: 2.1.1-7.16.1 also installed freeradius-server-libs and utils FreeRADIUS server and libs and utils was installed via Yast. radius:/etc # radclient -v radclient: $Id$ built on Jan 22 2013 at 23:55:37 # # Version: $Id$ #

Re: [Help] radtest mschap problem

2013-04-26 Thread Alan DeKok
Andres wrote: FreeRADIUS server Version: 2.1.1-7.16.1 also installed freeradius-server-libs and utils Why? That version is SEVEN YEARS old. Upgrade. Really. And you're using a version of radclient which doesn't support mschap. So... why are you trying to use mschap? We presume

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Alan Buxey
Controlled by the NAS and/or the RADIUS server depending on NAS settings. ie you should be able to set session-timeout on the NAS and then override/update the value on the RADIUS server depending on your chosen policies...eg for particular users/clients etc...and if proxying you may have

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Danny Kurniawan
Hi Alan, In which config files do i need to look / edit / add the session timeout in freeradius? Thanks Danny On Tue, Apr 23, 2013 at 3:11 PM, Alan Buxey a.l.m.bu...@lboro.ac.uk wrote: Controlled by the NAS and/or the RADIUS server depending on NAS settings. ie you should be able to set

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread A . L . M . Buxey
Hi, In which config files do i need to look / edit / add the session timeout in freeradius? that would depend on how your configuration is done and what options and methods you are using. 'users' file is basic way, SQL tables are another, unlang is yet another way...eg update reply {

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Danny Kurniawan
Thanks Alan, let me try that. So i can apply this only if the Wireless AP is sending packet with Session-Timeout too right? I don't see this setting in Meraki Wireless AP. I'm using ldap and all the authentication just simple username / password from ldap. Is the the exact syntax to apply with?

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread A . L . M . Buxey
Hi, Thanks Alan, let me try that. So i can apply this only if the Wireless AP is sending packet with Session-Timeout too right? I don't see this setting in Meraki Wireless AP. as i said, depends on your settings and what the NAS is willing to take from the RADIUS server - you'll

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Danny Kurniawan
Thanks again Alex, i will try your syntax. Thanks Danny On Tue, Apr 23, 2013 at 9:25 PM, a.l.m.bu...@lboro.ac.uk wrote: Hi, Thanks Alan, let me try that. So i can apply this only if the Wireless AP is sending packet with Session-Timeout too right? I don't see this setting in

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread A . L . M . Buxey
Hi, Thanks again Alex, i will try your syntax. do you deliberately change words? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Danny Kurniawan
Hi, What you mean? Sorry i think you might mis-understand my previous 2 message. I mean 2 ask what is the correct syntax for update reply Is it exactly like what you said in previous email or else : update reply { Session-Timeout : = 7200 } I will search the documentation again

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread A . L . M . Buxey
Hi, What you mean? see bottom of email Is it exactly like what you said in previous email or else : update reply { Session-Timeout : = 7200 } no, its exactly liek I typed. if you add spaces like you have then the server wont like it alan - List

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Matthew Newton
Hi Danny, On Tue, Apr 23, 2013 at 11:13:46PM +0800, Danny Kurniawan wrote: What you mean? Sorry i think you might mis-understand my previous 2 message. I mean 2 ask what is the correct syntax for update reply Is it exactly like what you said in previous email or else : update reply {

Re: [Help] How to control the authentication session timeout

2013-04-23 Thread Danny Kurniawan
Thanks all. -Danny On Tue, Apr 23, 2013 at 11:59 PM, Matthew Newton m...@leicester.ac.ukwrote: Hi Danny, On Tue, Apr 23, 2013 at 11:13:46PM +0800, Danny Kurniawan wrote: What you mean? Sorry i think you might mis-understand my previous 2 message. I mean 2 ask what is the correct syntax

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-21 Thread Jouni Malinen
On Mon, Mar 18, 2013 at 8:42 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: The old HP switches used to convert the Reply-Message into an EAP-Notification and send it after the EAP-Success or EAP-Failure. This is not compliant with the EAP specification (EAP-Notification needs to be

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-21 Thread Arran Cudbard-Bell
On 21 Mar 2013, at 13:26, Jouni Malinen jkmali...@gmail.com wrote: On Mon, Mar 18, 2013 at 8:42 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: The old HP switches used to convert the Reply-Message into an EAP-Notification and send it after the EAP-Success or EAP-Failure. This is

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-21 Thread David Mitton
Quoting Arran Cudbard-Bell a.cudba...@freeradius.org: On 21 Mar 2013, at 13:26, Jouni Malinen jkmali...@gmail.com wrote: On Mon, Mar 18, 2013 at 8:42 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: The old HP switches used to convert the Reply-Message into an EAP-Notification and

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-21 Thread Arran Cudbard-Bell
On 21 Mar 2013, at 15:56, David Mitton da...@mitton.com wrote: Quoting Arran Cudbard-Bell a.cudba...@freeradius.org: On 21 Mar 2013, at 13:26, Jouni Malinen jkmali...@gmail.com wrote: On Mon, Mar 18, 2013 at 8:42 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: The old HP

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-18 Thread Olivier Beytrison
On 18.03.2013 16:48, Danny Kurniawan wrote: Hi All, So i have been able to authenticate my wireless user using 802.1x + LDAP + MAC address (using CallingStationID attriubute). So now for example when user A have MAC 11:22:33 but tried to login using another device there will be a pop up

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-18 Thread A . L . M . Buxey
hi, we would all love to be able to send a relevant error message to our clients if they fail to authenticate (either locally or remotely). but we cant. :-( alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-18 Thread Danny Kurniawan
Thanks a lot :) Well i guess we just have to live with it :) -Danny On Tue, Mar 19, 2013 at 12:07 AM, a.l.m.bu...@lboro.ac.uk wrote: hi, we would all love to be able to send a relevant error message to our clients if they fail to authenticate (either locally or remotely). but we cant. :-(

Re: [Help] Is that possible to change the reject message that appears at the Windows Pop Up

2013-03-18 Thread Arran Cudbard-Bell
On 18 Mar 2013, at 12:07, a.l.m.bu...@lboro.ac.uk wrote: hi, we would all love to be able to send a relevant error message to our clients if they fail to authenticate (either locally or remotely). but we cant. :-( The old HP switches used to convert the Reply-Message into an

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-13 Thread Danny Kurniawan
Hi All, I already found a way to configure it. Thanks a lot. http://wiki.freeradius.org/guide/Mac-Auth#Note Thanks Danny On Wed, Mar 13, 2013 at 10:14 AM, Danny Kurniawan danny.kurnia...@fairchildsemi.com wrote: Sorry for this beginner question. I have read the man_rlm password but dont

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-12 Thread A . L . M . Buxey
Hi, Is that means we have to manually added the client MAC into radius one by one? well, you want to restrict it to known devicesso ONE way is to add the allowed MACs to a DB - they could be added to some other lookup table. alan - List info/subscribe/unsubscribe? See

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-12 Thread Phil Mayers
On 03/12/2013 01:46 AM, Danny Kurniawan wrote: Is that means we have to manually added the client MAC into radius one by one? RADIUS can only act on RADIUS attributes. There's no RADIUS attribute that says: Device-Type = Bosses iPad Most NASes send username and network address of the

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-12 Thread Alan DeKok
Danny Kurniawan wrote: Is that means we have to manually added the client MAC into radius one by one? You need *some* method to separate known devices from unknown ones. How you do it is up to you. Alan DeKok. - List info/subscribe/unsubscribe? See

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-12 Thread Danny Kurniawan
Noted. I guess using the AP to do the MAC filtering is the best options for me On Tue, Mar 12, 2013 at 9:19 PM, Alan DeKok al...@deployingradius.comwrote: Danny Kurniawan wrote: Is that means we have to manually added the client MAC into radius one by one? You need *some* method to

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-12 Thread Danny Kurniawan
Sorry for this beginner question. I have read the man_rlm password but dont see example how to add the mac address. can some of you showed to me an example of it? I assume its as simple as key in the MAC address into some file in Radius conf file or something? Thanks Danny On Wed, Mar 13, 2013

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-11 Thread Danny Kurniawan
Is that means we have to manually added the client MAC into radius one by one? -Danny On Fri, Mar 8, 2013 at 11:00 PM, Alan DeKok al...@deployingradius.comwrote: Danny Kurniawan wrote: We have successfully deploy Meraki Wireless with Radius 2.1.1 connect to eDir LDAP. Everything works just

Re: [Help] Is there a way to differentiate devices using Radius?

2013-03-08 Thread Alan DeKok
Danny Kurniawan wrote: We have successfully deploy Meraki Wireless with Radius 2.1.1 connect to eDir LDAP. Everything works just fine. Now my company want to explore whether we are able to restrict a devices, that only company devices can connect to our wifi ssid. Is that possible using

Re: Help

2013-03-06 Thread Yann Fouillat
On 03/06/2013 09:23 AM, Jed Gainer wrote: Help - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: [Help] How to eliminate client certificate popup

2013-03-06 Thread Alan Buxey
2. Check fig.9 and fig-10 .. looks like there is an option to cache user information and to 'not prompt user to ...' that I think (cmiiw) will give proper solution. It will stop pop-ups for future connections but not remove pop-ups for initial connection...which is what the requester wants.

Re: Help

2013-03-06 Thread Arran Cudbard-Bell
On 6 Mar 2013, at 03:23, Jed Gainer jedgai...@gmail.com wrote: Help Die potatoe! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Help

2013-03-06 Thread Arran Cudbard-Bell
On 6 Mar 2013, at 09:44, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: On 6 Mar 2013, at 03:23, Jed Gainer jedgai...@gmail.com wrote: Help Die potatoe! *potato - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe?

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread A . L . M . Buxey
Hi, How can i do that? We are using a cert from Global sign and we already have a root ca in our laptop, but we still need to choose that Terminate / Connect popup. It doesnt matter if we need to change our cert or etc, but we just want to eliminate that popup :) its down to the

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread A . L . M . Buxey
Hi, Check https://supportforums.cisco.com/docs/DOC-17544 how many 'how to configure PEAP' documents does the world need? this one has fewer issues than others but still has ambiguityand this guide also contains exactly the same security prompt that the requester DOESNT want ;-) alan - List

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread Phil Mayers
On 03/05/2013 01:58 AM, Danny Kurniawan wrote: Hello, We are using 802.1x wireless connection from Meraki and using PEAP-MSCHAPv2 for authentication with our LDAP. Everything works fine, it just we want to eliminate this pop-up at the 1st time people connect to it : How can i do that? We are

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread Danny Kurniawan
Hi All, Thanks for all your reply. Yes i do understand the solution is to deploy the network profile, but just curious at first who knows any of you have an idea how to eliminate it wthout touching the client. *for example push the profile automatically from the AP etc... But now i guess i will

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread Phil Mayers
On 05/03/13 09:56, Danny Kurniawan wrote: Hi All, Thanks for all your reply. Yes i do understand the solution is to deploy the network profile, but just curious at first who knows any of you have an idea how to eliminate it wthout touching the client. You can't. It's impossible by design -

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread bino
Hi, Check https://supportforums.cisco.com/docs/DOC-17544 how many 'how to configure PEAP' documents does the world need? this one has fewer issues than others but still has ambiguityand this guide also contains exactly the same security prompt that the requester DOESNT want ;-) I

Re: [Help] How to eliminate client certificate popup

2013-03-05 Thread Danny Kurniawan
Thanks for all the reply, means i have to settle it from Client end :) -Danny On Wed, Mar 6, 2013 at 10:30 AM, b...@indoakses-online.com wrote: Hi, Check https://supportforums.cisco.com/docs/DOC-17544 how many 'how to configure PEAP' documents does the world need? this one has fewer

Re: [Help] - How To configure Radius timeout / count retries

2013-03-04 Thread Danny Kurniawan
Noted, thanks in advance. -Danny On Fri, Mar 1, 2013 at 11:04 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: Or are you talking about failing over between upstream proxy servers? Does this mean a setup of Radius load balancing? I mean a few Radius server that used by the same

Re: [Help] How to eliminate client certificate popup

2013-03-04 Thread Danny Kurniawan
Hi, I mean eliminate it without a need to configure WLAN profile on each Windows 7 we have or using Intel Pro software etc.. I would like to know if anyone ever know how we can eliminate this from let say tweak the cert or some radius config. Thanks Danny On Tue, Mar 5, 2013 at 9:58 AM, Danny

Re: [Help] How to eliminate client certificate popup

2013-03-04 Thread bino
Hi, I mean eliminate it without a need to configure WLAN profile on each Windows 7 we have or using Intel Pro software etc.. I would like to know if anyone ever know how we can eliminate this from let say tweak the cert or some radius config. I don\'t think it\'s about radius

Re: [Help] - How To configure Radius timeout / count retries

2013-03-01 Thread Arran Cudbard-Bell
Or are you talking about failing over between upstream proxy servers? Does this mean a setup of Radius load balancing? I mean a few Radius server that used by the same AP ? So from AP point of view i just need to point to the master Ip address of the first radius server? No. That's

Re: [Help] - How To configure Radius timeout / count retries

2013-02-28 Thread Arran Cudbard-Bell
Let say for example in our Wireless AP (access point) we can put 2 Radius server in sequence, radiusA and radiusB. I know the AP will eventually look at the 1st server, and if its not available (let say server is down) then it will go to the 2nd radius server (I only assume this). So

Re: [Help] - How To configure Radius timeout / count retries

2013-02-28 Thread Danny Kurniawan
Hello, This is what i want to do : You're asking whether you can configure FreeRADIUS to inform the access point that it should fail over to another server server after a given number of timeouts/retries? Thanks Danny -- Best Regards, Danny - List info/subscribe/unsubscribe? See

Re: [Help] - How To configure Radius timeout / count retries

2013-02-28 Thread Danny Kurniawan
Out of topic : All, btw how can i make sure that when i reply in this mailing list it appears after the previous post ? I dont receieve any of your reply in my email and i have to go to the archive list to reply this. Thanks -- Best Regards, Danny - List info/subscribe/unsubscribe? See

Re: [Help] - How To configure Radius timeout / count retries

2013-02-28 Thread Arran Cudbard-Bell
On 1 Mar 2013, at 00:20, Danny Kurniawan danny.kurnia...@fairchildsemi.com wrote: Out of topic : All, btw how can i make sure that when i reply in this mailing list it appears after the previous post ? I dont receieve any of your reply in my email and i have to go to the archive list to

Re: [Help] - How To configure Radius timeout / count retries

2013-02-28 Thread Danny Kurniawan
No worries, i receive this mailing list on my email now.. OK, so i also understand that we can only configure that from the AP side. But unfortunately we cant find that in the Meraki AP ... let me check with our vendor on it. Thanks Danny On Fri, Mar 1, 2013 at 2:26 PM, Arran Cudbard-Bell

Re: [Help] - How To configure Radius timeout / count retries

2013-02-28 Thread Danny Kurniawan
Arran, * Let say for example in our Wireless AP (access point) we can put 2 Radius server in sequence, radiusA and radiusB. I know the AP will eventually look at the 1st server, and if its not available (let say server is down) then it will go to the 2nd radius server (I only assume this). **

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-02-03 Thread pradyumna dash
Hi, Am still struggling to get the accounting details, am not getting any value-attr pair or Reply message, However authentication works fine. Regards, /Neo On Mon, Jan 28, 2013 at 3:26 PM, a.l.m.bu...@lboro.ac.uk wrote: Hi, Am not able to see my authorization happening because I

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-28 Thread Pradyumna
Hi, Am not able to see my authorization happening because I don't see the value-attr or reply message. Please help. Logs attached. rad_recv: Access-Request packet from host 192.168.0.2 port 39662, id=92, length=62 User-Name = radiustest User-Password = password@123

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-28 Thread A . L . M . Buxey
Hi, Am not able to see my authorization happening because I don't see the value-attr or reply message. Please help. Logs attached. please do not email me and the freeradius users mailing list. much like the other Alan, I am already on that list and so choose to read/reply. I'm not your

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-24 Thread pradyumna dash
Hi, Thanks for the suggestion. The below setup is now working for me. I. Users are getting authenticated from the AD server II. I have configured the switch to send the accounting logs to TACACS and its working But am not able to see the value-attribute pair which i have passed, I can login to

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-24 Thread A . L . M . Buxey
Hi, you need whitspace before the service-type and cisco VSA lines after your auth line (they are reply items.not check items) - if you run in debug mode (radiusd -X or freeradius -X on some distros) you can confirm from the output that the VSA/TLV are being sent to the client (switch). if

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-24 Thread pradyumna dash
Hi Alan, Thanks for your reply. Do you mean the below in the users file? cisco Auth-Type := LDAP Service-Type = Administrative-User, cisco-avpair = shell:priv-lvl=15 Regards, /Neo On Thu, Jan 24, 2013 at 11:19 PM, a.l.m.bu...@lboro.ac.uk wrote: Hi, you need whitspace before the

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-24 Thread Alan DeKok
pradyumna dash wrote: But am not able to see the value-attribute pair which i have passed, I can login to the switch with the AD user account but am landing at the prompt and the priv showing 1, Where as i have passed the priv level 15 , So not sure how to fix this. PFA the configuration

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-24 Thread A . L . M . Buxey
Hi, Do you mean the below in the users file? cisco Auth-Type := LDAP Service-Type = Administrative-User, cisco-avpair = shell:priv-lvl=15 no. cisco Auth-Type := LDAP Service-Type = Administrative-User, cisco-avpair = shell:priv-lvl=15 (see all the examples

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-22 Thread Pradyumna
Hi, Thanks I have now configured the freeradius and the Cisco switch is now getting authenticated against the AD user but I can't see the commands executed in the switch by this user in the radius account log. Is it possible to see the command executed in accounting log ? Regards, /Neo Sent

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-22 Thread A . L . M . Buxey
Hi, Thanks I have now configured the freeradius and the Cisco switch is now getting authenticated against the AD user but I can't see the commands executed in the switch by this user in the radius account log. follow the cisco docs for configuring your device for RADIUS accounting.and

Re: help with proxy settings for EDUROAM

2013-01-21 Thread Olivier Beytrison
On 21.01.2013 16:39, Hocine M wrote: Hello, Could anyone help me? I'm trying setting up freeradius 2.1.12 for eduroam. The local auth works well, but the proxy part not so. First you should have a look at

Re: help with proxy settings for EDUROAM

2013-01-21 Thread A . L . M . Buxey
hi, as already mentined, there is the eduroam confluence wiki for further documentation. your request was proxied offbut not answered. ask for someone to check the logs on the next hop - or at the final target RADIUS to see if they got the requests through however, your eduroam

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-20 Thread Arran Cudbard-Bell
On 20 Jan 2013, at 07:31, pradyumna dash neomatrix...@gmail.com wrote: Hi Team, Were a community. I need a help, am new to RADIUS and i need the below to be configured. I. FreeRADIUS integration with Microsoft AD

Re: Help Needed !!! FreeRADIUS Integration with MS AD

2013-01-20 Thread A . L . M . Buxey
Hi, I. FreeRADIUS integration with Microsoft AD http://deployingradius.com/documents/configuration/active_directory.html II. Cisco switches needs to be the client http://www.cisco.com/cisco/web/support/index.html find your switch model and the documents for it. II. The

Re: help with DHCP server functionality

2012-11-11 Thread Fajar A. Nugraha
On Fri, Nov 2, 2012 at 6:30 AM, Duane Cox duane...@gmail.com wrote: OK, that solved my dilemma of no Pool-Name defined, thanks! Hmmm ... this just arrived in my mailbox. Anyway, in case you still need the response ... What are other operators doing to determine the appropriate pool? What

RE: help with DHCP server functionality

2012-11-09 Thread Duane Cox
: freeradius-users-bounces+duanecox=gmail@lists.freeradius.org [mailto:freeradius-users-bounces+duanecox=gmail@lists.freeradius.org ] On Behalf Of Fajar A. Nugraha Sent: Thursday, November 01, 2012 4:58 PM To: FreeRadius users mailing list Subject: Re: help with DHCP server functionality On Fri

Re: help with DHCP server functionality

2012-11-03 Thread Duane Cox
Thanks Fajar, that did help me get past this hurdle. Pressing forward with the dhcp side... Thanks, Duane Sent from my iPad by Verizon Wireless On Nov 1, 2012, at 4:59 PM, Fajar A. Nugraha l...@fajar.net wrote: On Fri, Nov 2, 2012 at 3:19 AM, Duane Cox duane...@gmail.com wrote: List:

Re: help with DHCP server functionality

2012-11-01 Thread Fajar A. Nugraha
On Fri, Nov 2, 2012 at 3:19 AM, Duane Cox duane...@gmail.com wrote: List: Hello. I have been working on this for a few days and have turned here for help. The server is listening on port 67 and when a DHCP packet comes in the server processes it, but in debug mode it give an error No

Re: help - simultaneous accounting

2012-10-09 Thread Johan Meiring
On 2012/10/09 02:21 AM, 劉君羿 wrote: I am using *Chillispot* on my NAS. But it doesn't seem to support CoA. Can you suggest other AP controllers? By the way, I though concurrent accounting was a feature that should be supported. I wonder why it's not supported by the major AAA protocols. Afaik

Re: help - simultaneous accounting

2012-10-08 Thread 劉君羿
I am using *Chillispot* on my NAS. But it doesn't seem to support CoA. Can you suggest other AP controllers? By the way, I though concurrent accounting was a feature that should be supported. I wonder why it's not supported by the major AAA protocols. - List info/subscribe/unsubscribe? See

Re: help - simultaneous accounting

2012-10-08 Thread Fajar A. Nugraha
On Tue, Oct 9, 2012 at 7:21 AM, 劉君羿 trantor@gmail.com wrote: I am using Chillispot on my NAS. But it doesn't seem to support CoA. Really? How did you determine that? Can you suggest other AP controllers? http://lmgtfy.com/?q=chillispot%20coa%20disconnect See top result -- Fajar - List

Re: help - simultaneous accounting

2012-10-08 Thread 劉君羿
Sorry, my fault.. I just take a look at ChilliSpot radius.h, and there's code about coa. Thank you! 2012/10/9 Fajar A. Nugraha l...@fajar.net On Tue, Oct 9, 2012 at 7:21 AM, 劉君羿 trantor@gmail.com wrote: I am using Chillispot on my NAS. But it doesn't seem to support CoA. Really? How did

Re: help - simultaneous accounting

2012-10-06 Thread Fajar A. Nugraha
On Sat, Oct 6, 2012 at 2:38 PM, 劉君羿 trantor@gmail.com wrote: I want to allow simultaneous use of accounts. However, RFC 2866 says that the Acct-Session-Time can only be present in Accounting-Request records where the Acct-Status-Type is set to Stop [Page 17] Look for Interim Accounting

Re: help - simultaneous accounting

2012-10-06 Thread Alan DeKok
劉君羿 wrote: I want to allow simultaneous use of accounts. However, *RFC 2866 *says that the* Acct-Session-Time* can only be present in Accounting-Request records where the Acct-Status-Type is set to Stop [Page 17] Does this mean that RADIUS protocol can not manage simultaneous

Re: Help with 802.1x Certificate

2012-09-14 Thread Phil Mayers
On 14/09/12 14:46, Tyller D wrote: Hi all, I would like to use FreeRadius to do 802.1x EAP-PEAP for wireless users. I have everything configured and working when I disabled validate server Certificate on windows. I have a wildcard certificate purchased from godaddy.com http://godaddy.com.

Re: Help with 802.1x Certificate

2012-09-14 Thread Alan DeKok
Tyller D wrote: I have everything configured and working when I disabled validate server Certificate on windows. I have a wildcard certificate purchased from godaddy.com. I'm not sure that will work. I had a problem when using it with apache as I had to add the intermediate chain in the

Re: Help with 802.1x Certificate

2012-09-14 Thread Tyller D
On Fri, Sep 14, 2012 at 4:07 PM, Alan DeKok al...@deployingradius.comwrote: Tyller D wrote: I have everything configured and working when I disabled validate server Certificate on windows. I have a wildcard certificate purchased from godaddy.com. I'm not sure that will work. Is there

Re: Help with 802.1x Certificate

2012-09-14 Thread Phil Mayers
On 14/09/12 15:38, Tyller D wrote: On Fri, Sep 14, 2012 at 4:07 PM, Alan DeKok al...@deployingradius.com mailto:al...@deployingradius.com wrote: Tyller D wrote: I have everything configured and working when I disabled validate server Certificate on windows. I have a

  1   2   3   4   5   6   7   8   >