Pfsense/Freeradius: Ignoring request to auth address ...



  • Hello All,

    I'm using FreeRadius in Pfsense for Mac Address Authentication to authenticate specific Wifi devices connected to Ruckus Virtual Smartzone.
    This gives me the possibility to determine in which vlan the device will connect, based on the given vlan ID. (Dynamic Vlan)

    In Ruckus Virtual Smartzone i have configured 1 SSID (MacAddressOnly) with authentication "Mac Address" + WPA2 encryption.
    The Pfsense box with FreeRadius is configured as Authentication Server.

    In Pfsense i have configured 10.0.90.0 als Client IP Address in NAS / Clients. 10.0.90.0 is the network of the Wifi AP's/Controller. The Client Shared Secret matches.

    When i try to connect to the SSID i get the different kind of error messages:

    • On the Ruckus Controller: failed to join WLAN, due to authentication failure.
    • On the Pfsense box when running Radiusd -X: Ignore Request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.10 (which is the Wifi AP) port 41949 proto UDP
    • On the Wireless device (Iphone) Incorrect password for network.

    The WPA2 passphrase is correct, and the Mac Address is also correct.

    I've tried with other Wireless devices, rebooted the Pfsense and Ruckus box.
    This was working before but suddenly it stopped and i don't know why? I have updated the Pfsense box to 2.4.4-RELEASE-p2 some time ago, but i can't confirm it stopped working since then.

    Configuration Details Pfsense Box:
    radiusd.conf

    /usr/local/etc/raddb/radiusd.conf
    prefix = /usr/local
    exec_prefix = ${prefix}
    sysconfdir = ${prefix}/etc
    localstatedir = /var
    sbindir = ${exec_prefix}/sbin
    logdir = ${localstatedir}/log
    raddbdir = ${sysconfdir}/raddb
    radacctdir = ${logdir}/radacct
    name = radiusd
    confdir = ${raddbdir}
    modconfdir = ${confdir}/mods-config
    certdir = ${confdir}/certs
    cadir = ${confdir}/certs
    run_dir = ${localstatedir}/run
    db_dir = ${raddbdir}
    libdir = /usr/local/lib/freeradius-3.0.17
    pidfile = ${run_dir}/${name}.pid
    max_request_time = 30
    cleanup_delay = 5
    max_requests = 1024
    hostname_lookups = no
    regular_expressions = yes
    extended_expressions = yes
    
    log {
    	destination = syslog
    	colourise = yes
    	file = ${logdir}/radius.log
    	syslog_facility = daemon
    	stripped_names = no
    	auth = yes
    	auth_badpass = yes
    	auth_goodpass = yes
    	msg_goodpass = ""
    	msg_badpass = ""
    	msg_denied = "You are already logged in - access denied"
    }
    
    checkrad = ${sbindir}/checkrad
    security {
    	allow_core_dumps = no
    	max_attributes = 200
    	reject_delay = 1
    	status_server = no
    	# Disable this check since it may not be accurate due to how FreeBSD patches OpenSSL
    	allow_vulnerable_openssl = yes
    }
    
    $INCLUDE  clients.conf
    thread pool {
    	start_servers = 5
    	max_servers = 32
    	min_spare_servers = 3
    	max_spare_servers = 10
    	max_queue_size = 65536
    	max_requests_per_server = 0
    	auto_limit_acct = no
    }
    
    modules {
    	$INCLUDE ${confdir}/mods-enabled/
    }
    
    instantiate {
    	exec
    	expr
    	expiration
    	logintime
    	### Dis-/Enable sql instatiate
    	#sql
    	daily
    	weekly
    	monthly
    	forever
    }
    policy {
    	$INCLUDE policy.d/
    }
    $INCLUDE sites-enabled/
    

    eap

    /usr/local/etc/raddb/mods-enabled/eap
    ### EAP
    eap {
    	default_eap_type = mschapv2
    	timer_expire     = 60
    	ignore_unknown_eap_types = no
    	cisco_accounting_username_bug = no
    	max_sessions = 4096
    
    ### DISABLED WEAK EAP TYPES MD5, GTC, LEAP ###
    
    #	pwd {
    #		group = 19
    #		server_id = theserver@example.com
    #		fragment_size = 1020
    #		virtual_server = "inner-tunnel"
    #	}
    
    	tls-config tls-common {
    		# private_key_password = whatever
    		private_key_file = ${certdir}/server_key.pem
    		certificate_file = ${certdir}/server_cert.pem
    		ca_path = ${confdir}/certs
    		ca_file = ${ca_path}/ca_cert.pem
    	#	auto_chain = yes
    	#	psk_identity = "test"
    	#	psk_hexphrase = "036363823"
    		dh_file = ${certdir}/dh
    		random_file = /dev/urandom
    		fragment_size = 1024
    		include_length = yes
    		check_crl = no
    		### check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd/emailAddress=test@mycomp.com/CN=myca" ###
    		### check_cert_cn = %{User-Name} ###
    		cipher_list = "DEFAULT"
    		cipher_server_preference = no
    #		disable_tlsv1_2 = no
    		ecdh_curve = "prime256v1"
    		cache {
    			enable = no
    			lifetime = 24
    			max_entries = 255
    			#name = "EAP module"
    			#persist_dir = "/tlscache"
    		}
    		verify {
    	#		skip_if_ocsp_ok = no
    	#		tmpdir = /tmp/radiusd
    	#		client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
    		}
    		ocsp {
    			enable = no
    			override_cert_url = no
    			url = "http://127.0.0.1/ocsp/"
    			# use_nonce = yes
    			# timeout = 0
    			# softfail = no
    		}
    	}
    	tls {
    		tls = tls-common
    	#	virtual_server = check-eap-tls
    	}
    	ttls {
    		tls = tls-common
    		default_eap_type = mschapv2
    		copy_request_to_tunnel = no
    		include_length = yes
    	#	require_client_cert = yes
    		virtual_server = "inner-tunnel-ttls"
    		#use_tunneled_reply is deprecated, new method happens in virtual-server
    	}	### end ttls
    	peap {
    		tls = tls-common
    		default_eap_type = mschapv2
    		copy_request_to_tunnel = no
    	#	proxy_tunneled_request_as_eap = yes
    	#	require_client_cert = yes
    ### MS SoH Server is disabled ###
    
    		virtual_server = "inner-tunnel-peap"
    		#use_tunneled_reply is deprecated, new method happens in virtual-server
    	}
    	mschapv2 {
    #		send_error = no
    #		identity = "FreeRADIUS"
    	}
    #	fast {
    #		tls = tls-common
    #		pac_lifetime = 604800
    #		authority_identity = "1234"
    #		pac_opaque_key = "0123456789abcdef0123456789ABCDEF"
    #		virtual_server = inner-tunnel
    #	}
    }
    

    clients.conf

    /usr/local/etc/raddb/clients.conf
    
    client "Ruckus" {
    	ipaddr = 10.0.90.0
    	proto = udp
    	secret = 'test'
    	require_message_authenticator = no
    	nas_type = other
    	### login = !root ###
    	### password = someadminpass ###
    	limit {
    		max_connections = 16
    		lifetime = 0
    		idle_timeout = 30
    	}
    }
    

    macs

    /usr/local/etc/raddb/authorized_macs
    
    7c-d1-c3-6c-ab-2a Cleartext-Password := "7c-d1-c3-6c-ab-2a"
    	
    	Tunnel-Type = VLAN,
    	Tunnel-Medium-Type = IEEE-802,
    	Tunnel-Private-Group-ID = "80"
    

    virtual-server-default

    /usr/local/etc/raddb/sites-enabled/default
    server default {
    listen {
    	type = auth
    	ipaddr = 10.0.0.252
    	port = 1812
    }
    
    authorize {
    #	filter_username
    #	filter_password
    	preprocess
    #	operator-name
    #	cui
    ##### AUTHORIZE FOR PLAIN MAC-AUTH IS DISABLED #####
    #	auth_log
    	chap
    	mschap
    	digest
    #	wimax
    #	IPASS
    	suffix
    	ntdomain
    	eap {
    		ok = return
    #		updated = return
    	}
    #	unix
    	files
    	### sql DISABLED ###
    	daily
    	weekly
    	monthly
    	forever
    #	smbpasswd
    ### ldap ###
    	# Formerly checkval
    	if (&request:Calling-Station-Id == &control:Calling-Station-Id) {
    		ok
    	}
    	expiration
    	logintime
    	pap
    	Autz-Type Status-Server {
    
    	}
    }
    
    authenticate {
    	Auth-Type PAP {
    		pap
    	}
    	Auth-Type CHAP {
    		chap
    	}
    	Auth-Type MS-CHAP {
    		mschap
    	}
    	mschap
    	Auth-Type MOTP {
    		motp
    	}
    	Auth-Type GOOGLEAUTH {
    		googleauth
    	}
    	digest
    #	pam
    #	unix
    
    	#Auth-Type LDAP {
    		#ldap
    		#### ldap2 disabled ###
    	#}
    
    	eap
    #	Auth-Type eap {
    #		eap {
    #			handled = 1
    #		}
    #		if (handled && (Response-Packet-Type == Access-Challenge)) {
    #			attr_filter.access_challenge.post-auth
    #			handled  # override the "updated" code from attr_filter
    #		}
    #	}
    }
    
    preacct {
    	preprocess
    ##### ACCOUNTING FOR PLAIN MAC-AUTH DISABLED #####
    #	acct_counters64
    	update request {
    		&FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
    	}
    acct_unique
    #	IPASS
    	suffix
    	ntdomain
    	files
    }
    
    accounting {
    #	cui
    	detail
    	### This makes it possible to run the datacounter_acct module only on accounting-stop and interim-updates
    	if ((request:Acct-Status-Type == Stop) || (request:Acct-Status-Type == Interim-Update)) {
    		datacounterdaily
    		datacounterweekly
    		datacountermonthly
    		datacounterforever
    	}
    #	unix
    	radutmp
    #	sradutmp
    #	main_pool
    	### sql DISABLED ###
    	daily
    	weekly
    	monthly
    	forever
    #	if (noop) {
    #		ok
    #	}
    #	pgsql-voip
    	exec
    	attr_filter.accounting_response
    	Acct-Type Status-Server {
    
    	}
    }
    
    session {
    #	radutmp
    	radutmp
    }
    
    post-auth {
    #	if (!&reply:State) {
    #		update reply {
    #			State := "0x%{randstr:16h}"
    #		}
    #	}
    	update {
    		&reply: += &session-state:
    	}
    #	main_pool
    #	cui
    #	reply_log
    ### sql DISABLED ###
    #	ldap
    	exec
    #	wimax
    #	update reply {
    #		Reply-Message += "%{TLS-Cert-Serial}"
    #		Reply-Message += "%{TLS-Cert-Expiration}"
    #		Reply-Message += "%{TLS-Cert-Subject}"
    #		Reply-Message += "%{TLS-Cert-Issuer}"
    #		Reply-Message += "%{TLS-Cert-Common-Name}"
    #		Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
    #
    #		Reply-Message += "%{TLS-Client-Cert-Serial}"
    #		Reply-Message += "%{TLS-Client-Cert-Expiration}"
    #		Reply-Message += "%{TLS-Client-Cert-Subject}"
    #		Reply-Message += "%{TLS-Client-Cert-Issuer}"
    #		Reply-Message += "%{TLS-Client-Cert-Common-Name}"
    #		Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
    #	}
    #	insert_acct_class
    #	if (&reply:EAP-Session-Id) {
    #		update reply {
    #			EAP-Key-Name := &reply:EAP-Session-Id
    #		}
    #	}
    	remove_reply_message_if_eap
    	Post-Auth-Type REJECT {
    		# log failed authentications in SQL, too.
    		# sql
    		attr_filter.access_reject
    		eap
    		remove_reply_message_if_eap
    	}
    	Post-Auth-Type Challenge {
    
    	}
    }
    
    pre-proxy {
    #	operator-name
    #	cui
    #	files
    	attr_filter.pre-proxy
    #	pre_proxy_log
    }
    
    post-proxy {
    
    #	post_proxy_log
    	attr_filter.post-proxy
    	eap
    #	Post-Proxy-Type Fail-Accounting {
    #			detail
    #	}
    }
    }
    

  • Galactic Empire

    Run radsniff -x from the console, you may see something that points to the issue



  • @NogBadTheBad It looks like the NAS client is sending an Access-Request 3 times but FreeRadius is not replying.



  • @joriz said in Pfsense/Freeradius: Ignoring request to auth address ...:

    @NogBadTheBad It looks like the NAS client is sending an Access-Request 3 times but FreeRadius is not replying.

    ??

    radiusd -X
    

    starts the FreeRadius server.
    So, it shows what it does, and it shows what it receives. And also what it sends back.
    If FreeRadius receives a "Access-Request" it will do something with it. I don't think that "let neglect that one" is what really happens.

    Instead of saying : "it looks like", I propose a little Cut&Paste exercise so we can see what you think you see.

    edit :
    Again :
    First : stop FreeRadius in the GUI.
    Connect to the console, and use option 8. Typically, use a SSH client to do this - or the "cable".
    Now run

    radiusd -X
    

    (capital X !)



  • Sorry for the missing Cut&Paste. Here we go.

    radsnif -X

    2019-05-31 15:57:20.171507 (4) ** rtx ** Access-Request Id 0 em1:10.0.90.11:32885 -> 10.0.0.252:1812 +21.832
    	User-Name = "78-67-d7-1b-11-d9"
    	User-Password = "q]\263\000k\245\235\206CVd\243~u\216q\225\305\344\361ȫ\243\364\345\001\235\316t\023ݶ"
    	NAS-IP-Address = 10.0.90.11
    	Service-Type = Framed-User
    	Called-Station-Id = "94-F6-65-1C-8B-E9:Known MAC Addresses"
    	Calling-Station-Id = "78-67-D7-1B-11-D9"
    	NAS-Identifier = "94-F6-65-1C-8B-E9"
    	NAS-Port-Type = Wireless-802.11
    	Message-Authenticator = 0xe8a4f5d9e469664a40dbf0c40ca2e3ec
    	Ruckus-SSID = "MacAddressOnly"
    	Ruckus-Wlan-Id = 8
    	Ruckus-Location = "Upstairs"
    	Ruckus-SCG-CBlade-IP = 167790081
    	Ruckus-VLAN-ID = 1
    	Ruckus-BSSID = 0x94f6651c8be9
    	Authenticator-Field = 0x1be4d02595e926202612051b1d9c5f01
    2019-05-31 15:57:25.371507 (4) ** norsp ** Access-Request Id 0 em1:10.0.90.11:32885 -> 10.0.0.252:1812
    2019-05-31 15:57:25.371507 (4) Cleaning up request packet ID 0
    

    radiusd -X

    FreeRADIUS Version 3.0.17
    Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
    There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
    PARTICULAR PURPOSE
    You may redistribute copies of FreeRADIUS under the terms of the
    GNU General Public License
    For more information about these matters, see the file named COPYRIGHT
    Starting - reading configuration files ...
    including dictionary file /usr/local/share/freeradius/dictionary
    including dictionary file /usr/local/share/freeradius/dictionary.dhcp
    including dictionary file /usr/local/share/freeradius/dictionary.vqp
    including dictionary file /usr/local/etc/raddb/dictionary
    including configuration file /usr/local/etc/raddb/radiusd.conf
    including configuration file /usr/local/etc/raddb/clients.conf
    including files in directory /usr/local/etc/raddb/mods-enabled/
    including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
    including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
    including configuration file /usr/local/etc/raddb/mods-enabled/chap
    including configuration file /usr/local/etc/raddb/mods-enabled/date
    including configuration file /usr/local/etc/raddb/mods-enabled/detail
    including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
    including configuration file /usr/local/etc/raddb/mods-enabled/digest
    including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
    including configuration file /usr/local/etc/raddb/mods-enabled/eap
    including configuration file /usr/local/etc/raddb/mods-enabled/echo
    including configuration file /usr/local/etc/raddb/mods-enabled/exec
    including configuration file /usr/local/etc/raddb/mods-enabled/expiration
    including configuration file /usr/local/etc/raddb/mods-enabled/expr
    including configuration file /usr/local/etc/raddb/mods-enabled/files
    including configuration file /usr/local/etc/raddb/mods-enabled/linelog
    including configuration file /usr/local/etc/raddb/mods-enabled/logintime
    including configuration file /usr/local/etc/raddb/mods-enabled/mschap
    including configuration file /usr/local/etc/raddb/mods-enabled/realm
    including configuration file /usr/local/etc/raddb/mods-enabled/pap
    including configuration file /usr/local/etc/raddb/mods-enabled/passwd
    including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
    including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
    including configuration file /usr/local/etc/raddb/mods-enabled/counter
    including configuration file /usr/local/etc/raddb/mods-enabled/replicate
    including configuration file /usr/local/etc/raddb/mods-enabled/soh
    including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
    including configuration file /usr/local/etc/raddb/mods-enabled/unix
    including configuration file /usr/local/etc/raddb/mods-enabled/always
    including configuration file /usr/local/etc/raddb/mods-enabled/unpack
    including configuration file /usr/local/etc/raddb/mods-enabled/utf8
    including configuration file /usr/local/etc/raddb/mods-enabled/motp
    including configuration file /usr/local/etc/raddb/mods-enabled/googleauth
    including configuration file /usr/local/etc/raddb/mods-enabled/datacounter_acct
    including files in directory /usr/local/etc/raddb/policy.d/
    including configuration file /usr/local/etc/raddb/policy.d/accounting
    including configuration file /usr/local/etc/raddb/policy.d/canonicalization
    including configuration file /usr/local/etc/raddb/policy.d/control
    including configuration file /usr/local/etc/raddb/policy.d/cui
    including configuration file /usr/local/etc/raddb/policy.d/debug
    including configuration file /usr/local/etc/raddb/policy.d/dhcp
    including configuration file /usr/local/etc/raddb/policy.d/eap
    including configuration file /usr/local/etc/raddb/policy.d/filter
    including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
    including configuration file /usr/local/etc/raddb/policy.d/operator-name
    including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
    including configuration file /usr/local/etc/raddb/policy.d/pfs_custom_policies
    including files in directory /usr/local/etc/raddb/sites-enabled/
    including configuration file /usr/local/etc/raddb/sites-enabled/default
    including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
    including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
    main {
     security {
     	allow_core_dumps = no
     }
    	name = "radiusd"
    	prefix = "/usr/local"
    	localstatedir = "/var"
    	logdir = "/var/log"
    	run_dir = "/var/run"
    }
    main {
    	name = "radiusd"
    	prefix = "/usr/local"
    	localstatedir = "/var"
    	sbindir = "/usr/local/sbin"
    	logdir = "/var/log"
    	run_dir = "/var/run"
    	libdir = "/usr/local/lib/freeradius-3.0.17"
    	radacctdir = "/var/log/radacct"
    	hostname_lookups = no
    	max_request_time = 30
    	cleanup_delay = 5
    	max_requests = 1024
    	pidfile = "/var/run/radiusd.pid"
    	checkrad = "/usr/local/sbin/checkrad"
    	debug_level = 0
    	proxy_requests = yes
     log {
     	stripped_names = no
     	auth = yes
     	auth_badpass = yes
     	auth_goodpass = yes
     	msg_badpass = ""
     	msg_goodpass = ""
     	colourise = yes
     	msg_denied = "You are already logged in - access denied"
     }
     resources {
     }
     security {
     	max_attributes = 200
     	reject_delay = 1.000000
     	status_server = no
     }
    }
    radiusd: #### Loading Realms and Home Servers ####
    radiusd: #### Loading Clients ####
     client RuckusAP {
     	ipaddr = 10.0.90.0
     	require_message_authenticator = no
     	secret = <<< secret >>>
     	nas_type = "other"
     	proto = "udp"
      limit {
      	max_connections = 16
      	lifetime = 0
      	idle_timeout = 30
      }
     }
    Debugger not attached
     # Creating Auth-Type = mschap
     # Creating Auth-Type = digest
     # Creating Auth-Type = eap
     # Creating Auth-Type = PAP
     # Creating Auth-Type = CHAP
     # Creating Auth-Type = MS-CHAP
     # Creating Auth-Type = MOTP
     # Creating Auth-Type = GOOGLEAUTH
     # Creating Autz-Type = Status-Server
     # Creating Acct-Type = Status-Server
    radiusd: #### Instantiating modules ####
     modules {
      # Loaded module rlm_attr_filter
      # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.post-proxy {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
      	key = "%{Realm}"
      	relaxed = no
      }
      # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.pre-proxy {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
      	key = "%{Realm}"
      	relaxed = no
      }
      # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.access_reject {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
      	key = "%{User-Name}"
      	relaxed = no
      }
      # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.access_challenge {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
      	key = "%{User-Name}"
      	relaxed = no
      }
      # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.accounting_response {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
      	key = "%{User-Name}"
      	relaxed = no
      }
      # Loaded module rlm_cache
      # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
      cache cache_eap {
      	driver = "rlm_cache_rbtree"
      	key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
      	ttl = 15
      	max_entries = 0
      	epoch = 0
      	add_stats = no
      }
      # Loaded module rlm_chap
      # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
      # Loaded module rlm_date
      # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
      date {
      	format = "%b %e %Y %H:%M:%S %Z"
      	utc = no
      }
      # Loaded module rlm_detail
      # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
      detail {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail auth_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail reply_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail pre_proxy_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail post_proxy_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loaded module rlm_digest
      # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
      # Loaded module rlm_dynamic_clients
      # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
      # Loaded module rlm_eap
      # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
      eap {
      	default_eap_type = "mschapv2"
      	timer_expire = 60
      	ignore_unknown_eap_types = no
      	cisco_accounting_username_bug = no
      	max_sessions = 4096
      }
      # Loaded module rlm_exec
      # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
      exec echo {
      	wait = yes
      	program = "/bin/echo %{User-Name}"
      	input_pairs = "request"
      	output_pairs = "reply"
      	shell_escape = yes
      }
      # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
      exec {
      	wait = no
      	input_pairs = "request"
      	shell_escape = yes
      	timeout = 10
      }
      # Loaded module rlm_expiration
      # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
      # Loaded module rlm_expr
      # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
      expr {
      	safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
      }
      # Loaded module rlm_files
      # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files
      files {
      	filename = "/usr/local/etc/raddb/mods-config/files/authorize"
      	acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
      	preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
      }
      # Loaded module rlm_linelog
      # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
      linelog {
      	filename = "/var/log/linelog"
      	escape_filenames = no
      	syslog_severity = "info"
      	permissions = 384
      	format = "This is a log message for %{User-Name}"
      	reference = "messages.%{%{reply:Packet-Type}:-default}"
      }
      # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
      linelog log_accounting {
      	filename = "/var/log/linelog-accounting"
      	escape_filenames = no
      	syslog_severity = "info"
      	permissions = 384
      	format = ""
      	reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
      }
      # Loaded module rlm_logintime
      # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
      logintime {
      	minimum_timeout = 60
      }
      # Loaded module rlm_mschap
      # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
      mschap {
      	use_mppe = yes
      	require_encryption = no
      	require_strong = no
      	with_ntdomain_hack = yes
       passchange {
       }
      	allow_retry = yes
      	winbind_retry_with_normalised_username = no
      }
      # Loaded module rlm_realm
      # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
      realm IPASS {
      	format = "prefix"
      	delimiter = "/"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
      realm suffix {
      	format = "suffix"
      	delimiter = "@"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
      realm realmpercent {
      	format = "suffix"
      	delimiter = "%"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
      realm ntdomain {
      	format = "prefix"
      	delimiter = "\"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loaded module rlm_pap
      # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
      pap {
      	normalise = yes
      }
      # Loaded module rlm_passwd
      # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
      passwd etc_passwd {
      	filename = "/etc/passwd"
      	format = "*User-Name:Crypt-Password:"
      	delimiter = ":"
      	ignore_nislike = no
      	ignore_empty = yes
      	allow_multiple_keys = no
      	hash_size = 100
      }
      # Loaded module rlm_preprocess
      # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
      preprocess {
      	huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
      	hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
      	with_ascend_hack = no
      	ascend_channels_per_line = 23
      	with_ntdomain_hack = no
      	with_specialix_jetstream_hack = no
      	with_cisco_vsa_hack = no
      	with_alvarion_vsa_hack = no
      }
      # Loaded module rlm_radutmp
      # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
      radutmp {
      	filename = "/var/log/radutmp"
      	username = "%{User-Name}"
      	case_sensitive = yes
      	check_with_nas = yes
      	permissions = 384
      	caller_id = yes
      }
      # Loaded module rlm_counter
      # Loading module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
      counter daily {
      	filename = "/var/log/radacct/timecounter/db.daily"
      	key = "User-Name"
      	reset = "daily"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Daily-Session-Time"
      	check_name = "Max-Daily-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loading module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
      counter weekly {
      	filename = "/var/log/radacct/timecounter/db.weekly"
      	key = "User-Name"
      	reset = "weekly"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Weekly-Session-Time"
      	check_name = "Max-Weekly-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loading module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
      counter monthly {
      	filename = "/var/log/radacct/timecounter/db.monthly"
      	key = "User-Name"
      	reset = "monthly"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Monthly-Session-Time"
      	check_name = "Max-Monthly-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loading module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
      counter forever {
      	filename = "/var/log/radacct/timecounter/db.forever"
      	key = "User-Name"
      	reset = "never"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Forever-Session-Time"
      	check_name = "Max-Forever-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loaded module rlm_replicate
      # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
      # Loaded module rlm_soh
      # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
      soh {
      	dhcp = yes
      }
      # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
      radutmp sradutmp {
      	filename = "/var/log/sradutmp"
      	username = "%{User-Name}"
      	case_sensitive = yes
      	check_with_nas = yes
      	permissions = 420
      	caller_id = no
      }
      # Loaded module rlm_unix
      # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
      unix {
      	radwtmp = "/var/log/radwtmp"
      }
    Creating attribute Unix-Group
      # Loaded module rlm_always
      # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always
      always reject {
      	rcode = "reject"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always
      always fail {
      	rcode = "fail"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
      always ok {
      	rcode = "ok"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always
      always handled {
      	rcode = "handled"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
      always invalid {
      	rcode = "invalid"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
      always userlock {
      	rcode = "userlock"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
      always notfound {
      	rcode = "notfound"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always
      always noop {
      	rcode = "noop"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always
      always updated {
      	rcode = "updated"
      	simulcount = 0
      	mpp = no
      }
      # Loaded module rlm_unpack
      # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
      # Loaded module rlm_utf8
      # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
      # Loading module "motp" from file /usr/local/etc/raddb/mods-enabled/motp
      exec motp {
      	wait = yes
      	program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}"
      	shell_escape = yes
      }
      # Loading module "googleauth" from file /usr/local/etc/raddb/mods-enabled/googleauth
      exec googleauth {
      	wait = yes
      	program = "/usr/local/etc/raddb/scripts/googleauth.py %{request:User-Name} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{request:User-Password}"
      	shell_escape = yes
      }
      # Loading module "datacounterdaily" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterdaily {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} daily %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loading module "datacounterweekly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterweekly {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} weekly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loading module "datacountermonthly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacountermonthly {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} monthly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loading module "datacounterforever" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterforever {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} forever %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      instantiate {
      # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
      # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
      # Instantiating module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 1559340000 [2019-06-01 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1559340000
    rlm_counter: DEFAULT2 set to 1559310885
    rlm_counter: add_defaults: End
      # Instantiating module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 1559426400 [2019-06-02 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1559426400
    rlm_counter: DEFAULT2 set to 1559310885
    rlm_counter: add_defaults: End
      # Instantiating module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 1559340000 [2019-06-01 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1559340000
    rlm_counter: DEFAULT2 set to 1559310885
    rlm_counter: add_defaults: End
      # Instantiating module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 0 [2019-05-31 15:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 0
    rlm_counter: DEFAULT2 set to 1559310885
    rlm_counter: add_defaults: End
      }
      # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
      # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
      # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
    [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" 	found in filter list for realm "DEFAULT".
    [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" 	found in filter list for realm "DEFAULT".
      # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
      # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
      # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
    rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
      # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
      # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
    rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
      # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
       # Linked to sub-module rlm_eap_tls
       tls {
       	tls = "tls-common"
       }
       tls-config tls-common {
       	verify_depth = 0
       	ca_path = "/usr/local/etc/raddb/certs"
       	pem_file_type = yes
       	private_key_file = "/usr/local/etc/raddb/certs/server_key.pem"
       	certificate_file = "/usr/local/etc/raddb/certs/server_cert.pem"
       	ca_file = "/usr/local/etc/raddb/certs/ca_cert.pem"
       	dh_file = "/usr/local/etc/raddb/certs/dh"
       	random_file = "/dev/urandom"
       	fragment_size = 1024
       	include_length = yes
       	auto_chain = yes
       	check_crl = no
       	check_all_crl = no
       	cipher_list = "DEFAULT"
       	cipher_server_preference = no
       	ecdh_curve = "prime256v1"
       	tls_max_version = ""
       	tls_min_version = "1.0"
        cache {
        	enable = no
        	lifetime = 24
        	max_entries = 255
        }
        verify {
        	skip_if_ocsp_ok = no
        }
        ocsp {
        	enable = no
        	override_cert_url = no
        	url = "http://127.0.0.1/ocsp/"
        	use_nonce = yes
        	timeout = 0
        	softfail = no
        }
       }
       # Linked to sub-module rlm_eap_ttls
       ttls {
       	tls = "tls-common"
       	default_eap_type = "mschapv2"
       	copy_request_to_tunnel = no
       	use_tunneled_reply = no
       	virtual_server = "inner-tunnel-ttls"
       	include_length = yes
       	require_client_cert = no
       }
    tls: Using cached TLS configuration from previous invocation
       # Linked to sub-module rlm_eap_peap
       peap {
       	tls = "tls-common"
       	default_eap_type = "mschapv2"
       	copy_request_to_tunnel = no
       	use_tunneled_reply = no
       	proxy_tunneled_request_as_eap = yes
       	virtual_server = "inner-tunnel-peap"
       	soh = no
       	require_client_cert = no
       }
    tls: Using cached TLS configuration from previous invocation
       # Linked to sub-module rlm_eap_mschapv2
       mschapv2 {
       	with_ntdomain_hack = no
       	send_error = no
       }
      # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
    reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
    reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
    reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
      # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
      # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
      # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
    rlm_mschap (mschap): using internal authentication
      # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
      # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
    rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
      # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
    reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
    reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
      # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
     } # modules
    radiusd: #### Loading Virtual Servers ####
    server { # from file /usr/local/etc/raddb/radiusd.conf
    } # server
    server default { # from file /usr/local/etc/raddb/sites-enabled/default
     # Loading authenticate {...}
     # Loading authorize {...}
     # Loading preacct {...}
     # Loading accounting {...}
     # Loading session {...}
     # Loading pre-proxy {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server default
    server inner-tunnel-ttls { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
     # Loading authenticate {...}
     # Loading authorize {...}
    Ignoring "sql" (see raddb/mods-available/README.rst)
    Ignoring "ldap" (see raddb/mods-available/README.rst)
     # Loading session {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server inner-tunnel-ttls
    server inner-tunnel-peap { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
     # Loading authenticate {...}
     # Loading authorize {...}
     # Loading session {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server inner-tunnel-peap
    radiusd: #### Opening IP addresses and Ports ####
    listen {
      	type = "auth"
      	ipaddr = 10.0.0.252
      	port = 1812
    }
    listen {
      	type = "auth"
      	ipaddr = 127.0.0.1
      	port = 18127
    }
    listen {
      	type = "auth"
      	ipaddr = 127.0.0.1
      	port = 18128
    }
    Listening on auth address 10.0.0.252 port 1812 bound to server default
    Listening on auth address 127.0.0.1 port 18127 bound to server inner-tunnel-ttls
    Listening on auth address 127.0.0.1 port 18128 bound to server inner-tunnel-peap
    Ready to process requests
    
    Ignoring request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.11 port 32885 proto udp
    Ready to process requests
    Ignoring request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.11 port 32885 proto udp
    Ready to process requests
    Ignoring request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.11 port 32885 proto udp
    Ready to process requests
    

  • LAYER 8 Global Moderator

    @joriz said in Pfsense/Freeradius: Ignoring request to auth address ...:

    from unknown client 10.0.90.11

    Says right there what your problem is ;)

    Did you setup the client in freerad?

    clients.png



  • i was testing this on a VM and i've come to the same conclusion of @joriz :)
    You say "In Pfsense i have configured 10.0.90.0"
    this is the problem
    You must add nas/client with ip 10.0.90.11 and so on



  • @kiokoman Thank you for testing this.
    I have added every AP as a NAS client and now it works again.
    Something must have been changed with the newer FreeRadius modules because 10.0.90.0 was working for many years...

    Thank you everyone. I learned alot.


  • LAYER 8 Global Moderator

    I have been using the freerad package on pfsense for years, for sure since May of 2014 when got first unifi AP.. And for sure you had to setup nas client for it to work... I distinctly recall doing testing and having to put that in place.


Log in to reply