Re: freeradius denies to authentocate with eap-tls

Hello and good day.

Finally found the actual reason.

The outer client is failed eap tls because of packet fragmentation. on
interface mtu is set as 1500, and packet is 1514.

from tshark:

RADIUS 1514 Access-Request id=4[BoundErrorUnreassembled Packet]
RADIUS 1514 Access-Request id=4, Duplicate
Request[BoundErrorUnreassembled Packet]
RADIUS 1514 Access-Request id=4, Duplicate
Request[BoundErrorUnreassembled Packet]
RADIUS 1514 Access-Request id=4, Duplicate
Request[BoundErrorUnreassembled Packet]

any idea why this happen ?

Thank you.

On 3/2/23 00:55, Mikhael Lialin wrote:
>
> Hello.
>
> Answered to moved to ports thread, and realised that it not posted in
> thread.
>
> So copying messages here as attachments.
>
> Finally found the cause - fragmented packet reassembly error.
>
> Thank you.
> On 2/26/23 15:37, Robert Klein wrote:
>> Hi,
>>
>> I'm answering this to the misc list.
>>
>> The ktrace is a bit heavy to read. Could you run freeradius from the
>> command line as follows
>>
>> /usr/local/sbin/radiusd -X >radius.log
>>
>> and sent this file?
>>
>>
>> But first, if you didn't change the configuration, I don't believe
>> you can use freeradius at all. Didn't you at least set up some files
>> in /etc/raddb, e.g. client.conf, users.conf, proxy.conf? No changes in
>> sites and/or modules?
>>
>> Best regards
>> Robert
>>
>>
>> On Sat, 25 Feb 2023 02:18:20 +0400
>> Mikhael Lialin<soultenq@gmail.com> wrote:
>>
>>> Hi.
>>>
>>> Trying to setup witi with radius eap-tls authentication.
>>>
>>> And getting time out while authenticated.
>>>
>>> Tried with custome setup, and default setup with generated
>>> certificates within installation.
>>>
>>> in ktrace of rediusd something waiting:
>>>
>>> 28664 radiusd  RET   wait4 -1 errno 10 No child processes
>>>
>>> all configuration of freeradius are default after installation,
>>> nothing were modified.
>>>
>>> Please help.
>>>
>>> Debug ant ktrace session attached.
>>>
>>>
>>> Mikhael.