Re: csr 1000v,Radius AAA with Coa, captive portal redirection, a

sololuke2013 · ‎11-29-2013

Hi

I attached my full configuration used on CSR1000V to do AAA with an external radius server, external captive portal using COA. Also arhitecture attached.

Here is my inspiration link and scenario :

http://www.cisco.com/en/US/docs/ios/12_2sb/isg/coa/guide/isgcoa4.html

My COA work good, I used for testing radclient and changes the subscriber session from unauth to authenticated.

My issue is that the redirect to captive portal is not working and I don't know why?

show subsecriber policy all looks good also.

Can you please help me with my config?

Here are parts from my config also:

aaa new-model

!

aaa group server radius RAD-SRV-GRP

server 192.168.100.123 auth-port 1812 acct-port 1813

ip radius source-interface Loopback1

!

aaa authentication login RAD-ALL group RAD-SRV-GRP

aaa authorization network RAD-ALL group RAD-SRV-GRP

aaa authorization subscriber-service default local group RAD-SRV-GRP

aaa accounting network RAD-ALL

action-type start-stop

group RAD-SRV-GRP

!

aaa server radius dynamic-author

client 192.168.100.123

server-key cisco

port 3799

auth-type all

ignore session-key

ignore server-key

!

aaa session-id common

ip dhcp excluded-address 192.168.200.1

!

ip dhcp pool WiFi_DHCP_POOL1

network 192.168.200.0 255.255.255.0

dns-server 192.168.1.1

default-router 192.168.200.1

lease 0 0 30

class DHCP-WiFi-CL

!

ip dhcp class DHCP-WiFi-CL

subscriber service coa-rfc-compliant

subscriber service session-accounting

subscriber authorization enable

class-map type traffic match-any REDIRECT-MAP

match access-group input name REDIRECT-ACL-UP

!

class-map type traffic match-any INTERNET-MAP

match access-group input name INTERNET-ACL-UP

match access-group output name INTERNET-ACL-DW

!

class-map type traffic match-any OPENGARDEN-MAP

match access-group input name OPENGARDEN-ACL-UP

match access-group output name OPENGARDEN-ACL-DW

!

class-map type control match-all INIT-SESSION

match timer INIT-SESSION-TIMER

match authen-status unauthenticated

!

policy-map type service REDIRECT-SERV

class type traffic REDIRECT-MAP

redirect to ip 192.168.100.123 port 80

!

class type traffic default input

drop

!

policy-map type service OPENGARDEN-SERV

class type traffic OPENGARDEN-MAP

police input 1000000

police output 3000000

!

class type traffic default in-out

drop

!

policy-map type service INTERNET-SERV

class type traffic INTERNET-MAP

timeout idle 300

timeout absolute 3600

police input 5000000

police output 10000000

!

class type traffic default in-out

drop

!

policy-map type service PBHK-SERV

ip portbundle

!

policy-map type control WIFI-POL-1

class type control INIT-SESSION event timed-policy-expiry

10 service disconnect

!

class type control always event session-start

10 service-policy type service name PBHK-SERV

20 collect identifier mac-address

30 authorize aaa list RAD-ALL identifier mac-address

40 service-policy type service name REDIRECT-SERV

50 service-policy type service name OPENGARDEN-SERV

60 set-timer INIT-SESSION-TIMER 5

!

class type control always event account-logon

10 authenticate aaa list RAD-ALL

!

class type control always event service-start

10 service-policy type service unapply name PBHK-SERV

20 service-policy type service unapply name REDIRECT-SERV

30 service-policy type service unapply name OPENGARDEN-SERV

40 service-policy type service identifier service-name

!

class type control always event account-logoff

10 service disconnect delay 5

!

class type control always event service-stop

10 service-policy type service unapply identifier service-name

20 service-policy type service name PBHK-SERV

30 service-policy type service name REDIRECT-SERV

40 service-policy type service name OPENGARDEN-SERV

!

interface Loopback1

ip address 192.168.255.1 255.255.255.255

!

interface GigabitEthernet1

description "Internet_Interface"

ip address 192.168.1.28 255.255.255.0

negotiation auto

!

interface GigabitEthernet2

description "AP_Interface"

ip address 192.168.200.1 255.255.255.0

negotiation auto

service-policy type control WIFI-POL-1

ip subscriber routed

initiator unclassified ip-address

initiator dhcp

!

interface GigabitEthernet3

description "Radius-Portal_Interface"

ip address 192.168.100.131 255.255.255.0

negotiation auto

!

interface GigabitEthernet0

vrf forwarding Mgmt-intf

ip address 192.168.50.130 255.255.255.0

negotiation auto

!

virtual-service csr_mgmt

activate

!

ip forward-protocol nd

!

no ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 192.168.1.1

!

ip access-list extended INTERNET-ACL-DW

permit ip any 192.168.200.0 0.0.0.255

ip access-list extended INTERNET-ACL-UP

permit ip any 192.168.200.0 0.0.0.255

ip access-list extended OPENGARDEN-ACL-DW

permit ip host 192.168.100.123 any

permit udp any eq domain any

ip access-list extended OPENGARDEN-ACL-UP

permit udp any any eq domain

permit tcp any host 192.168.100.123

ip access-list extended REDIRECT-ACL-UP

deny ip any host 192.168.100.123

permit tcp any any eq www

permit tcp any any eq 8080

permit tcp any any eq 443

!

ip portbundle

match access-list 101

source Loopback1

!

access-list 101 permit tcp any host 192.168.100.123

!

radius-server attribute 44 include-in-access-req default-vrf

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 32 include-in-access-req

radius-server attribute 31 send nas-port-detail mac-only

radius-server attribute 31 remote-id

radius-server host 192.168.100.123 auth-port 1812 acct-port 1813 key cisco

radius-server retransmit 5

radius-server timeout 10

radius-server key cisco

!

AbdelGalil Farid · ‎12-07-2013

Hi luke;

According to your configuration and as i remember

the problem may be in your redirect command as follow

you configure redirect as

!
policy-map type service REDIRECT-SERV
 class type traffic REDIRECT-MAP
  redirect to ip 192.168.100.123 port 80
 !

I suggest to replace

      redirect to ip 192.168.100.123 port 80

with

     redirect to group REDIRECT_SERVER_NAME

And in global configuration you add

redirect server-group REDIRECT_SERVER_NAME

server ip 192.168.100.123

Please Try and tell us ...

And tell me do you know the function of the follow commands and also why you use

As you didn't call them??!!!

!

class-map type control match-all INIT-SESSION

match timer INIT-SESSION-TIMER

match authen-status unauthenticated

!

BR

AbdelGalil

sololuke2013 · ‎12-09-2013

Hi AbdelGalil

I changed and used server group for redirect. Same thing.

class-map type control match-all INIT-SESSION

match timer INIT-SESSION-TIMER

match authen-status unauthenticated

Is used for Captive Portal to set the timer for unauthenticated users. Anyway I removed this but same behaviour.

This is the new full config

!

version 15.3

service timestamps debug datetime msec

service timestamps log datetime msec

service internal

no platform punt-keepalive disable-kernel-core

platform console virtual

!

hostname CISCO-CSR1000v

!

boot-start-marker

boot-end-marker

!

vrf definition Mgmt-intf

!

address-family ipv4

exit-address-family

!

address-family ipv6

exit-address-family

!

enable secret 5 ................

!

aaa new-model

!

aaa group server radius RAD-SRV-GROUP

server 192.168.100.123 auth-port 1812 acct-port 1813

ip radius source-interface Loopback1

!

aaa authentication login default none

aaa authentication login RAD-ALL group RAD-SRV-GROUP

aaa authorization network RAD-ALL group RAD-SRV-GROUP

aaa authorization subscriber-service default local group RAD-SRV-GROUP

aaa accounting delay-start

aaa accounting update periodic 5

aaa accounting network RAD-ALL

action-type start-stop

group RAD-SRV-GROUP

!

aaa server radius dynamic-author

client 192.168.100.123

server-key cisco

port 3799

auth-type all

ignore session-key

ignore server-key

!

aaa session-id common

no ip source-route

!

ip name-server 192.168.1.1

ip address-pool local

ip dhcp excluded-address 192.168.200.1

!

ip dhcp pool WiFi_DHCP_POOL1

network 192.168.200.0 255.255.255.0

dns-server 192.168.1.1

default-router 192.168.200.1

lease 0 0 30

class UNAUTH-DHCP

!

ip dhcp class UNAUTH-DHCP

!

subscriber service coa-rfc-compliant

subscriber authorization enable

service-policy type control WIFI-POL-1

multilink bundle-name authenticated

!

username root privilege 15 password 0 1 xxxxxxxxxx

!

redundancy

mode none

redirect server-group PORTAL-PAGE

server ip 192.168.2.123 port 80

!

ip tftp source-interface GigabitEthernet0

class-map type traffic match-any REDIRECT-MAP

match access-group output 197

match access-group input 197

!

class-map type traffic match-any OPENGARDEN-MAP

match access-group output 195

match access-group input 195

!

class-map type control match-all INIT-SESSION

match timer INIT-SESSION-TIMER

match authen-status unauthenticated

!

policy-map type service REDIRECT-SERV

ip access-group 197 in

ip access-group 197 out

1 class type traffic REDIRECT-MAP

redirect to group PORTAL-PAGE

!

class type traffic default input

drop

!

policy-map type service OPENGARDEN-SERV

class type traffic OPENGARDEN-MAP

police input 96000 1000 1500

police output 96000 1000 1500

!

class type traffic default in-out

drop

!

policy-map type service PBHK-SERV

service local

ip portbundle

!

policy-map type control WIFI-POL-1

class type control INIT-SESSION event timed-policy-expiry

10 service disconnect

!

class type control always event session-start

2 service-policy type service name PBHK-SERV

5 collect identifier mac-address

10 authorize aaa list RAD-ALL password cisco identifier mac-address

20 set-timer INIT-SESSION-TIMER 10

30 service-policy type service name REDIRECT-SERV

40 service-policy type service name OPENGARDEN-SERV

!

class type control always event account-logon

2 service-policy type service unapply name PBHK-SERV

10 authenticate aaa list RAD-ALL

20 service-policy type service unapply name REDIRECT-SERV

30 service-policy type service unapply name OPENGARDEN-SERV

!

class type control always event service-start

2 service-policy type service unapply name PBHK-SERV

10 service-policy type service unapply name REDIRECT-SERV

20 service-policy type service unapply name OPENGARDEN-SERV

30 service-policy type service identifier service-name

!

class type control always event account-logoff

10 service disconnect delay 5

!

class type control always event service-stop

1 service-policy type service unapply identifier service-name

10 service-policy type service unapply identifier service-name

12 service-policy type service unapply name PBHK-SERV

20 service-policy type service name REDIRECT-SERV

30 service-policy type service name OPENGARDEN-SERV

!

interface Loopback1

ip address 192.168.255.1 255.255.255.255

!

interface GigabitEthernet1

description "Internet_Interface"

ip address 192.168.1.253 255.255.255.0

negotiation auto

!

interface GigabitEthernet2

description "AP_Interface"

ip address 192.168.200.1 255.255.255.0

negotiation auto

service-policy type control WIFI-POL-1

ip subscriber l2-connected

initiator unclassified mac-address

initiator dhcp

!

interface GigabitEthernet3

description "Radius-Portal_Interface"

ip address 192.168.100.131 255.255.255.0

negotiation auto

!

interface GigabitEthernet4

ip address 192.168.2.100 255.255.255.0

ip portbundle outside

negotiation auto

!

interface GigabitEthernet0

description "PORTAL"

vrf forwarding Mgmt-intf

ip address 192.168.50.130 255.255.255.0

negotiation auto

!

virtual-service csr_mgmt

activate

!

ip forward-protocol nd

!

no ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 192.168.1.1

!

ip portbundle

length 5

match access-list 101

source Loopback1

!

logging trap debugging

access-list 101 permit ip any any

access-list 195 permit ip any any

access-list 196 permit ip any any

access-list 197 permit tcp any any eq www

access-list 197 permit tcp any eq www any

access-list 197 deny ip any any

!

radius-server attribute 44 include-in-access-req default-vrf

radius-server attribute 44 extend-with-addr

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 32 include-in-access-req

radius-server attribute 32 include-in-accounting-req

radius-server attribute 55 include-in-acct-req

radius-server attribute 55 access-request include

radius-server attribute 31 mac format unformatted

radius-server attribute 31 send nas-port-detail mac-only

radius-server attribute 31 remote-id

radius-server host 192.168.100.123 auth-port 1812 acct-port 1813 key cisco

radius-server retransmit 5

radius-server timeout 10

radius-server key cisco

!

control-plane

!

line con 0

stopbits 1

line aux 0

stopbits 1

line vty 0

exec-timeout 30 0

transport input telnet

line vty 1

exec-timeout 30 0

length 0

transport input telnet

line vty 2 4

exec-timeout 30 0

transport input telnet

!

onep

!

end

LOG attached.

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Root SIP DHCP

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Enable IP parsing

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Enable DHCP parsing

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Enable IP-Interface parsing

*Dec 6 20:56:56.917: SSS PM [uid:172][7FAF8F61AAA8]: ACTIVE HANDLE[0]: Snapshot captured in Active context

*Dec 6 20:56:56.917: SSS PM [uid:172][7FAF8F61AAA8]: ACTIVE HANDLE[0]: Active context created

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Event , state changed from idle to authorizing

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Active key set to Apply-Service

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Authorizing key OPENGARDEN-SERV

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Set authorization profile type to service

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: AAA request sent for key OPENGARDEN-SERV

*Dec 6 20:56:56.917: SSS PM [uid:172][7FAF8F61AAA8]: RULE[1]: Downloading service "OPENGARDEN-SERV"

*Dec 6 20:56:56.917: SSS PM [uid:172][7FAF8F61AAA8]: RULE[2]: Continue

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Received an AAA pass

Initial attr password 0

Initial attr username 0 "OPENGARDEN-SERV"

Initial attr traffic-class 0 "output access-group 195"

Initial attr traffic-class 0 "input access-group 195"

Initial attr ssg-service-info 0 "QU;96000;1000;1500;D;96000;1000;1500"

Initial attr traffic-class 0 "input default drop"

Initial attr traffic-class 0 "output default drop"

*Dec 6 20:56:56.917: SSS AAA AUTHOR [uid:172]: Could not parse AAA interim interval

*Dec 6 20:56:56.917: SSS PM: PARAMETERIZED-QoS: QOS parameters

*Dec 6 20:56:56.917: SSS PM [uid:172][7FAF8F61AAA8]: RULE: VRF Parsing routine:

password 0

username 0 "OPENGARDEN-SERV"

traffic-class 0 "output access-group 195"

traffic-class 0 "input access-group 195"

ssg-service-info 0 "QU;96000;1000;1500;D;96000;1000;1500"

traffic-class 0 "input default drop"

traffic-class 0 "output default drop"

*Dec 6 20:56:56.917: SSS PM: VPDN is not enabled

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: Set class ids: 484.485

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: Feature

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: SIP Root parser not installed

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: SIP IP-Interface parser not installed

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: SIP IP[2672EF0] parsed as Ignore

*Dec 6 20:56:56.918: IPSUB: Invalid magic 0xFADEDEAF in IP session 0x7FAF3761C8E8

*Dec 6 20:56:56.918: IPSUB-VRFSET: Entered allocate feature info

*Dec 6 20:56:56.918: IPSUB-VRFSET: Allocated sg vrfset info 0x7FAF37CB1160

*Dec 6 20:56:56.918: IPSUB-VRFSET: Freeing the sg vrfset info 0x7FAF37CB1160

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: SIP IP[2687F00] parsed as Ignore

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: SIP DHCP[2672EF0] parsed as Ignore

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: Event , state changed from authorizing to complete

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: No service authorization info found

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: Active Handle present - FE000189

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Attr list is NULL, apply config handle [0] not reset

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: ACTIVE HANDLE[0]: Snapshot reverted from Active context to policy context

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: Freeing Active Handle; SSS Policy Context Handle = 8500030F

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: ACTIVE HANDLE[989]: Released active handle

*Dec 6 20:56:56.918: SSS PM [7FAF8F619C68]: Create context 7FAF8F619C68

*Dec 6 20:56:56.918: SSS PM: PROFILE-DB: is profile "OPENGARDEN-SERV" in DB

*Dec 6 20:56:56.918: SSS PM: PROFILE-DB: Computed hash value = 1769598160

*Dec 6 20:56:56.918: SSS PM: PROFILE-DB: No, add new list

*Dec 6 20:56:56.918: SSS PM: PROFILE-DB: create "OPENGARDEN-SERV"

*Dec 6 20:56:56.918: SSS PM: PROFILE-DB: create "OPENGARDEN-SERV"/7FAF37CB32A8 hdl F1000358 ref 1

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: downloaded first version

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: SVM download for "OPENGARDEN-SERV" ok

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [8500030F]: client download ok

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [SVM-to-client-msg:8500030F] locked 0->1

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [AAA-Download:7FAF37E758E8] unlocked 1->0

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: Event , state changed from complete to terminal

*Dec 6 20:56:56.918: SSS AAA AUTHOR [uid:172]: Cancel request

*Dec 6 20:56:56.918: SSS PM [7FAF8F619C68]: Destroy context 7FAF8F619C68

*Dec 6 20:56:56.918: SSS PM: [PARAMETERIZED-QoS]: In removed_from_rbpl_ctx_temp_hold for policy handle[84000315

*Dec 6 20:56:56.918: SSS PM: [PARAMETERIZED-QoS]: No rabapol context created yet for handle [84000315], nothing to return

*Dec 6 20:56:56.918: CH-UTILS: Invalid command handle

*Dec 6 20:56:56.918: SSS PM [7FAF8F619C68]: PROFILE: destroy all config

*Dec 6 20:56:56.918: SSS PM [7FAF8F619C68]: SSS PM: destroy all user profile info from policy context

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: SVM service download success

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: download completed for "OPENGARDEN-SERV" version 1

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: alloc feature info

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [SVM-Feature-Info:7FAF373D5C80] locked 0->1

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: has Policy info

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [PM-Info:7FAF8F64DB40] locked 0->1

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: has Policy info

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: PROFILE: store profile "OPENGARDEN-SERV"

*Dec 6 20:56:56.918: SSS PM: PROFILE-DB: incremented ref "OPENGARDEN-SERV"/7FAF37CB32A8 hdl F1000358 ref 2

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: PROFILE: create 7FAF8F65A260, ref 1

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: populated client

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [PM-Download:8500030F] unlocked 1->0

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [SVM-to-client-msg:8500030F] unlocked 1->0

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE: VRF/Classname Check: session logging off or not VRF/Classname dependent

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Handling Author Not Found Event

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Feature info: 7FAF373D5CC0 Type: Service Config

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : Config level: Service Profile

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : IDB type: Sub-if or not required

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : 16 bytes:

SSS PM [uid:172][7FAF8F61AAA8]: : Data: 000000 00 00 A3 00 01 46 00 00 .....f..

SSS PM [uid:172][7FAF8F61AAA8]: : Data: 000008 00 00 A7 00 03 10 00 00 ........

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Feature info: 7FAF373D5CA0 Type: Service Config

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : Config level: Service Profile

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : IDB type: Sub-if or not required

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : 16 bytes:

SSS PM [uid:172][7FAF8F61AAA8]: : Data: 000000 00 00 94 00 01 47 00 00 .....g..

SSS PM [uid:172][7FAF8F61AAA8]: : Data: 000008 00 00 31 00 03 12 00 00 ..1.....

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Feature info: 7FAF373D5C80 Type: Service Config

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : Config level: Service Profile

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : IDB type: Sub-if or not required

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: : 16 bytes:

SSS PM [uid:172][7FAF8F61AAA8]: : Data: 000000 00 00 D2 00 01 48 00 00 .....h..

SSS PM [uid:172][7FAF8F61AAA8]: : Data: 000008 00 00 69 00 03 14 00 00 ..i.....

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Service starting

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: SERVICE [OPENGARDEN-SERV]: Parent 7FAF8F61AAA8 (same as session)

*Dec 6 20:56:56.918: SVM [D2000148/OPENGARDEN-SERV]: [PM-Service:7FAF37CB5378] locked 0->1

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Client block is NULL in get client block with handle 8500030F

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: SERVICE [OPENGARDEN-SERV]: Start-pending request: Ok

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Event , State: authorizing to check-auth-needed

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Handling Next Authorization Check

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[0]: Continue

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[0]: WIFI-POL-1/always event session-start/40 service-policy type service name OPENGARDEN-SERV

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Client block is NULL in get client block with handle 8500030F

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[0]: No more actions to run

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[1]: Continue

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[1]: WIFI-POL-1/always event session-start/40 service-policy type service name OPENGARDEN-SERV

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: State: check-auth-needed to initial-req

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[1]: Using previously offered directive Local Terminate

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[2]: Continue

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE[2]: WIFI-POL-1/always event session-start/40 service-policy type service name OPENGARDEN-SERV

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Client block is NULL in get client block with handle 8500030F

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Event , State: initial-req to wait-for-events

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Handling Service Direction

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Policy reply - Local Terminate

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Plumbing proposed by default, not FSP

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Policy reply - Local Terminate

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Plumbing proposed by default, not FSP

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: Policy reply - Local Terminate

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Looking for a rule for event session-service-found

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Intf CloneSrc Gi2: service-rule any: WIFI-POL-1

*Dec 6 20:56:56.918: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Evaluate "WIFI-POL-1" for session-service-found

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/INIT-SESSION event timed-policy-expiry"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event session-start"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event account-logon"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event service-start"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event account-logoff"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event service-stop"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: No match for "WIFI-POL-1"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Intf AccessIE Gi2: service-rule any: WIFI-POL-1

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Evaluate "WIFI-POL-1" for session-service-found

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/INIT-SESSION event timed-policy-expiry"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event session-start"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event account-logon"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event service-start"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event account-logoff"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Wrong type "WIFI-POL-1/always event service-stop"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: No match for "WIFI-POL-1"

*Dec 6 20:56:56.919: SSS PM [uid:172][7FAF8F61AAA8]: RULE: Intf InputI/f Gi2: service-rule any: WIFI-POL-1