Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About nellson
Stats
Member since
07-26-2001
22
Posts
4
Helpful
0
Solutions
05-10-2016
01:11 PM
Same issue moving code from a ISR3925 G2 to a 4451 ISR running IOS XE.. I depend on the reversible function. Trying to get a TAC answer this week.
Nick
... View more
Created by
nellson
in Wireless Security and Network Management
in Wireless Security and Network Management
03-03-2013
07:21 PM
03-03-2013
07:21 PM
Oh, of course if I was running this for full time home use, I would be using much less. The overload of SSID's was just to be silly (spelled out a Berma Shave like road sign ad with it).I will continue until I have tried a 16 VLAN system, and have been told to watch the power level function work I need 4 AP's ideally, so I will do that as well. But in two months after I have this stuff down, I will pair it back to two AP's, and maybe 2 SSID's going forward. I'll collect my configs used and post as I go, for those that want to go FreeRadius. Nick
... View more
Created by
nellson
in Wireless Security and Network Management
in Wireless Security and Network Management
03-03-2013
02:08 PM
03-03-2013
02:08 PM
Hi Scott, I appear to have fallen into some dumb luck. Fo followed the initial test of adding a "testing" user with nothing more than a "password" for a password. And ran the simple radtest command to insure my radiusd was functional. That passed. So I added in the clients.conf an simple entry for my WLC, my 2950 switch, my 1841 router, so I would have test NAS's. I added the radius server in the WLC, and noticed that the management GUI was already set to use RADIUS then LOCAL as it's method.. hrmm.. OK, so I logged out and back in, but used the testing user. It worked! Well, ok, I half expected it to, but perhaps not pass any of the AV pairs to set up proper menu permissions. But it was a baby step. So I got bold. I tried using my iPhone to connect to one of the 16 SSID's I made... (yes.. I used all 16 to confuse my neighbors, I'm evil) Each of these were done by selecting NEW, giving only an SSID and then activating. It defaults to WPA2-Enterprise on the WLC for securtity. What I say on my iPhone was a username/password prompt, and when i entered "testing/password" it prompted me to accept an untrusted certificate (I viewed it, and it was teh self signed one from FreeRadius that it built when I first ran it)I accepted that cert, and poof, I am online with an IP address and surfing the web. So I am not using a PKI (that's trusted), I am not using the Multi Vlan concept per SSID, so all those fancy AV Pairs appear not to be required. Well, this is awesome. I will now look at adding more than one VLAN (need to trunk a few things) and see if I can get VLAN selection based on login like the other posts I have seen. Then I will tackle the whoel PKI mess of OpenCA and see if I can make this work without the cert warning on a commercial product like my iPhone/IPad. That will require something that is mutually trusted, ergo $$$... But for my home project of teaching myself WLC, I am not quite as intimidated as I started out. I used an SSID of ":-)" so you will see that in the radius handshake. For those FreeRadius types out there, this is what my server spit up: Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=13, length=222 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 State = 0x73eb6eeb70ee77dbab4005972fb84a50 Message-Authenticator = 0x7717ccd50e30babb3b4117330cc2533d # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 13 to 10.0.0.12 port 32769 EAP-Message = 0x0106021419000b6e698cff671a24470ba23bc5cd58214bf5e2f72f7ce934a859656561adabeb5bb310301c260600dc26eb1e704b19d880b8959a63bcd14ce893cf388f47ce8449dbbeca4e0f70822195627c0f53f77dcb3a6d08c9c99b8a645a9256443e6557df43c3f4a2603f0236d92c8e3c8e4540911ca150458160a6d3eeb5f8bf9afe6f7e06b3b55acc3950faeb1e6c66ec608789a161f8030d3298410c8d2b9d6a38785cc0f60980ba907d2acc0d664d7eb350afa492e926160301014b0c00014703001741044fc5812f5011824057125fea0e47d445c928c3af8fdc2ed228987a8605594a823a105b65344cf70a40a8d4d7a7141de7bb171899 EAP-Message = 0x20619bda0b8797eb97029f4701006e73e15be5138ed5c1cbfb7b96ca975c4073a48c159ba60bed89ab8115b7607c0965745bd0e229b929bac6b81802ceb9ab9ebc8c8187a5942f062905d0ffe21933dc05945ddfaf9f0ad577e4ceda8991adc9ef87706a94838d7d238e8b5b75507baabefd1a65153e27542b5645f4c71bc0d23a9196b54de55e8eaa76decbd8a5143ac8e38679efe536ddf6edf880406a7dcdf8bf7237f9dc2face142b0ba99fd3d4018da77035d9a1ffee9fff0b388ab3a9171d9af973d19703a2dd72a3f95bdd1d78f0bf797069e40d8e1ed610321b2042a1d7c75b5be9eee80ceaec539ab8f11425b676eae25046479d1e606b086 EAP-Message = 0x4a046de17f67e2ba30a0475079ae084d9116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73eb6eeb77ed77dbab4005972fb84a50 Finished request 11. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=14, length=360 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600901980000000861603010046100000424104d0c3847c755edc97193c3a7fc45b23a0b4412d001c0cc70f6a6aedde1d2c2148555026fc757c7a2f60bb913a6d944dedc563b4622f80e116cf44541113f6673514030100010116030100301a6d058f6952ec064d990521cf81885feb03ccc7bc646630ea09be594d2e7b9a510a5869f38eb7d702827b1f60f0d386 State = 0x73eb6eeb77ed77dbab4005972fb84a50 Message-Authenticator = 0x7057aff4addd943bacd17a1d0acd83d6 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 14 to 10.0.0.12 port 32769 EAP-Message = 0x01070041190014030100010116030100306159a51cb9e95e598443a58c28905f5b3401a36f6ade329c00e73237b55c8ad68be30867396f9018af88f4204d5f9054 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73eb6eeb76ec77dbab4005972fb84a50 Finished request 12. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=15, length=222 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700061900 State = 0x73eb6eeb76ec77dbab4005972fb84a50 Message-Authenticator = 0x68a0a32665a682a8105a90ce8170ba0f # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 15 to 10.0.0.12 port 32769 EAP-Message = 0x0108002b1900170301002005753ba468b77ec20a43c1fb1ec19fea10a4f79c5932ef40d71b95fb93ab2d83 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73eb6eeb75e377dbab4005972fb84a50 Finished request 13. Going to the next request Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=16, length=259 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208002b19001703010020422f8e62a8c3ece30b1359799e342131b09c4987db5750785545bf70fe4c0f18 State = 0x73eb6eeb75e377dbab4005972fb84a50 Message-Authenticator = 0xc680d244328d414f86cb2915466a5c70 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - testing [peap] Got inner identity 'testing' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000c0174657374696e67 server { [peap] Setting User-Name to testing Sending tunneled request EAP-Message = 0x0208000c0174657374696e67 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testing" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry testing at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900211a0109001c10aca9799efad64499b615ffdc2f5165ae74657374696e67 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x18902df81899370636c4e7e5690d28c9 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900211a0109001c10aca9799efad64499b615ffdc2f5165ae74657374696e67 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x18902df81899370636c4e7e5690d28c9 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 16 to 10.0.0.12 port 32769 EAP-Message = 0x0109004b1900170301004021ce4449a2c6588c45533dc57939b60bef1717316ccf3ab5f2af9398f147abd4d75c6cbd5a69641ff2d2a164bfd6d565efe962801d03295a2b12a56727b91c8a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73eb6eeb74e277dbab4005972fb84a50 Finished request 14. Going to the next request Waking up in 3.1 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=17, length=323 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0209006b19001703010060e7318f96f70b28e945688da1bfd5b61c3ad00c1ba1246c3649258de8c95bb4f855fe652bc4db91999108f5434d61d86529111c29fb48e2cf9764b815bff073f2e3acab087b281b037d26d91f3b6a8390fe0ec2fb5d8a722dab3b7fcd11044687 State = 0x73eb6eeb74e277dbab4005972fb84a50 Message-Authenticator = 0x02bab4b58f5e310f02f9b2ebe13e0f05 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900421a0209003d319990ea2bed6e5013e9dbc121d5a69d41000000000000000075d3c40b381619618f977e958672926c2d56ac79c98ecd370074657374696e67 server { [peap] Setting User-Name to testing Sending tunneled request EAP-Message = 0x020900421a0209003d319990ea2bed6e5013e9dbc121d5a69d41000000000000000075d3c40b381619618f977e958672926c2d56ac79c98ecd370074657374696e67 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testing" State = 0x18902df81899370636c4e7e5690d28c9 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry testing at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: testing [mschap] Client is using MS-CHAPv2 for testing, we need NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d41323041303437443538414334313144373441433641363143363143383038363542334346463242 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x18902df8199a370636c4e7e5690d28c9 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d41323041303437443538414334313144373441433641363143363143383038363542334346463242 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x18902df8199a370636c4e7e5690d28c9 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 17 to 10.0.0.12 port 32769 EAP-Message = 0x010a005b190017030100504fb5fcd04762cc15914b6d4af35311ba331de931aff368ca3c34138c7f03f02b068bbe134bb83999b6716bb64bc5adb24a95c01e8b61523831e0ab1d0081ed1e2d5342c3d57c379171cb0a86d118cb29 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73eb6eeb7be177dbab4005972fb84a50 Finished request 15. Going to the next request Waking up in 3.1 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=18, length=259 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a002b19001703010020f8a1f8d0933ad89c64731181d33da06aeff9eb035879fa8a62abbbd07d75616c State = 0x73eb6eeb7be177dbab4005972fb84a50 Message-Authenticator = 0x7463a6818ee330c798e61dacb75b162c # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { [peap] Setting User-Name to testing Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testing" State = 0x18902df8199a370636c4e7e5690d28c9 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry testing at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel } # server inner-tunnel [peap] Got tunneled reply code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xd67428f2d8f04a7c7f48f820842baacf MS-MPPE-Recv-Key = 0xf30b0f96dc8a2ba868b144c4cfe5333e EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testing" [peap] Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xd67428f2d8f04a7c7f48f820842baacf MS-MPPE-Recv-Key = 0xf30b0f96dc8a2ba868b144c4cfe5333e EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testing" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 18 to 10.0.0.12 port 32769 EAP-Message = 0x010b002b19001703010020a741d9ceb2c84aae144d08ee11b1aa9c8f7bdedc44c3036131bf62b981ea27dd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73eb6eeb7ae077dbab4005972fb84a50 Finished request 16. Going to the next request Waking up in 3.1 seconds. rad_recv: Access-Request packet from host 10.0.0.12 port 32769, id=19, length=259 User-Name = "testing" Calling-Station-Id = "60-c5-47-45-43-0c" Called-Station-Id = "00-11-20-48-53-40::-)" NAS-Port = 8 Cisco-AVPair = "audit-session-id=0c00000a000000005cc43351" NAS-IP-Address = 10.0.0.12 NAS-Identifier = "Cisco_49:4b:40" Airespace-Wlan-Id = 15 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b002b1900170301002023b9b430c65678f3ab95d0d06293c0995690f88114516f64eeb410b632b8d548 State = 0x73eb6eeb7ae077dbab4005972fb84a50 Message-Authenticator = 0x0a56d0c11f179ad0e657387c2aef95dc # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 19 to 10.0.0.12 port 32769 MS-MPPE-Recv-Key = 0x72b108b845fb9d5769b49058156b1725ef003e3ba7c81d4b632d0a496c3ea920 MS-MPPE-Send-Key = 0xe0a06ae4249976a28dd0da48338d722d11745099a0bb3d3ec752284952dfa6ad EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testing" Finished request 17. Going to the next request
... View more
Created by
nellson
in Wireless Security and Network Management
in Wireless Security and Network Management
03-03-2013
10:25 AM
03-03-2013
10:25 AM
I have a WLC 2106 with two AP's connected, But have not set up any authentication. I don't have CSACS at my disposal, so I thought I would try FreeRadius on my Linux Server. I am looking for User/Password auth, and for now I would expect to have those accounts local to the FreeRadius engine. (baby steps before I try PAM/LDAP/AD/Certs ) I have seen a number of posts asking final step questions. I was looking for more of a where to begin How To. I have read the docs on Free Radius, and believe I have the method worked out on how to make a small change, run in debug mod to observe my change, to verify that I don't spend too much time pulling out my hair. I am fairly adept at CSACS 5.3 but it hides the magic of Radius from me ;-) Would anyone be able to point me to a starting place? Nick
... View more
Created by
nellson
in VPN and AnyConnect
in VPN and AnyConnect
12-11-2012
08:03 AM
12-11-2012
08:03 AM
This is where the connection sits... show crypto session detail Interface: GigabitEthernet0/0 Profile: Site-to-Site-Aggressive_PAN Session status: UP-IDLE Peer: d.d.d.d port 4500 fvrf: (none) ivrf: (none) Phase1_id: d.d.d.d Desc: (none) IKEv1 SA: local 192.168.221.2/4500 remote d.d.d.d/4500 Active Capabilities:DN connid:1473 lifetime:07:31:02
... View more
Created by
nellson
in VPN and AnyConnect
in VPN and AnyConnect
12-11-2012
07:22 AM
12-11-2012
07:22 AM
I have a frustrating issue with a dynamic VPN head end running IOS 15.2 on 2900's. I have existing keyrings, and isakmp profiles (both main and agressive) running. When I add in a new peer, by adding in a keyring prechared statement and a match identity in the isakmp profile, phase 1 biulds but phase 2 only gets right to the end and the Cisco side resets the connection because it did not get back a response to it's Phase 2 proposal. I have tried a number of soft clear commands to remedy this (I do have 16 other production tunnels I do not want to take down) and no avail. This is very consistent. We had this happen last week in the same manner, and the TAC finally said I must reboot the system. So I removed the cmap from the interface, and reapplied it (using notepad to do it all at once). All the tunnels dropped, and after a few manual restarts on the far end for thos etunnels that are tempermental, all tunnels came back up, including my new add. I have a pair of 3900's running 15.1 code in the US that terminate the same tunnels, and I can add and remove PEERS all day long without resetting anything. Has anyone one encountered this before? Could there be a more polite way of resetting what ever it is that removing the CMAP does to allow my new peer to get the full treatment here? (I am not asking for VPN peer config help, as I know this tunnel template I am using works, but if you want to see it) Nick crypto pki token default removal timeout 0 crypto keyring Site-to-Site pre-shared-key address a.a.a.a key lkdshjfhjkdsfkjfsjkddedswdes pre-shared-key address b.b.b.b key lkdshjfhjkdsfkjfsjkddedswdes pre-shared-key address c.c.c.c key lkdshjfhjkdsfkjfsjkddedswdes pre-shared-key address d.d.d.d key lkdshjfhjkdsfkjfsjkddedswdes <- old sonicwall VPN KEY pre-shared-key hostname BOB key lkdshjfhjkdsfkjfsjkddedswdes pre-shared-key hostname BILL key lkdshjfhjkdsfkjfsjkddedswdes pre-shared-key hostname JILL key lkdshjfhjkdsfkjfsjkddedswdes crypto keyring Site-to-Site_PAN description Keyring used for AES256 Palo Alto config, using IP's pre-shared-key address e.e.e.e key uiopadsbfjkahfga;lkdj pre-shared-key address f.f.f.f key uiopadsbfjkahfga;lkdj pre-shared-key address d.d.d.d key uiopadsbfjkahfga;lkdj <- my new add for Palo crypto isakmp policy 5 encr aes 256 hash sha256 authentication pre-share group 2 lifetime 28800 crypto isakmp policy 10 encr 3des authentication pre-share group 2 lifetime 28800 crypto isakmp policy 20 encr aes 256 authentication pre-share group 2 lifetime 28800 crypto isakmp policy 30 encr aes authentication pre-share group 2 lifetime 28800 crypto isakmp invalid-spi-recovery crypto isakmp keepalive 60 3 periodic crypto isakmp nat keepalive 20 crypto isakmp profile Site-to-Site-Main keyring Site-to-Site self-identity user-fqdn ASIA match identity address a.a.a.a 255.255.255.255 match identity address b.b.b.b 255.255.255.255 match identity address c.c.c.c 255.255.255.255 (Removed SonicWall peer match for d.d.d.d) keepalive 60 retry 3 crypto isakmp profile Site-to-Site-Aggressive keyring Site-to-Site self-identity user-fqdn ASIA match identity user-fqdn BOB match identity user-fqdn BILL match identity user-fqdn JILL keepalive 60 retry 3 initiate mode aggressive crypto isakmp profile Site-to-Site-Aggressive_PAN keyring Site-to-Site_PAN self-identity address match identity address e.e.e.e 255.255.255.255 match identity address f.f.f.f 255.255.255.255 match identity address d.d.d.d 255.255.255.255 <- My new add keepalive 10 retry 3 initiate mode aggressive crypto ipsec transform-set CSC-TS1 esp-3des esp-sha-hmac crypto ipsec transform-set CSC-TS2 esp-aes 256 esp-sha-hmac crypto ipsec transform-set CSC-TS3 esp-des esp-md5-hmac crypto ipsec transform-set CSC-TS4 esp-aes esp-sha-hmac crypto ipsec transform-set CSC-TS5 esp-aes 256 esp-sha256-hmac crypto dynamic-map CSC-DMAP 5 set security-association lifetime kilobytes disable set security-association lifetime seconds 28800 set transform-set CSC-TS5 set reverse-route distance 240 set reverse-route tag 240 set isakmp-profile Site-to-Site-Aggressive_PAN reverse-route crypto dynamic-map CSC-DMAP 10 set security-association lifetime kilobytes disable set security-association lifetime seconds 28800 set transform-set CSC-TS1 CSC-TS2 CSC-TS3 CSC-TS4 set reverse-route distance 240 set reverse-route tag 240 set isakmp-profile Site-to-Site-Aggressive reverse-route crypto dynamic-map CSC-DMAP 20 set security-association lifetime kilobytes disable set security-association lifetime seconds 28800 set transform-set CSC-TS1 CSC-TS2 CSC-TS3 CSC-TS4 set reverse-route distance 240 set reverse-route tag 240 set isakmp-profile Site-to-Site-Main reverse-route crypto map CSC-CMAP 20 ipsec-isakmp dynamic CSC-DMAP interface G0/0 crypto map CSC-CMAP redundancy dmzvpn <-- I just negate this and re-add and new peers start working.
... View more
Labels:
Created by
nellson
in Network Management
in Network Management
09-27-2012
12:59 PM
09-27-2012
12:59 PM
I have created my own custome dashboard under Detail Dashboards. I have added 4 "Interface Tx and Rx Utilization" Dashlets. When I edit them, I don't see how I tie them to an interface? In the Interface Detail Dashboard, the entire page uses a Filter to pick an interface to show stats on. I can't even add a filter to my dashboard, the drop down is empty. This is CPI 1.2, and I am only using the ROOT-DOMAIN at this time. Nick
... View more
Labels:
Created by
nellson
in Network Management
in Network Management
09-27-2012
07:02 AM
09-27-2012
07:02 AM
I have been looking at Prime Infrastructure, trying to eliminate a mix of Entuity's Eye of the Storm and BMC's Network Automation. The LMS bit of CPI seems to cover what BMC does, with out any gaps. But my manager was interested in the reports on bandwidth utilization of key links. Entuity's Eye (Or NetScout, SolarWinds NPM, and such) would let you pick an interface or two and show the IN/OUT stats. From what I can tell, CPI is primarily aimed at TOP-N based statistics in a more general sense. Does anyone use a variant of Prime to watch traffic stats, and if so, what modules sould I be looking at? Nick
... View more
Labels:
Created by
nellson
in Network Management
in Network Management
09-26-2012
07:51 AM
09-26-2012
07:51 AM
task46=... task47=... (submit, reopen) task48=... To Cisco CSACS team: This is progress???? task48=... (oh frick!, click, edit, task49, replace..)
... View more
Created by
nellson
in Network Management
in Network Management
09-26-2012
07:07 AM
09-26-2012
07:07 AM
Oh dear gosh.... I added: role0=Root virtual-domain0=ROOT-DOMAIN task0=All (Cause that was in the list for the ROOT group) And while I now get logged in, I don't have permissions to even display the Monitor Summary page... Please, someone tell me that I do not have to enter ALL of the AV Pairs one at a time (thank you CSACS 5.x ) What is the point of having the role "ROOT" if you have restrictions??? Nick
... View more
Created by
nellson
in Network Management
in Network Management
09-26-2012
06:40 AM
09-26-2012
06:40 AM
Oh good grief... Thank you, Alex!! (smh) how did I miss this...
... View more
Created by
nellson
in Network Management
in Network Management
09-25-2012
12:43 PM
09-25-2012
12:43 PM
I am scanning the documentation for CPI 1.2, trying to get it to use CSACS 5.3 for my authentication/Authorization. The docs say to create a TACACS Shell Profile, and add the TACACS A/V Pairs as needed... um... nowhere could I find a listing of AV Pairs I can use to grant authorization. I did see that what ever pairs I did use, I must keep the menu chain in tact.. that makes sense. Anyone got a list somewhere of how they are formatted? Or a document I can use? Nick
... View more
Labels:
08-23-2012
02:42 PM
I have read a number of posts regarding the 3750x series switches and performance issues. I have also read the comparison white papers that HP puts out (with a grain of salt, mind you) listing possible over subscription being a production characteristic of this model. As one of the harder performance issues to document, has anyone with this stack model fought this battle? I have a pair of switch clusters (This one has a bug that messes up the output drop counters, have to use the asic counters) * 1 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M 2 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M 3 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M This one runs clean, no display bugs. 1 54 WS-C3750X-48P 12.2(53)SE2 C3750E-UNIVERSALK9-M * 2 54 WS-C3750X-48P 12.2(53)SE2 C3750E-UNIVERSALK9-M And one 2960G * 1 24 WS-C2960G-24TC-L 12.2(35)SE5 C2960-LANBASE-M The remote admin of this location has been doing a 550Meg .iso file transfer between two systems, moving them between the switches, using SMB/CIFS as the transfer protocol. The 3750x stacks are on the order of 3-5 minutes slower to complete the transfers. I am going back and working with the Admin on the site, to get a better test matrix so I have indivudual ports and what was done. But I did clear the counters all around, and the switches do run clean.. not an obvious duplex mismatch issue. Looking to add heads and ideas on what I should be testing/looking at. I'll post what I learn. Nick
... View more
Labels:
07-29-2010
10:41 AM
Did you ever get a response? I did JUST as you did, and NADA in my CSACS logs. The tacacs servers appear up sho tacacs-server timeout value:5 deadtime value:0 total number of servers:2 following TACACS+ servers are configured: 172.21.1.221: available on port:49 TACACS+ shared secret:******** 172.21.174.221: available on port:49 TACACS+ shared secret:******** But with the same config you have, I get only local auth. And no options for Authorization?? What's up with that? Nick
... View more
05-10-2016
Same issue moving code from a ISR3925 G2 to a 4451 ISR running IOS XE..
I depend on the reversible f...
Created by
nellson
in Wireless Security and Network Management
03-03-2013
03-03-2013
Oh, of course if I was running this for full time home use, I would be
using much less. The overload...
Created by
nellson
in Wireless Security and Network Management
03-03-2013
03-03-2013
Hi Scott,I appear to have fallen into some dumb luck. Fo followed the
initial test of adding a "test...
Created by
nellson
in Wireless Security and Network Management
03-03-2013
03-03-2013
I have a WLC 2106 with two AP's connected, But have not set up any
authentication. I don't have CSAC...
Created by
nellson
in VPN and AnyConnect
12-11-2012
12-11-2012
This is where the connection sits...show crypto session detailInterface:
GigabitEthernet0/0Profile: ...
Created by
nellson
in VPN and AnyConnect
12-11-2012
12-11-2012
I have a frustrating issue with a dynamic VPN head end running IOS 15.2
on 2900's. I have existing k...
09-27-2012
I have created my own custome dashboard under Detail Dashboards. I have
added 4 "Interface Tx and Rx...
Created by
nellson
in Network Management
09-27-2012
09-27-2012
I have been looking at Prime Infrastructure, trying to eliminate a mix
of Entuity's Eye of the Storm...
Created by
nellson
in Network Management
09-26-2012
09-26-2012
task46=...task47=...(submit, reopen)task48=...To Cisco CSACS team: This
is progress????task48=...(oh...
Created by
nellson
in Network Management
09-26-2012
09-26-2012
Oh dear gosh.... I added:role0=Rootvirtual-domain0=ROOT-DOMAINtask0=All
(Cause that was in the list ...
Created by
nellson
in Network Management
09-26-2012
09-26-2012
Oh good grief... Thank you, Alex!!(smh) how did I miss this...
Created by
nellson
in Network Management
09-25-2012
09-25-2012
I am scanning the documentation for CPI 1.2, trying to get it to use
CSACS 5.3 for my authentication...
08-23-2012
I have read a number of posts regarding the 3750x series switches and
performance issues. I have als...
Public Statistics
| Date Registered | 07-26-2001 10:38 AM |
| Date Last Visited | 08-18-2017 03:56 AM |
| Total Messages Posted | 22 |
| Total Helpful Votes Received | 4 |
