Hi,
I have trying to setup Freeradius to work with my MikroTik as a NAS. My aim is to have session time limit per user. Now user can log in. Session time limiting is working on the radius server. The radius rejects the user when the time limit is reached. However my problem is the NAS does not receive Session-Timeout from the radius server. Therefore it does not terminate the active session when the time limit is reached.
It seems like MikroTik dropped the Session-Timeout. eap_peap : Got tunneled reply code 11
What should I do?
Does it have to do with enabling connection termination on my NAS?http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client#Connection_Terminating_from_RADIUS
This is my radiusd -X
Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095
Session-Timeout := 600
Idle-Timeout := 30
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb77514c3b6770d58e310744eea16afdc
(1) Finished request 1.
(8) [pap] = noop
(8) } # authorize = updated
(8) Found Auth-Type = EAP
(8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
(8) authenticate {
(8) eap : Expiring EAP session with state 0x7b061f337b0e0549
(8) eap : Finished EAP session with state 0x7b061f337b0e0549
(8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list
(8) eap : Peer sent MSCHAPv2 (26)
(8) eap : EAP MSCHAPv2 (26)
(8) eap : Calling eap_mschapv2 to process EAP data
(8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
(8) eap_mschapv2 : Auth-Type MS-CHAP {
(8) mschap : Found Cleartext-Password, hashing to create LM-Password
(8) mschap : Found Cleartext-Password, hashing to create NT-Password
(8) mschap : Creating challenge hash with username: bob
(8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password
(8) mschap : adding MS-CHAPv2 MPPE keys
(8) [mschap] = ok
(8) } # Auth-Type MS-CHAP = ok
MSCHAP Success
(8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549
(8) [eap] = handled
(8) } # authenticate = handled
} # server inner-tunnel
(8) eap_peap : Got tunneled reply code 11
Session-Timeout := 600
Idle-Timeout := 30
EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x7b061f337a0f0549d125cd93a8b94882
(8) eap_peap : Got tunneled reply RADIUS code 11
Session-Timeout := 600
Idle-Timeout := 30
EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x7b061f337a0f0549d125cd93a8b94882
(8) eap_peap : Got tunneled Access-Challenge
(8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58
(8) [eap] = handled
(8) } # authenticate = handled
