☰

Cisco Aironet AP1260 无法访问 FreeRADIUS 服务器

tag-icon • tag-icon cisco freeradius wlan freeradius2
Cisco Aironet AP1260 无法访问 FreeRADIUS 服务器

我在使用 Cisco Aironet AP1260 独立接入点和 FreeRADIUS 服务器时遇到了问题。我尝试在 FreeRADIUS 服务器上设置带有身份验证的 802.11x 接入点。我已经设置了 AP 和服务器，创建了临时用户，/etc/raddb/users并使用实用程序测试了 RADIUS 服务器radtest。但是当我尝试连接到我的 AP 时，我被拒绝了，而且根本没有登录FreeRADIUS。我确定我的日志配置没有问题（启用了极其详细的日志）。我尝试运行radiusd -X以实时查看活动，但没有结果：radtest活动显示良好，但没有来自 AP 的活动。

我确实使用 检查了 UDP 流量tcpdump，并且 AP 的请求到达了服务器，但被 FreeRADIUS 守护进程忽略。端口也设置正确（默认为1812进行身份验证）。

那么，如何让 FreeRADIUS 接受 Cisco 的身份验证请求？

更新：radtest命令仅在本地主机上有效。即使我直接连接两台装有 Linux 的机器并radiusd -X在第一台机器上运行，然后尝试radtest在第二台机器上运行，FreeRADIUS 服务器也不会做出任何反应。我认为 FreeRADIUS 中存在一些配置错误，但它在哪里呢？

这是我的配置：

sasaika#sh run
Building configuration...

Current configuration : 2030 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname sasaika
!
logging rate-limit console 9
enable secret 5 *omitted*
!
aaa new-model
!
!
aaa group server radius rad_eap
 server 172.16.10.13 auth-port 1812 acct-port 1813
!
aaa authentication login eap_methods group rad_eap
!
aaa session-id common
ip domain name ex.example.com
!
!
dot11 syslog
!
dot11 ssid Edhelwen
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management wpa version 2
   guest-mode
!
!
!
username *omitted* privilege 15 secret 5 *omitted*
!
!
ip ssh time-out 60
ip ssh version 2
bridge irb
!
!
interface Dot11Radio0
 description Test-WiFi
 no ip address
 no ip route-cache
 !
 encryption mode ciphers aes-ccm
 !
 ssid Edhelwen
 !
 antenna gain 0
 station-role root access-point
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 antenna gain 0
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 no keepalive
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 172.16.10.12 255.255.255.128
 no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
radius-server host 172.16.10.13 auth-port 1812 acct-port 1813 key 7 *omitted*
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 transport input ssh
line vty 5 15
 transport input ssh
!
end

/etc/raddb/radiusd.conf：

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
name = radiusd
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
user = radiusd
group = radiusd
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
        type = auth
        ipaddr = *
        port = 1812
}

listen {
        ipaddr = *
        port = 1813
        type = acct
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions     = yes
extended_expressions    = yes
log {
    destination = files
    file = ${logdir}/radius.log
    requests = ${logdir}/radiusd-%Y%m%d.log
    syslog_facility = daemon
    stripped_names = yes
    auth = yes
    auth_badpass = yes
    auth_goodpass = yes
    msg_goodpass = "Good: "
    msg_badpass = "Bad: "
}
checkrad = ${sbindir}/checkrad
security {
        max_attributes = 200
        reject_delay = 1
        status_server = yes
}
proxy_requests  = off
$INCLUDE clients.conf
thread pool {
        start_servers = 5
        max_servers = 32
        min_spare_servers = 3
        max_spare_servers = 10
        max_requests_per_server = 0
}
modules {
        $INCLUDE ${confdir}/modules/
        $INCLUDE eap.conf
}
instantiate {
        exec
        expr
        expiration
        logintime
}

$INCLUDE policy.conf
$INCLUDE sites-enabled/

/etc/raddb/clients.conf：

client cisco-ap {
        ipaddr = 172.16.10.12
        nastype = cisco # i tried to disable it, no effect
        secret = *omitted*
        require_message_authenticator = no
}

client localhost {
        ipaddr = 127.0.0.1
        secret = *omitted*
        require_message_authenticator = no
}

答案1

问题解决了。我是 CentOS 新手，我不知道它-A INPUT -j REJECT默认在防火墙中应用规则。编辑（注释掉，因为它是测试服务器）此行后，RADIUS 检测到身份验证数据包。

答案2

实际上对于 802.1x 您需要的是aaa authentication ppp <...>线，而不是login。

相关内容