[c-nsp] vti tunnel configuration via radius with inacl avrpair
Thomas Braun
thomas.braun at flashstudy.de
Fri Jan 23 08:10:29 EST 2009
Hi Group,
i run into a problem with vti tunnel interface.
I got following error message when i try to install inacl or outacl via
cisco-avrpairs:
%AAA-3-BADHDL: invalid hdl AAA ID 7, hdl 36000024, retire
I use the cisco-avrpair example from the cisco site:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1090640
I use freeradius for the authorization and i send following string to
the cisco router:
mysql> select * from radreply where username='tb';
+----+----------+--------------+----+----------------------------------------------+
| id | UserName | Attribute | op | Value
|
+----+----------+--------------+----+----------------------------------------------+
| 45 | tb | Cisco-AVPair | += | ip:outacl#101=permit tcp any any
established |
+----+----------+--------------+----+----------------------------------------------+
1 row in set (0.00 sec)
I got the same error message with following entry:
ip:sub-policy-Out#4=pppoemap
When i remove the 2 AVPairs i don't get the error message.
I tried different ios version to test this feature, from 12.4T9 to
12.4T22 and i use a cisco 2821 to test it.
Maybe someone has seen the same problem and has a workaround.
Here is the debug output:
*Jan 23 13:43:52.211: AAA/BIND(00000011): Bind i/f
*Jan 23 13:43:52.243: AAA/AUTHOR (0x11): Pick method list 'groupauthor'
*Jan 23 13:43:52.243: RADIUS/ENCODE(00000011):Orig. component type =
VPN_IPSEC
*Jan 23 13:43:52.243: RADIUS(00000011): Config NAS IP: 0.0.0.0
*Jan 23 13:43:52.243: RADIUS/ENCODE(00000011): acct_session_id: 17
*Jan 23 13:43:52.243: RADIUS(00000011): sending
*Jan 23 13:43:52.243: RADIUS/ENCODE: Best Local IP-Address 55.55.55.2
for Radiu
1*Jan 23 13:43:52.243: RADIUS(00000011): Send Access-Request to
55.55.55.1:1812
2*Jan 23 13:43:52.243: RADIUS: authenticator 5C 2F C9 41 D5 A6 A9 36 -
AC 62 98
8*Jan 23 13:43:52.243: RADIUS: User-Name [1] 6 "PHAT"
*Jan 23 13:43:52.243: RADIUS: User-Password [2] 18 *
*Jan 23 13:43:52.243: RADIUS: Calling-Station-Id [31] 12 "66.66.66.2"
*Jan 23 13:43:52.243: RADIUS: NAS-Port-Type [61] 6 Virtual
]*Jan 23 13:43:52.243: RADIUS: NAS-Port [5] 6 0
*Jan 23 13:43:52.243: RADIUS: NAS-Port-Id [87] 12 "66.66.66.1"
*Jan 23 13:43:52.243: RADIUS: Service-Type [6] 6 Outbound
]*Jan 23 13:43:52.243: RADIUS: NAS-IP-Address [4] 6 55.55.55.2
*Jan 23 13:43:52.247: RADIUS: Received from id 1645/19 55.55.55.1:1812,
Access-
6*Jan 23 13:43:52.247: RADIUS: authenticator 27 FF 7E 5E 89 30 19 72 -
5A 2B FD
1*Jan 23 13:43:52.247: RADIUS: Service-Type [6] 6 Outbound
]*Jan 23 13:43:52.247: RADIUS: Vendor, Cisco [26] 36
*Jan 23 13:43:52.247: RADIUS: Cisco AVpair [1] 30
"ipsec:addr-pool=P
"*Jan 23 13:43:52.247: RADIUS: Vendor, Cisco [26] 30
*Jan 23 13:43:52.247: RADIUS: Cisco AVpair [1] 24
"ipsec:key-exchang
"*Jan 23 13:43:52.247: RADIUS: Vendor, Cisco [26] 35
*Jan 23 13:43:52.247: RADIUS: Cisco AVpair [1] 29
"ipsec:tunnel-pass
"*Jan 23 13:43:52.247: RADIUS: Vendor, Cisco [26] 29
*Jan 23 13:43:52.247: RADIUS: Cisco AVpair [1] 23
"ipsec:tunnel-type
"*Jan 23 13:43:52.247: RADIUS(00000011): Received from id 1645/19
*Jan 23 13:43:52.267: AAA/BIND(00000012): Bind i/f
*Jan 23 13:43:52.271: RADIUS/ENCODE(00000012):Orig. component type =
VPN_IPSEC
*Jan 23 13:43:52.271: RADIUS/ENCODE(00000012): dropping service type,
"radius-s
f*Jan 23 13:43:52.271: RADIUS(00000012): Config NAS IP: 0.0.0.0
*Jan 23 13:43:52.271: RADIUS/ENCODE(00000012): acct_session_id: 18
*Jan 23 13:43:52.271: RADIUS(00000012): sending
*Jan 23 13:43:52.271: RADIUS/ENCODE: Best Local IP-Address 55.55.55.2
for Radiu
1*Jan 23 13:43:52.271: RADIUS(00000012): Send Access-Request to
55.55.55.1:1812
4*Jan 23 13:43:52.271: RADIUS: authenticator 42 FB 1B 29 3C 18 8F A0 -
16 84 0E
0*Jan 23 13:43:52.271: RADIUS: User-Name [1] 4 "tb"
*Jan 23 13:43:52.271: RADIUS: User-Password [2] 18 *
*Jan 23 13:43:52.271: RADIUS: Calling-Station-Id [31] 12 "66.66.66.2"
*Jan 23 13:43:52.271: RADIUS: NAS-Port-Type [61] 6 Virtual
]*Jan 23 13:43:52.271: RADIUS: NAS-Port [5] 6 0
*Jan 23 13:43:52.271: RADIUS: NAS-Port-Id [87] 12 "66.66.66.1"
*Jan 23 13:43:52.271: RADIUS: NAS-IP-Address [4] 6 55.55.55.2
*Jan 23 13:43:52.275: RADIUS: Received from id 1645/20 55.55.55.1:1812,
Access-
2*Jan 23 13:43:52.275: RADIUS: authenticator 1C 69 C1 EC 2D 57 35 6B -
3D 01 D6
6*Jan 23 13:43:52.275: RADIUS: Vendor, Cisco [26] 52
*Jan 23 13:43:52.275: RADIUS: Cisco AVpair [1] 46
"ip:outacl#101=per
"*Jan 23 13:43:52.275: RADIUS(00000012): Received from id 1645/20
*Jan 23 13:43:52.279: AAA/AUTHOR (0x12): Pick method list 'groupauthor'
*Jan 23 13:43:52.279: RADIUS/ENCODE(00000012):Orig. component type =
VPN_IPSEC
*Jan 23 13:43:52.279: RADIUS(00000012): Config NAS IP: 0.0.0.0
*Jan 23 13:43:52.279: RADIUS/ENCODE(00000012): acct_session_id: 18
*Jan 23 13:43:52.279: RADIUS(00000012): sending
*Jan 23 13:43:52.279: RADIUS/ENCODE: Best Local IP-Address 55.55.55.2
for Radiu
1*Jan 23 13:43:52.279: RADIUS(00000012): Send Access-Request to
55.55.55.1:1812
8*Jan 23 13:43:52.279: RADIUS: authenticator 92 C8 4E 0E E3 16 02 6E -
0B 64 CA
C*Jan 23 13:43:52.279: RADIUS: User-Name [1] 6 "PHAT"
*Jan 23 13:43:52.279: RADIUS: User-Password [2] 18 *
*Jan 23 13:43:52.279: RADIUS: Calling-Station-Id [31] 12 "66.66.66.2"
*Jan 23 13:43:52.279: RADIUS: NAS-Port-Type [61] 6 Virtual
]*Jan 23 13:43:52.279: RADIUS: NAS-Port-Type [61] 6 Virtual
]*Jan 23 13:43:52.279: RADIUS: NAS-Port [5] 6 0
*Jan 23 13:43:52.279: RADIUS: NAS-Port-Id [87] 12 "66.66.66.1"
*Jan 23 13:43:52.279: RADIUS: Service-Type [6] 6 Outbound
]*Jan 23 13:43:52.279: RADIUS: NAS-IP-Address [4] 6 55.55.55.2
*Jan 23 13:43:52.283: RADIUS: Received from id 1645/21 55.55.55.1:1812,
Access-
6*Jan 23 13:43:52.283: RADIUS: authenticator 3E AA 07 BE 08 03 8F BC -
19 AA 22
B*Jan 23 13:43:52.283: RADIUS: Service-Type [6] 6 Outbound
]*Jan 23 13:43:52.283: RADIUS: Vendor, Cisco [26] 36
*Jan 23 13:43:52.283: RADIUS: Cisco AVpair [1] 30
"ipsec:addr-pool=P
"*Jan 23 13:43:52.283: RADIUS: Vendor, Cisco [26] 30
*Jan 23 13:43:52.283: RADIUS: Cisco AVpair [1] 24
"ipsec:key-exchang
"*Jan 23 13:43:52.283: RADIUS: Vendor, Cisco [26] 35
*Jan 23 13:43:52.283: RADIUS: Cisco AVpair [1] 29
"ipsec:tunnel-pass
"*Jan 23 13:43:52.283: RADIUS: Vendor, Cisco [26] 29
*Jan 23 13:43:52.283: RADIUS: Cisco AVpair [1] 23
"ipsec:tunnel-type
"*Jan 23 13:43:52.283: RADIUS(00000012): Received from id 1645/21
*Jan 23 13:43:52.295: %AAA-3-BADHDL: invalid hdl AAA ID 18, hdl
1B000077, retir
4*Jan 23 13:43:52.307: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Virtual-A
Regards
thomas
More information about the cisco-nsp
mailing list