Unsucessful ACS to RADIUS token server exchange

Question

Hello team:
We are getting a hard time in trying to make our ACS 4.2 talk to an external FreeRadius token server.
When our ACS sends the Access-Request message, our FreeRadius token server answers with an Access-Accept message with zero atributes on the message. This answer, according to ACS documentation, should be perfectly accepted by ACS when it works as a RADIUS client. However, our ACS considers this answer as an error and so the transaction fails.
In order to compare with another platform working of radius server of our , we replaced our FreeRadius token server by another CS ACS. With this scenario, everything works! So we sniffed the ACS to ACS transaction and found that two RADIUS attributes are sent with the Access-Accept message:
(1) Framed-IP = 255.255.255.255
(2) Class = 0x434143533a302f356662622f37663030303030312f31383133
We got back to our FreeRadius as the external RADIUS server of our ACS, and managed it to generate and return exactly the previous kind of message to the ACS working as radius client, however when our ACS receives the RADIUS Access-Accept with these attributes, it still rejects the answer and fails.
So we are missing something.
¿Did anyone manage to make ACS query an external RADIUS server with success? We would appreciate any hints!!
thank you very much in advance
Rogelio Alvez
Argentina

Answer 1

Thanks for the interest Tarik!
Here you have the debug from both sides ACS 4.2 and Freeradius in the same authentication event:
ACS Debug from a terminal monitor
2w1d: AAA/AUTHEN/CONT (4096347873): continue_login (user='(undef)')
2w1d: AAA/AUTHEN (4096347873): status = GETUSER
2w1d: AAA/AUTHEN (4096347873): Method=radius (radius)
2w1d: AAA/AUTHEN (4096347873): status = GETPASS
2w1d: AAA/AUTHEN/CONT (4096347873): continue_login (user='camara/829113')
2w1d: AAA/AUTHEN (4096347873): status = GETPASS
2w1d: AAA/AUTHEN (4096347873): Method=radius (radius)
2w1d: RADIUS: ustruct sharecount=1
2w1d: RADIUS: Initial Transmit tty7 id 175 192.168.0.3:1645, Access-Request, len 86
2w1d:         Attribute 4 6 C0A800CB
2w1d:         Attribute 5 6 00000007
2w1d:         Attribute 61 6 00000005
2w1d:         Attribute 1 15 63616D61
2w1d:         Attribute 31 15 3139322E
2w1d:         Attribute 2 18 893A4B64
2w1d: RADIUS: Received from id 175 192.168.0.3:1645, Access-Reject, len 32
2w1d:         Attribute 18 12 52656A65
2w1d: RADIUS: saved authorization data for user 80E8A88C at 0
2w1d: AAA/AUTHEN (4096347873): status = FAIL
2w1d: AAA/AUTHEN/ABORT: (4096347873) because Invalid password.
2w1d: AAA/MEMORY: free_user (0x80E8A88C) user='camara/829113' ruser='' port='tty7' rem_addr='192.168.0.202' authen_type=ASCII service=LOGIN priv=1
2w1d: AAA: parse name=tty7 idb type=-1 tty=-1
2w1d: AAA: name=tty7 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=7 channel=0
2w1d: AAA/MEMORY: create_user (0x80E8B920) user='' ruser='' port='tty7' rem_addr='192.168.0.202' authen_type=ASCII service=LOGIN priv=1
2w1d: AAA/AUTHEN/START (2072451976): port='tty7' list='pepe' action=LOGIN service=LOGIN
2w1d: AAA/AUTHEN/START (2072451976): found list pepe
2w1d: AAA/AUTHEN/START (2072451976): Method=radius (radius)
2w1d: AAA/AUTHEN (2072451976): status = GETUSER
Freeradius Debug
rad_recv: Access-Request packet from host 192.168.0.3 port 3912, id=23, length=94
    User-Name = "camara/829113"
    NAS-IP-Address = 192.168.0.3
    NAS-Port = 6372
    NAS-Identifier = "CiscoSecure ACS v4.2(0.124)"
    User-Password = "\277\241\340t\312/\2303^;\216\233\3618\2179"
# Executing section authorize from file /etc/freeradius/sites-enabled/vuserver
+- entering group authorize {...}
++[preprocess] returns ok
[auth_log]     expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.3/auth-detail-20120714
[auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.3/auth-detail-20120714
[auth_log]     expand: %t -> Sat Jul 14 18:42:32 2012
++[auth_log] returns ok
[IPASS] Looking up realm "camara" for User-Name = "camara/829113"
[IPASS] Found realm "DEFAULT"
[IPASS] Adding Stripped-User-Name = "829113"
[IPASS] Adding Realm = "DEFAULT"
[IPASS] Authentication realm is LOCAL.
++[IPASS] returns ok
[suffix] Request already proxied.  Ignoring.
++[suffix] returns ok
++[files] returns noop
++[control] returns noop
rlm_perl: Response: 201: Succeeded
rlm_perl: Added pair User-Name = camara/829113
rlm_perl: Added pair User-Password = \277\241\340t\312/\2303^;\216\233\3618\2179
rlm_perl: Added pair NAS-Identifier = CiscoSecure ACS v4.2(0.124)
rlm_perl: Added pair Realm = DEFAULT
rlm_perl: Added pair Stripped-User-Name = 829113
rlm_perl: Added pair NAS-Port = 6372
rlm_perl: Added pair NAS-IP-Address = 192.168.0.3
rlm_perl: Added pair Class = 0x434143533a302f3265662f37663030303030312f31383133
rlm_perl: Added pair Framed-IP-Address = 255.255.255.255
rlm_perl: Added pair Auth-Type = Perl
++[perl] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = Perl
# Executing group from file /etc/freeradius/sites-enabled/vuserver
+- entering group Perl {...}
rlm_perl: Added pair User-Name = camara/829113
rlm_perl: Added pair NAS-Identifier = CiscoSecure ACS v4.2(0.124)
rlm_perl: Added pair User-Password = \277\241\340t\312/\2303^;\216\233\3618\2179
rlm_perl: Added pair Realm = DEFAULT
rlm_perl: Added pair NAS-IP-Address = 192.168.0.3
rlm_perl: Added pair NAS-Port = 6372
rlm_perl: Added pair Stripped-User-Name = 829113
rlm_perl: Added pair Framed-IP-Address = 255.255.255.255
rlm_perl: Added pair Class = 0x434143533a302f3265662f37663030303030312f31383133
rlm_perl: Added pair Auth-Type = Perl
++[perl] returns ok
  WARNING: Empty post-auth section.  Using default return values.
# Executing section post-auth from file /etc/freeradius/sites-enabled/vuserver
Sending Access-Accept of id 23 to 192.168.0.3 port 3912
    Framed-IP-Address = 255.255.255.255
    Class = 0x434143533a302f3265662f37663030303030312f31383133
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 3 ID 23 with timestamp +575
Ready to process requests.
Inside the file archive.zip you`ll find
cap_freeradius.cap (communication sniffed between the ACS and the Freeradius)
captura2acsOK.pcapng (communication sniffed between the ACS 1 and the ACS 2 where everything its ok)
If you need more information or output please let me know.
Rogelio