Solved

freeradius + cisco asa vpn

Posted on 2010-09-01
7
2,103 Views
Last Modified: 2012-05-10
Hello,

I'm trying to setup dynamic split tunnels in my VPN with Cisco ASA.
I setup into radreply database the config:

|      id      |      username      |            attribute                  |       op      |      value            |
---------------------------------------------------------------------------------------------------------------------------------
|      1      |      userX            |      CVPN3000-IPSec-Split-Tunnel-List      |      =      |      acl-name      |


But when I test the loggin, radius debbuging says:
    rlm_sql: Failed to create the pair: Invalid octet string "acl-name" for attribute name " cVPN3000-IPSec-Split-Tunnel-List"
And user is rejected for access.

Does anyone know how to setup this correctly?

Thanks!
0
Comment
Question by:jhclemente
  • 4
  • 3
7 Comments
 
LVL 77

Expert Comment

by:arnold
ID: 33586266

Check the attribute files to make sure you have the correct definition for the attribute.

https://supportforums.cisco.com/thread/217951;jsessionid=B99ED992EF545E8F08583BFAB9DC1CAB.node0
Have you looked at trying to use ipsec-split-tunnel-list instead?
0
 
LVL 4

Author Comment

by:jhclemente
ID: 33588775
Yes, even with "ipsec-split-tunnel-list" I get the same error.

I found in dictionary.cisco.vpn3000 this:

      ATTRIBUTE         CVPN3000-IPSec-Split-Tunnel-List      27      string

And my client is defined this way:

      client IPAddr {
            shortname = shortNameOfClient
            secret = secretPass
            nastype = Cisco-VPN3000
      }


Any idea why I get that error?
0
 
LVL 77

Expert Comment

by:arnold
ID: 33588967
The error seems to suggest that acl-name is an invalid string.
Could you check whether the op should be := rather than =?

0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 77

Expert Comment

by:arnold
ID: 33589086
run the radiusd in debug mode to see what it is doing right before this error.

0
 
LVL 4

Author Comment

by:jhclemente
ID: 33591626
Both operators ( := and = ) do the same

This is the debug output:

[files] users: Matched entry DEFAULT at line 172
++[files] returns ok
[sql]       expand: %{User-Name} -> USERNAME
[sql] sql_set_user escaped user --> 'USERNAME'
rlm_sql (sql): Reserving sql socket id: 9
[sql]       expand: --------- REMOVED QUERY -------------
[sql] User found in radcheck table
[sql]       expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}'             ORDER BY id  ->  SELECT id, username, attribute, value, op FROM radreply WHERE username = 'USERNAME' ORDER BY id
rlm_sql: Failed to create the pair: Invalid octet string "acl-name" for attribute name "CVPN3000-IPSec-Split-Tunnel-List"
rlm_sql (sql): Error getting data from database
[sql] SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 9
++[sql] returns fail
0
 
LVL 77

Expert Comment

by:arnold
ID: 33591895
can you try aclname and see if it makes a difference?
Also what is the output
SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' order by id
presumably USERNAME in the above was commented out for a valid username.

0
 
LVL 4

Accepted Solution

by:
jhclemente earned 0 total points
ID: 33600868
I finally found the problem.... everything was right in the database.
The problem was with dictionary file.... it had commented out the line for including dictionary.cisco.vpn3000
I removed the comment and it worked.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Help with ASA config smtp traffic 10 38
Adding VPN user with Cisco RV110W changes IP address 7 36
ISP Change 14 44
Cisco 5508 WLC software upgrade 2 27
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now