Subject: (usr-tc) l2tp tunnel authentication secret

From: Kalev Nurklik <[email-masked]>
Date: Wed, 09 Feb 2000 16:14:26 +0000

Hi.

What's the radius attribute for l2tp tunnel authentication secret?
Tunnel-Hostname (from HARC product reference) or
Tunnel-Auth-Hostname in USR dictionary does not seem to work.
Neither does Tunnel-Password or other similar attributes.
I have tried different attributes but with no success whatsoever.
All the time I get "Could not get password from radius" from l2tp
debug output.
Maybe I got wrong attribute numbers but I doubt that because I
checked all of them with "mon radius". On the other hand "mon
radius" is not be very reliable as I found out - inconsistencies
with USR dictionary names (similar but not exact) and not reporting
right values for at least one attribute - Tunnel-Security.

When I define a local HARC user with "set tunnel user ...
password etc." then the l2tp tunnel secret is equivalent to the
"system transmit authentication name" and authenticating works.
For the radius equivalent HARC product reference just states dryly -
"You can also set this from RADIUS by using a VSA"(page 180).
So what's the VSA?

Or am I missing something else?

One thing that I noticed is that when I use radius defined tunnel
account then there is no challenge AVP present in SCCRQ from
LAC(HARC) and if I turn off the tunnel authentication on the LNS
then l2tp tunneling works.
I guess I need to turn off authentication on LNS because HARC
has no clue about what the secret might be and just drops the
connection attempt with l2tp debug message "Unauthenticated
message from remotehost" when the LNS presents the challenge
AVP in SCCRP.
With local HARC user there's always an challenge AVP in SCCRQ
from LAC and as I stated before authenticating works...
This (I guess again) is probably due to HARC knowing what the
tunnel secret is for that user e.g. the "system transmit
authentication name".

So obviously there something missing or wrong with the radius
defined user.
Anyone have any ideas what that something might be?

Regards,
__________________________________
Kalev Nurklik
Delfi Online
Pa"rnu mnt. 158, 11317 Tallinn, Estonia
Tel: +372 6501709
Fax: +372 6501708
E-mail: [email-masked]
http://online.delfi.ee

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.