| *** makobug (~csec14_2@128.8.135.198) has joined #wikid | 00:50 | |
| *** makobug has parted #wikid (None) | 02:11 | |
| *** m0rg4n (4ce2a73e@gateway/web/freenode/ip.76.226.167.62) has joined #wikid | 06:33 | |
| *** m0rg4n has quit (Client Quit) | 06:33 | |
| *** nowen (~nowen@adsl-66-184-38.asm.bellsouth.net) has joined #wikid | 14:31 | |
| *** Bart_ (d57e804a@gateway/web/freenode/ip.213.126.128.74) has joined #wikid | 15:19 | |
| *** WI_User (a5bd4f32@gateway/web/freenode/ip.165.189.79.50) has joined #wikid | 15:36 | |
| WI_User | New Install using RADIUS and ASA - Can anyone help? | 15:37 |
|---|---|---|
| nowen | sure | 15:37 |
| nowen | at least on the WiKID side ;) | 15:37 |
| nowen | did you restart wikid after creating the network client for the ASA? | 15:38 |
| nowen | also, there is a known issue where radius takes forever to start | 15:38 |
| WI_User | Cool . Config the server via IOS and VM and that's all good. RADIUS in inabled and the server is validating users and users can get passcodes but when I test auth there is nothing in the logs. I have a trace as this server is a dmz and it shows the ASA making a connection to the server on UDP 1812 but the server logs nothing | 15:39 |
| nowen | sounds like the fw is blocking - did you restart WiKID with 'wikidctl restart'? | 15:40 |
| WI_User | Yep. | 15:40 |
| nowen | on the WiKID server, run 'netstat -anp | grep 1812' and see if there is a listener | 15:41 |
| WI_User | Retuns"upd 0 0 :::1812 :::*" | 15:42 |
| nowen | ok | 15:43 |
| nowen | run 'iptables -L -n' and make sure that the fw has a port open for the IP of the ASA | 15:44 |
| WI_User | Looks good: | 15:49 |
| WI_User | Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 127.0.0.1 0.0.0.0/0 state NEW tcp dpt:49 ACCEPT tcp -- 127.0.0.1 0.0.0.0/0 state NEW tcp dpt:8388 ACCEPT udp -- 127.0.0.1 0.0.0.0/0 state NEW udp dpt:1813 ACCEPT tcp -- 127.0.0.1 0.0.0.0/0 state NEW tcp dpt:1813 ACCEPT | 15:49 |
| nowen | hmm, no, it shouldn't be the localhost, it should be the cisco ASA | 15:50 |
| WI_User | Sorry there was amore | 15:51 |
| WI_User | ACCEPT udp -- 10.123.1.8 0.0.0.0/0 state NEW udp dpt:1812 ACCEPT tcp -- 10.123.1.8 0.0.0.0/0 state NEW tcp dpt:1812 | 15:51 |
| WI_User | I think I see the issue | 15:51 |
| nowen | what? wrong IP? | 15:52 |
| WI_User | The ASA network client will be use PAT to access the server in the DMZ so the network client will be 62.200 | 15:52 |
| WI_User | I changed the network client but the firewall tables did not update | 15:53 |
| WI_User | If I create a new client will the tables update? | 15:53 |
| nowen | sorry - you still have to restart - the radius client caches the info | 15:55 |
| nowen | but once you restart, you should be good | 15:55 |
| WI_User | Checking... | 15:57 |
| nowen | ok - brb, coffee time | 15:59 |
| WI_User | Built outbound UDP connection 211331626 for dmz:10.123.62.15/1812 (10.123.62.15/1812) to inside:10.123.xxx.8/1025 (10.123.62.200/47518) | 16:01 |
| WI_User | Still no activity on the WiKID server. Just the issuing of the passcode | 16:01 |
| nowen | try running 'service iptables stop' and then test. we'll know if it is the firewall | 16:03 |
| WI_User | Sorry I was away. Testing now | 16:16 |
| nowen | k | 16:16 |
| WI_User | That worked | 16:17 |
| nowen | hmm | 16:17 |
| nowen | is this an RPM install? | 16:17 |
| WI_User | Access granted for klivese, domain code: 165189075015 client: /10.123.62.200 | 16:17 |
| WI_User | This is the 30 day trail IOS build on a VM | 16:18 |
| nowen | hmm | 16:21 |
| nowen | is /10.123.62.200 the asa? | 16:22 |
| WI_User | 10.123.62.200 is the pat address any client will be assigned when communication from the inside trusted network to the DMZ. | 16:23 |
| WI_User | It's the network client address I have in the WiKID server. | 16:24 |
| nowen | pat address? | 16:24 |
| WI_User | Port Address Translation. Like NAT Network Address Translation. | 16:25 |
| WI_User | It assigned and maps 10.123.1.x address to 10.123.62.200 when talking to the DMZ network 10.123.62.x | 16:26 |
| nowen | hmm. the network client for WiKID is supposed to be the ASA | 16:27 |
| WI_User | It is as far as the WiKID sever knows. | 16:28 |
| nowen | but it is supposed to be static, otherwise, the fw won't let it in. | 16:28 |
| nowen | is it static? | 16:29 |
| WI_User | The network client will always use 62.200 when communiatioing with the WiKID server so in that way it's static | 16:30 |
| nowen | ok - sorry, a bit slow today and too many windows open ;) | 16:30 |
| WI_User | Is there an IPS IDS running on the WiKID server | 16:30 |
| nowen | no, just the fw | 16:30 |
| WI_User | K | 16:31 |
| WI_User | Hmm | 16:31 |
| nowen | but if that is the network client IP, then the fw should open a port for it | 16:31 |
| nowen | hmm, ACCEPT udp -- 10.123.1.8 0.0.0.0/0 state NEW udp dpt:1812 ACCEPT tcp -- 10.123.1.8 0.0.0.0/0 state NEW tcp dpt:1812 | 16:31 |
| WI_User | It did. | 16:31 |
| WI_User | ACCEPT tcp -- 10.123.62.200 0.0.0.0/0 state NEW tcp dpt:49 ACCEPT tcp -- 10.123.62.200 0.0.0.0/0 state NEW tcp dpt:8388 ACCEPT udp -- 10.123.62.200 0.0.0.0/0 state NEW udp dpt:1813 ACCEPT tcp -- 10.123.62.200 0.0.0.0/0 state NEW tcp dpt:1813 ACCEPT udp -- 10.123.62.200 0.0.0.0/0 state NEW udp dpt:1812 ACCEPT tcp | 16:31 |
| nowen | hmm | 16:32 |
| WI_User | I know strange | 16:32 |
| nowen | ok - so did you restart iptables? if, so try again | 16:32 |
| WI_User | Not yet I will. is there a way to review the iptables log to see why it's blocking UDP 1812 traffic? | 16:33 |
| nowen | you can run 'tail -f /var/log/secure' | 16:34 |
| WI_User | K. The test failed. No logs just the issuing of the passcode "Issued passcode to device 2184324507355248423" | 16:35 |
| WI_User | I will check the firewall logs | 16:35 |
| WI_User | There are no logs for the last hour and a half ??? | 16:38 |
| WI_User | Last line Mar 8 08:57:41 wikid runuser: pam_unix(runuser-l:session): session closed for user postgres | 16:38 |
| WI_User | Going to restart the server | 16:39 |
| nowen | what does 'date' return? | 16:39 |
| WI_User | It's an hour behind | 16:41 |
| nowen | did you set the time-zone | 16:41 |
| WI_User | Yep. CST -S Chicago | 16:42 |
| WI_User | err -6 | 16:42 |
| nowen | you can use date to also set the time | 16:44 |
| nowen | 'date 03081146' or whatever time it is there | 16:45 |
| WI_User | hmm. After a restart I cannot access the web admin console | 16:50 |
| nowen | 'netstat -anp | grep 443' | 16:50 |
| WI_User | I reran the wikidctl setup and verifed all settings | 16:50 |
| nowen | is there an error? | 16:50 |
| WI_User | Nothing | 16:51 |
| WI_User | Netstat returns nothing | 16:51 |
| *** bigbash has parted #wikid ("Leaving") | 16:53 | |
| nowen | have a look in /opt/WiKID/tomcat/logs/catalina.out | 16:56 |
| WI_User | k | 16:56 |
| WI_User | Tail shows Mar 8, 2011 9:39:19 AM org.apache.coyote.http11.Http11BaseProtocol destroy INFO: Stopping Coyote HTTP/1.1 on http-80 Mar 8, 2011 9:39:19 AM org.apache.coyote.http11.Http11BaseProtocol destroy INFO: Stopping Coyote HTTP/1.1 on http-443 | 16:57 |
| nowen | hmm | 16:58 |
| nowen | try running wikidctl start again | 16:58 |
| WI_User | That started successfuly but a test auth after failed | 17:02 |
| WI_User | Nothing in the secure log | 17:03 |
| WI_User | Is there a way to set the firewall logging to debugging | 17:04 |
| nowen | maybe this: http://www.cyberciti.biz/tips/force-iptables-to-log-messages-to-a-different-log-file.html? | 17:11 |
| WI_User | K. You have your note pad open? | 17:17 |
| WI_User | I edited the DMZ ACL to allow the WiKID server to access any time server via UDP 123 and once the servers time was updated I tested again... It works! | 17:19 |
| nowen | hehe | 17:19 |
| nowen | so, it was the date? | 17:20 |
| WI_User | Seems to be. I don't know of any reason that would affect iptables or RADIUS | 17:20 |
| WI_User | Have a good one and thanks for your assistance | 17:21 |
| nowen | np | 17:21 |
| nowen | here to help | 17:21 |
| *** WI_User has quit (Quit: Page closed) | 17:21 | |
| *** klaze (4227a4c2@gateway/web/freenode/ip.66.39.164.194) has joined #wikid | 18:02 | |
| klaze | hello | 18:03 |
| nowen | hi | 18:11 |
| nowen | klaze: let me know if you have any questions about wikid | 18:21 |
| *** klaze has quit (Quit: Page closed) | 18:21 | |
| nowen | ls | 18:24 |
| *** nowen has quit (Quit: Leaving.) | 21:57 | |
| *** klaze (4227a4c2@gateway/web/freenode/ip.66.39.164.194) has joined #wikid | 22:05 | |
| klaze | hello | 22:05 |
| klaze | ill check back later | 22:40 |
| *** klaze has quit (Quit: Page closed) | 22:51 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!