<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt">Thanks!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<p class="MsoNormal">Neil Johnson<o:p></o:p></p>
<p class="MsoNormal">319 384-0938<o:p></o:p></p>
<p class="MsoNormal"><a href="mailto:neil-johnson@uiowa.edu"><span style="color:#0563C1">neil-johnson@uiowa.edu</span></a><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Date: </b>Thursday, February 27, 2020 at 4:46 AM<br>
<b>To: </b>"radiator@lists.open.com.au" <radiator@lists.open.com.au><br>
<b>Subject: </b>[External] Re: [RADIATOR] Client definition stanza<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On 26.2.2020 1.12, Johnson, Neil M wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<p class="MsoNormal">Given the following stanza:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><Client 172.24.144.0/24><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> IdenticalClients fd9a:2c75:7d0c:6400::/64<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> # LC Research Switches<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> IdenticalClients 172.24.145.0/24<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> IdenticalClients fd9a:2c75:7d0c:6600::/64<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> #<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Identifier LC_NET_Clients<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Secret <SECRET><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> DupInterval 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></Client><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Why would connections from fd9a:2c75:7d0c:6400::1a be reported as from
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">an unknown client, but connections from fd9a:2c75:7d0c:6600::b work fine?<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Jumping back to the start of this thread; your configuration is fine and
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">it should work. The reason it does not is that when there are two IPv6
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">address blocks, the latest overwrites the previous ones. For this reason
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">client ..::b works and ::1a does not. If there had been more IPv6
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">blocks, only the last one would have worked.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The manual is also correct: it's possible to have one or more
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">IdenticalClients parameters with one or more address or address blocks
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">for each parameter.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">While this was tested with a mix of IdenticalClients, the tests did not
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">use IdenticalClients with two IPv6 blocks. For this reason the bug was
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">not detected and has been broken for the earlier versions too.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The only thing I'd remove from the above config is 'DupInterval 0'. For
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">typical use the default 10 seconds is fine. Value zero was for radpwtst
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">testing when radpwtst requests had identifier and other values that made
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">subsequent tests look like duplicate requests. Duplicate detection has
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">since version 4.0 followed RFC 5080<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In short, after IPv6 address/mask fix, the config above should work
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">fine. I'll let the list know when the fix is available.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for the report and all the debug work,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Heikki<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Heikki Vatiainen <<a href="mailto:hvn@open.com.au">hvn@open.com.au</a>><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Radiator: the most portable, flexible and configurable RADIUS server<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">anywhere. SQL, proxy, DBM, files, LDAP, TACACS+, PAM, Active Directory,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">EAP, TLS, TTLS, PEAP, WiMAX, RSA, Vasco, Yubikey, HOTP, TOTP,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS, etc.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">radiator mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:radiator@lists.open.com.au">radiator@lists.open.com.au</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://lists.open.com.au/mailman/listinfo/radiator">https://lists.open.com.au/mailman/listinfo/radiator</a><o:p></o:p></p>
</div>
</div>
</body>
</html>