FreeRadius User-password encoding

Answered Question
Mar 6th, 2007


I'm trying to setup a RADIUS server to authenticate my users on a couple of routers.

Now I've done my initial setup on a 1811 router and everything works fine, moving to a production 2801 router I get into problems. Trying our second production 2801 it works fine again. I'm busting my head on what might be wrong but cannot find anything!

What I see in my FreeRadius outputlog:

rad_recv: Access-Request packet from host, id=172, length=96

User-Name = "sander"

Reply-Message = "Password: "

User-Password = "\204p\034\272\345\346K^\250s\346\200gN\035\250"

NAS-Port = 194

NAS-Port-Id = "tty194"

NAS-Port-Type = Virtual

Calling-Station-Id = ""

NAS-IP-Address =

rlm_sql (sql): Reserving sql socket id: 3

So the User-Password get's crypted somehow by the Cisco. The password is "test" for now. If I login from my other two Cisco routers I see the plaintex password in the logfile from FreeRadius (like I'd expect).

Is there any reason why this 2801 router is acting weird and putting a different user-password encoding into the mix?

Both 2801 are running the same IOS release.

Please help!

I have this problem too.
0 votes
Correct Answer by Vivek Santuka about 9 years 7 months ago


Only password in encrypted with RADIUS. I would suggest checking the keys



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Vivek Santuka Wed, 03/07/2007 - 04:19


IOS will encrypt the password field in a Radius packet if you are using a secret key.

Please remove any "key" keyword from the radius host entry or remove "radius-server key" command from the config.



marketgraph Wed, 03/07/2007 - 16:34

Thanks for your answer but I'm a little confused. On both my 2801 routers I have the following:

radius-server host auth-port 1812 acct-port 1813 key 7 <>

Both servers use there own key for radius authentication on my free radisu but that part seems to work as the reques come through. But only one of these Cisco 2801 lets me see the password in the radius log (in which case the checking works)

Or is only the password bit encrypted and could my key be wrong?

Correct Answer
Vivek Santuka Thu, 03/08/2007 - 02:45


Only password in encrypted with RADIUS. I would suggest checking the keys




This Discussion