Hi Rick,

it is the password in the authentication request that I am referring to. We can see it on the freeradius server and although it is set to something different in the clients the 2811 transfers "cisco". The clients are non cisco devices so it is very likely that they are not the source of this string.

Here's the RADIUS part of my config:

aaa new-model

!

aaa group server radius AAA-CLIENT-VPN2-GROUP

server 10.10.10.1 auth-port 1812 acct-port 1813

!

aaa authentication login default local

aaa authentication ppp AAA-CLIENT-VPN2-GROUP group radius local

aaa authorization network default group AAA-CLIENT-VPN2-GROUP local

aaa accounting update periodic 2

aaa accounting network default start-stop group AAA-CLIENT-VPN2-GROUP

!

aaa pod server auth-type any server-key

aaa session-id common

!

!

!

interface FastEthernet0/0

ip address 10.10.10.254 255.255.255.0

!

interface FastEthernet0/1

ip address x.x.x.114 255.255.255.248

!

interface Virtual-Template1

ip unnumbered FastEthernet0/0

peer default ip address dhcp-pool DHCP-POOL-CLIENT-VPN2

ppp authentication pap chap ms-chap

!

!

ip radius source-interface FastEthernet0/0

!

radius-server attribute 44 include-in-access-req

radius-server host 10.10.10.1 auth-port 1812 acct-port 1813 key

radius-server unique-ident 2

Thanks,

Mat

Hi Rick,

Thanks for your reply. You are right, I sort of mixed up the two lists. As soon as I can contact my peer on the RADIUS server side I'll check if this changes the behavior.

Regards,

Mat

vpn-03(config)#aaa authentication ppp ?

WORD Named authentication list.

default The default authentication list.

vpn-03(config)#aaa authentication ppp AAA-CLIENT-VPN2-GROUP group ?

WORD Server-group name

radius Use list of all Radius hosts.

tacacs+ Use list of all Tacacs+ hosts.

Rick,

I tested it now with the syntax you proposed and it was successful. Thanks for your idea. I previously thought that not entering the list would default to any configured RADIUS server (which partly is the case). But for the password sending apparently there is a different mechanism with or without the right group name.

Thanks again. That's a good start for this year!

Regards,

Mat

Mat

I am glad that my suggestion was able to resolve your issue. I believe that the issue has less to do with whether you supply the group name or not and was the fact that you had created a named method list. So ppp authentication had no default method configured, had a named method configured, but had nothing to tell ppp to use the named method.

Thank you for using the rating system to indicate that your issue was resolved (and thanks for the rating). It makes the forum more useful when people can read about an issue and can read what was successful in resolving the issue.

I encourage you to continue your participation in the forum.

HTH

Rick