how to configure FreeRADIUS to proxy the PAP reque

Question

how can I configure FreeRADIUS to proxy the PAP request inside an EAP-TTLS tunnel? Client sends a EAP-TTLS with PAP as inner protocol to freeradius server. I want to proxy the PAP request to another RADIUS server which understands only PAP. How could I configire freeradius for this.

Answer 1

Just putting the solution steps in case someone needs it.

1. Add realm in proxy conf file (/sbin/proxy.conf): realm MYAUTH { type = radius authhost = Radius_server_IP:Port] secret = RadiusSharedSecret nostrip }

2. Modify virtual server information in /etc/raddb/mods-enabled/eap.conf: ttls{ ......... ......... virtual_server = "proxy-inner-tunnel" }

3. In /etc/raddb/sites-enabled creates a softlink proxy-inner-tunnel pointing to /etc/raddb/sites-available/proxy-inner-tunnel. Modify proxy-inner-tunnel to add the proxy realm: authorize {
   update control { &Proxy-To-Realm := "MYAUTH" } }

Answer 2

Ensure in the eap module configuration

proxy_tunneled_request_as_eap = no

Configure your proxy realm in proxy.conf

Set proxy realm in inner server

update control {
    Proxy-To-Realm := <realm>
}