FreeRadius doesn't log request in Debug mode

Sorry, Radius newbie here …

I try to get a FreeRadius server version 3.0.20 as packaged by NixOS running to authenticate users on a dlink access point. I’m running the server with debug logging enabled.

I started with the default configuration and followed the Getting Started guide. So I added the user testing using testing Cleartext-Password := "password". I could confirm that this authentication works using radtest testing password 127.0.0.1 0 testing123. I also see it as a successful login in the logfile. – Cool, works so far.

Next I tried to authenticate over an access point using the same user and password. So I added the IP of the access point to clients.conf and configured the radius server and shared secret in the access point.

client ap2 {
    ipaddr = 192.168.1.32
    secret = testing123
}

When trying to authenticate I see the Request coming in on tcpdump, but FreeRadius is ignoring it completely: nothing gets logged.

To cross check and verify that the radius server is not only listening on localhost, I added another non-localhost-client and used radtest again with that source IP: everything still worked.

Checking with tcpdump again this is the working request:

192.168.1.144.57243 > 192.168.1.144.1812: [bad udp cksum 0x84d7 -> 0x44fd!] RADIUS, length: 77
    Access-Request (1), id: 0x2c, Authenticator: 106b49030bec802e1bd156ff48e3589a
      User-Name Attribute (1), length: 9, Value: testing
        0x0000: 7465 7374 696e 67
      User-Password Attribute (2), length: 18, Value:
        0x0000: d112 7b01 9c70 9548 d4a1 db33 c648 739e
      NAS-IP-Address Attribute (4), length: 6, Value: 127.0.1.1
        0x0000: 7f00 0101
      NAS-Port Attribute (5), length: 6, Value: 0
        0x0000: 0000 0000
      Message-Authenticator Attribute (80), length: 18, Value: &7u...s..L....|..
        0x0000: 2637 75c2 ead6 73cc d64c ee9f a97c d8d7

And this is the response from FreeRadius:

192.168.1.144.1812 > 192.168.1.144.57243: [bad udp cksum 0x849e -> 0x427b!] RADIUS, length: 20
    Access-Accept (2), id: 0x2c, Authenticator: 750e916c6b56f85eed550088c6cf30fc

In contrast this is request from DLink:

192.168.1.32.36759 > 192.168.1.144.1812: [udp sum ok] RADIUS, length: 103
    Access-Request (1), id: 0x6a, Authenticator: e7e4df28fcd96772ffb508c4df564d
      User-Name Attribute (1), length: 9, Value: testing
        0x0000: 7465 7374 696e 67
      User-Password Attribute (2), length: 18, Value:
        0x0000: a7cb 807f a0dc fdca 8bd4 e19f cbf4 3e79
      Calling-Station-Id Attribute (31), length: 19, Value: 98:f6:21:c0:cc:9d
        0x0000: 3938 3a66 363a 3231 3a63 303a 6363 3a39
        0x0010: 64
      NAS-Identifier Attribute (32), length: 19, Value: c4:e9:0a:21:61:b0
        0x0000: 6334 3a65 393a 3061 3a32 313a 3631 3a62
        0x0010: 30
      NAS-IP-Address Attribute (4), length: 6, Value: 192.168.1.32
        0x0000: c0a8 0120
      NAS-Port-Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11
        0x0000: 0000 0013
      NAS-Port Attribute (5), length: 6, Value: 255
        0x0000: 0000 00ff

FreeRadius isn’t logging this request at all, and also sends no response to it.

The first thing I probably wonder most: Why isn’t FreeRadius logging the request from the DLink access point while it logs the other request?

Any idea what I am missing why there is no response UDP packet from FreeRadius to the access point?

One “bonus” question: in the UI of the access point the authentication mechanism is called “SPAP” but the “User-Password Attribute” looks like a normal “PAP” authentication. What is the difference between PAP and SPAP? What does SPAP stand for? I couldn’t find any protocol documentation for it.