- Freeradius-Users - lists.freeradius.org

freeradius does not send tunnel-type.
by Gildo Castro 25 Jan '10

25 Jan '10

Hi, I have a problem with my freeradius server, after the authentication, it does not send the tunnel-type or Tunnel-Medium-Type information. Can anyone help me? PEAP: Got tunneled reply RADIUS code 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "teste3" PEAP: Processing from tunneled session code 0x967b688 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "teste3" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS Saving tunneled attributes for later modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group EAP (returns handled) for request 8 Sending Access-Challenge of id 47 to 10.1.10.1 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010a00261900170301001b44323057d9f66e452eb3025c6b0adde60971049e6c8c20901a25f0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a5c33fd9b76ead074d1c636d08bb94f Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.10.1:1645, id=48, length=147 User-Name = "teste3" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.1.10.1 NAS-Port = 7 Calling-Station-Id = "00-22-15-62-54-BA" State = 0x9a5c33fd9b76ead074d1c636d08bb94f EAP-Message = 0x020a00261900170301001bd3cca956e18d7127395a3c5cad6f3b564c44038b5dc9740734ca57 Message-Authenticator = 0x8a2cb874d839aa15123357e704f34b95 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "teste3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 171 users: Matched entry teste3 at line 224 modcall[authorize]: module "files" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group EAP for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success Using saved attributes from the original Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group EAP (returns ok) for request 9 Sending Access-Accept of id 48 to 10.1.10.1 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User User-Name = "teste3" MS-MPPE-Recv-Key = 0xf058f1dbb8a5f02902f4d6536af78b333ab73568070fbaac3e281171e9cb31be MS-MPPE-Send-Key = 0xcffa34fb8461d53aff874f3749bee52662c85f05d88c04c8d47453530de47630 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 -- --------------------------------------------------------------------------------------------------- Gildo Castro da Silva JR. ---------------------------------------------------------------------------------------------------

2 1

EAP-TLS User-Name not matching
by Huckle Berry 25 Jan '10

25 Jan '10

First off, forgive me if this has been asked before on this list (I did do a search first, yet no results proved useful). I am on a fact finding mission to see whether freeradius is going to be feasible to deploy in my environment (~50 users over ~40 windows and linux desktops). On a test network I have configured an Ubuntu 9.10 Server with a patched freeradius that has openssl (oh what fun that was to build). I have so far altered the original configuration by only a few lines, as everywhere I go I see Alan screaming "Don't change the config!". I changed eap.conf by the following default_eap_type = tls ... fragment_size = 1024 include_length = yes I also changed users to include a few lines, most of which are incorrect, one of which may be correct (but I'm not sure). I added them one at a time in case one did the trick, but no such luck. example.com/user user(a)example.com host/user winlaptop/user WinLaptop/user I also edited client.conf to include my NAS (pretty standard change so I'm not going to detail it) The issue is when a windows client (A user by the name of user on a laptop named WinLaptop) attempts to connect, it cannot Authenticate. The error seems to be that the user name doesn't match between something and the TLS attrtibute. I would love more info on what this implies and how TLS and Radius work with each other. I get the following radiusd -X output: (sorry for the length) FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 15 2010 at 23:02:23 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.1.1 { ipaddr = 192.168.1.1 require_message_authenticator = no secret = "secret123" shortname = "AP" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 3079, id=0, length=145 User-Name = "user(a)example.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x6e28f191648ccbe2be4c4354a7975433 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "example.com" for User-Name = "user(a)example.com" [suffix] Found realm "example.com" [suffix] Adding Stripped-User-Name = "user" [suffix] Adding Realm = "example.com" [suffix] Proxying request from user user to realm example.com [suffix] Preparing to proxy authentication request to realm "example.com" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm example.com. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 139 to 127.0.0.1 port 1812 User-Name = "user" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Proxying request 0 to home server 127.0.0.1 port 1812 Sending Access-Request of id 139 to 127.0.0.1 port 1812 User-Name = "user" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=139, length=136 User-Name = "user" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0xa892984cce17699fd5732b0db2faf7a8 Proxy-State = 0x30 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 139 to 127.0.0.1 port 1814 Proxy-State = 0x30 Waking up in 4.9 seconds. rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=139, length=23 Proxy-State = 0x30 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user(a)example.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 0 to 192.168.1.1 port 3079 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 139 with timestamp +8 Cleaning up request 0 ID 0 with timestamp +8 Ready to process requests. Thanks in advance for any help! ~Huckle Berry

5 26

Re: config files separation for each sites enabled
by Fred 25 Jan '10

25 Jan '10

Thanks, Alan, I will check. Bye.

1 0

config files separation for each sites enabled
by Fred 25 Jan '10

25 Jan '10

Hello freeradius-users, I have 6 virtual servers on version 2.1.8, each listening on differents ip addresses lo:[1-6]. I saw it was easy to separate clients files, using clients site-name {} , and including a sitename.client.conf. But as huntgroups and users files seems to be loaded globally before sites instanciation, I found no way to dedicate huntgroup and users file to each server instance, as done previously for clients... Is there any way to achieve this without having to launch many radiusd in differents location ? Best regards, Fred MAISON

2 1

ldap auth
by José Campos 25 Jan '10

25 Jan '10

Hello, Can someone give me some guidelines to config freeradius (freeradius-2.1.7-1.fc11.i586) to do ldap auth. Witch files must I config. José Campos

1 0

IP delivery for MAC records
by Sylvain De Muynck 25 Jan '10

25 Jan '10

Dear freeradius users, I am currently facing an issue on my network architecture. Before, I was using freeradius with a DHCP server running in order to attribute IPs addresses to my customers (I work for an ISP) This configuration is perfectly working however for security, maintenance and monitoring, I took the choice of delivering IP addresses through my radius server. In fact, our Base Station got 2 modes of working, one is Ethernet and the other is IP mode data, so I juste configured as IP mode data to get it working. WHAT IS THE PROBLEM : when I connect my computer it is perfectly working and I can get my IP and all network parameters to get an access to the Internet however, when I want to change of computer, it does not work anymore. We were thinking about record of the MAC address as a security level and would like to get to know more about it. The attributes we are using are : Framed-Netmask --> Netmask Filter-Id --> DNS in this attribute (that's vendor attribute Alvarion) Framed-route --> Routing to the gateway Framed-Ip-address --> the IP addresse If you don't know, could you please advice me on how to troubleshoot this issue. Thanks in advance for your help, Best regards Sylvain

2 1

Free radius installation
by José Campos 25 Jan '10

25 Jan '10

Im new on freeradius. Ive just installed it on fedora11 with yum install freeradius* and then done: radiusd X Here are the final lines of the debugging mode: } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. After install done the test in another shell on the same machine: radtest test test localhost 0 testing123, as suggested in <http://freeradius.org/radiusd/INSTALL> http://freeradius.org/radiusd/INSTALL and nothing appended. What is wrong with it? Can someone help me.

4 17

Dan Schaffer is not in the office
by Dan Schaffer 25 Jan '10

25 Jan '10

I will be out of the office starting 01/25/2010 and will not return until 01/28/2010. I will have limited email and voicemail access during the week at the Phoenix Contact Kickoff meetings. If this is an urgent issue, please contact our Tech Support group at 800-586-5525. Thanks, Dan

1 0

ldap group filter by different incoming IPs
by Stephon Chen 25 Jan '10

25 Jan '10

Hello all, We want to do a sceranio like below: (Pre-requisties: a radius server RD, a ldap backend LD, and 2 unix clients CA and CB with different IPs) CA sends user auth requests to RD, RD would only send if the user is in ldap group A CB sends user auth requests to RD, RD would only send if the user is in ldap group B Is it possible for only one radius server to do this according to different incoming IPs? Thanks a lot stephon

2 1

How to charge based on accounting correctly
by George Chelidze 25 Jan '10

25 Jan '10

Hello, We have a system which sends radius accounting messages to our radius. Based on this accounting we charge subscribers. Interim accounting is enabled so for a normal session we get one Start, zero or more Interim-Update and one Stop packets. Every accounting packet except Start contains Acct-Session-Time which is "how many seconds the user has received service for" according to rfc2866. That means that it's always incrementing during a session. To charge a session in chunks we calculate a difference between the recent value and the previous one. In our case we get Interim-Update records every 15 minutes, so this difference between 2 sequential Interim-Update records is 900 secs +/- 2-3 secs. What happens when for some reason one Interim-Update records is lost? In such case we get diff - 1800 secs and everything is fine. However recently we discovered that a system which is sending accounting records will resend unconfirmed packets after some time (I do not mean Retransmit-Interval/Retransmit-Count feature which exists on most if not all NAS-es). The later means that in some cases we can get an Interim-Update packet with Acct-Session-Timeout = 1800 calculate a difference against a Start record (that is 1800 secs) and charge it, later get Interim-Update with Acct-Session-Timeout = 900. So my questions can be stated like this: 1. Is it better to charge the whole difference between current and previous Session-Timeout values and later ignore any previous packets which arrive out of order, or it's better to charge last 15 minutes (I get Interim-Update records every 15 minutes as already stated above) and do not care about missing parts (if any) of a session? 2. Is it a correct behavior of a NAS to store accounting information on it's internal disk if it can't get acknowledgment for accounting request/s and resend it later? Best Regards, George Chelidze

2 3