COA server times out

11 May 2021

      Hello,

I have setup freeradius to disconnect the NAS when certain conditions are met.
However the COA server can't be reached or doesn't react, so the requests get duplicated and sent over and over again, until it times out.

(3) Received Accounting-Request Id 220 from 127.0.0.1:36559 to 127.0.0.1:1813 length 158

(3) User-Name = "mark"

(3) NAS-IP-Address = 127.0.0.1

(3) NAS-Port = 1

(3) Service-Type = Outbound-User

(3) Framed-Protocol = PPP

(3) Framed-IP-Address = 10.8.0.2

(3) Calling-Station-Id = "89.32.xxx.xxx"

(3) NAS-Identifier = "OpenVpn"

(3) Acct-Status-Type = Interim-Update

(3) Acct-Input-Octets = 103730

(3) Acct-Output-Octets = 356871

(3) Acct-Session-Id = "A7E4B3803D0E4A87C8CC76B5C0E1910B"

(3) Acct-Session-Time = 20

(3) Acct-Input-Gigawords = 0

(3) Acct-Output-Gigawords = 0

(3) NAS-Port-Type = Virtual

(3) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default

(3) preacct {

(3) update control {

(3) EXPAND %l

(3)--> 1620718410

(3) &Current-Timestamp := 1620718410

(3) } # update control = noop

(3) update request {

rlm_sql (sql): Reserved connection (0)

rlm_sql (sql): Released connection (0)

Need 2 more connections to reach 10 spares

rlm_sql (sql): Opening additional connection (8), 1 of 24 pending slots used

rlm_sql_mysql: Starting connect to MySQL server

rlm_sql_mysql: Connected to database 'radius_db' on 3.64.143.170 via TCP/IP, server version 8.0.24, protocol version 10

(3) EXPAND %{User-Name}

(3)--> mark

(3) SQL-User-Name set to 'mark'

rlm_sql (sql): Reserved connection (5)

(3) Executing select query: SELECT COALESCE((SELECT UNIX_TIMESTAMP(expires_at) FROM master_db.device d WHERE d.id='mark'), 0)

rlm_sql (sql): Released connection (5)

(3) EXPAND %{sql:SELECT COALESCE((SELECT UNIX_TIMESTAMP(expires_at) FROM master_db.device d WHERE d.id='%{User-Name}'), 0)}

(3)--> 1589143717

(3) &Expires-Timestamp := 1589143717

rlm_sql (sql): Reserved connection (1)

rlm_sql (sql): Released connection (1)

(3) EXPAND %{User-Name}

(3)--> mark

(3) SQL-User-Name set to 'mark'

rlm_sql (sql): Reserved connection (7)

(3) Executing select query: SELECT COALESCE(MAX(is_banned), 0) as banned FROM master_db.device d WHERE d.id = 'mark'

rlm_sql (sql): Released connection (7)

(3) EXPAND %{sql:SELECT COALESCE(MAX(is_banned), 0) as banned FROM master_db.device d WHERE d.id = '%{User-Name}'}

(3)--> 0

(3) &Banned := 0

(3) } # update request = noop

(3) if (&request:Banned == 1) {

(3) if (&request:Banned == 1)-> FALSE

(3) if (&control:Current-Timestamp > &request:Expires-Timestamp) {

(3) if (&control:Current-Timestamp > &request:Expires-Timestamp)-> TRUE

(3) if (&control:Current-Timestamp > &request:Expires-Timestamp){

(3) update disconnect {

(3) EXPAND %{User-Name}

(3)--> mark

(3) &User-Name = mark

(3) } # update disconnect = noop

(3) } # if (&control:Current-Timestamp > &request:Expires-Timestamp)= noop

(3) [preprocess] = ok

(3) policy acct_unique {

(3) update request {

(3) &Tmp-String-9 := "ai:"

(3) } # update request = noop

(3) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) {

(3) EXPAND %{hex:&Class}

(3)-->

(3) EXPAND ^%{hex:&Tmp-String-9}

(3)--> ^61693a

(3) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i))-> FALSE

(3) else {

(3) update request {

(3) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}

(3)--> 47a7883f04b4faeba08349f153a68b6b

(3) &Acct-Unique-Session-Id := 47a7883f04b4faeba08349f153a68b6b

(3) } # update request = noop

(3) } # else = noop

(3) } # policy acct_unique = noop

(3) suffix: Checking for suffix after "@"

(3) suffix: No '@' in User-Name = "mark", looking up realm NULL

(3) suffix: No such realm "NULL"

(3) [suffix] = noop

(3) } # preacct = ok

(3) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default

(3) accounting {

(3) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d

(3) detail:--> /var/log/freeradius/radacct/127.0.0.1/detail-20210511

(3) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20210511

(3) detail: EXPAND %t

(3) detail:--> Tue May 11 07:33:30 2021

(3) [detail] = ok

(3) [unix] = noop

(3) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}

(3) sql:--> type.interim-update.query

(3) sql: Using query template 'query'

rlm_sql (sql): Reserved connection (6)

(3) sql: EXPAND %{User-Name}

(3) sql:--> mark

(3) sql: SQL-User-Name set to 'mark'

(3) sql: EXPAND UPDATE radacct SET acctupdatetime= (@acctupdatetime_old:=acctupdatetime), acctupdatetime= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctinterval= %{%{integer:Event-Timestamp}:-%l} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'

(3) sql:--> UPDATE radacct SET acctupdatetime= (@acctupdatetime_old:=acctupdatetime), acctupdatetime= FROM_UNIXTIME(1620718410), acctinterval= 1620718410 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '10.8.0.2', framedipv6address = '', framedipv6prefix = '', framedinterfaceid = '', delegatedipv6prefix = '', acctsessiontime = 20, acctinputoctets = '0' << 32 | '103730', acctoutputoctets = '0' << 32 | '356871' WHERE AcctUniqueId = '47a7883f04b4faeba08349f153a68b6b'

(3) sql: Executing query: UPDATE radacct SET acctupdatetime= (@acctupdatetime_old:=acctupdatetime), acctupdatetime= FROM_UNIXTIME(1620718410), acctinterval= 1620718410 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '10.8.0.2', framedipv6address = '', framedipv6prefix = '', framedinterfaceid = '', delegatedipv6prefix = '', acctsessiontime = 20, acctinputoctets = '0' << 32 | '103730', acctoutputoctets = '0' << 32 | '356871' WHERE AcctUniqueId = '47a7883f04b4faeba08349f153a68b6b'

rlm_sql_mysql: Rows matched: 1Changed: 1Warnings: 1

(3) sql: SQL query returned: success

(3) sql: 1 record(s) updated

rlm_sql (sql): Released connection (6)

(3) [sql] = ok

(3) [exec] = noop

(3) attr_filter.accounting_response: EXPAND %{User-Name}

(3) attr_filter.accounting_response:--> mark

(3) attr_filter.accounting_response: Matched entry DEFAULT at line 12

(3) [attr_filter.accounting_response] = updated

(3) } # accounting = updated

(3) Sent Disconnect-Request Id 155 from 0.0.0.0:57659 to 127.0.0.1:3799 length 28

(3) User-Name = "mark"

(3) Sent Accounting-Response Id 220 from 127.0.0.1:1813 to 127.0.0.1:36559 length 0

(3) Finished request

(3) Cleaning up request packet ID 220 with timestamp +44

Waking up in 2.3 seconds.

(3) Sending duplicate CoA request to home server 127.0.0.1 port 3799 - ID: 155

Waking up in 4.5 seconds.

(5) Sending duplicate CoA request to home server 127.0.0.1 port 3799 - ID: 211

Waking up in 0.3 seconds.

(6) Sending duplicate CoA request to home server 127.0.0.1 port 3799 - ID: 79

Waking up in 3.5 seconds.

...

(4) ERROR: Failing request - originate-coa ID 83, due to lack of any response from coa server 127.0.0.1 port 3799 within 30 seconds

This is the coa section defined in the /etc/freeradius/3.0/proxy.conf
home_server my-coa {
type = coa
ipaddr = 127.0.0.1
port = 3799
secret = coa123
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}

Do I also have to set it in /etc/freeradius/3.0/clients.conf:
client localhost {
...
coa_server = my-coa
}

Is there anything else I need to do to setup the COA server?

My NAS is OpenVPN and I'm using openvpn-auth-radius plugin from Debian:
https://packages.debian.org/buster/openvpn-auth-radius

/etc/openvpn/radiusplugin.cnf

NAS-Identifier=OpenVpn

Service-Type=5

Framed-Protocol=1

NAS-Port-Type=5

NAS-IP-Address=127.0.0.1

OpenVPNConfig=/etc/openvpn/server.conf

subnet=255.255.255.0

overwriteccfiles=true

server

{

authport=1812

name=127.0.0.1

retry=1

wait=1

sharedsecret=${CLIENT_SECRET}

}

Thanks

COA server times out

Mark Antony