CoA-Ack and radclient/radiusd
Hello, I have a strange problem with CoA-Ack receive I send test Coa packet to nas (juniper erx), the nas sees the packet and do corresponding action as well, and sends Coa-Ack back Nothing strange in nas debug or tcpdump But radclient says: some# /usr/local/bin/radclient -t20 -r 1 -c 1 -f ./user-81-200-27-42.rad -x 10.200.27.3:1700 coa su29 Sending CoA-Request of id 44 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" Framed-IP-Address = 10.200.27.42 ERX-Service-Activate:2 = "setmv(10.200.27.42,000e.0cb9.3140,vrf_nat1)" ERX-Service-Timeout:2 = 20 rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=44, length=20 radclient: received response to request we did not send. (id=44 socket 3) radclient: no response from server for ID 44 socket 3 some# I can`t clearly understand why.. And using radiusd CoA functionality i get similar behavior, but in that case i`m not sure if my config is ok to handle CoA-Ack Have update action in acconting section accounting { if ("%{Acct-Session-Id}" =~ /:/) { if ("%{Acct-Status-Type}" == "Start") { update coa { User-Name := "%{User-Name}" ERX-Virtual-Router-Name := "default:vrf_nat1" ERX-Service-Activate:2 += "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 += 20 } } } ok } and get rad_recv: Accounting-Request packet from host 10.200.27.3 port 50125, id=187, length=283 Acct-Status-Type = Start User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" Event-Timestamp = "Aug 21 2009 13:25:51 MSD" Acct-Delay-Time = 0 NAS-Identifier = "bsr01-su29" Acct-Session-Id = "0024163640:0016777349" ERX-Service-Session = "inetpublic(10.200.27.42,000e.0cb9.3141,vrf_nat1,gi5/0/0.951,0,0,20485760,20485760)" NAS-IP-Address = 10.200.27.3 Framed-IP-Address = 10.200.27.42 Calling-Station-Id = "#bsr01-su29#E50#951" NAS-Port-Type = Ethernet NAS-Port = 671089591 NAS-Port-Id = "GigabitEthernet 5/0/0.951:951" Acct-Authentic = RADIUS +- entering group preacct {...} ++[preprocess] returns ok ++[files] returns noop +- entering group accounting {...} ++? if ("%{Acct-Session-Id}" =~ /:/) expand: %{Acct-Session-Id} -> 0024163640:0016777349 ? Evaluating ("%{Acct-Session-Id}" =~ /:/) -> TRUE ++? if ("%{Acct-Session-Id}" =~ /:/) -> TRUE ++- entering if ("%{Acct-Session-Id}" =~ /:/) {...} +++? if ("%{Acct-Status-Type}" == "Start") expand: %{Acct-Status-Type} -> Start ? Evaluating ("%{Acct-Status-Type}" == "Start") -> TRUE +++? if ("%{Acct-Status-Type}" == "Start") -> TRUE +++- entering if ("%{Acct-Status-Type}" == "Start") {...} expand: %{User-Name} -> 10.200.27.42.vrf_nat1.vlan.5.0.0.951 ++++[coa] returns noop +++- if ("%{Acct-Status-Type}" == "Start") returns noop ++- if ("%{Acct-Session-Id}" =~ /:/) returns noop ++[ok] returns ok Sending Accounting-Response of id 187 to 10.200.27.3 port 50125 WARNING: Empty section. Using default return values. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Finished request 2. Cleaning up request 2 ID 187 with timestamp +4 Going to the next request Waking up in 2.1 seconds. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Waking up in 1.5 seconds. Cleaning up request 0 ID 52 with timestamp +3 Waking up in 2.7 seconds. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Waking up in 8.7 seconds. rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=128, length=20 Ignoring proxy reply that arrived after we sent a reply to the NAS Waking up in 8.3 seconds. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Waking up in 14.6 seconds. rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=128, length=20 Ignoring proxy reply that arrived after we sent a reply to the NAS Waking up in 14.6 seconds. No response to CoA request sent to 10.200.27.3 Found Post-Proxy-Type +- entering group Fail-CoA {...} ++[ok] returns ok Finished request 2. Cleaning up request 2 ID 187 with timestamp +4 Going to the next request ... Thanks.
Hi, Does anyone know how to configure the following things. RAS ---> Free radius ----> Proxy Radius 1) I want to echo the free radius accounting request with modified two radius attributes to another proxy radius server. 2) but another radius server will not send any aknowledgement back to freeradius server. IS it possibe? Thanks in advance Ganehs
RAS ---> Free radius ----> Proxy Radius
1) I want to echo the free radius accounting request with modified two radius attributes to another proxy radius server.
See copy-acct-to-home-server virtual server.
2) but another radius server will not send any aknowledgement back to freeradius server.
And freeradius will mark it as dead and stop sending packets to it. Why would you want to break the home server so it would stop responding? Ivan Kalik Kalik Informatika ISP
Hi, Thanks for your mail. I want to send the radius accounting packets to home server but the home server is not radius server. It will take that accounting packet and procees for billing and I also need the following thing in echo request username= user1@doamain.com calling-station-id= user1 username= user2@doamain.com calling-station-id= user2 Is it possible? Cheers Ganesh --- On Fri, 8/21/09, Ivan Kalik <tnt@kalik.net> wrote:
From: Ivan Kalik <tnt@kalik.net> Subject: Re: Echo the radius accounting request To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Date: Friday, August 21, 2009, 9:32 PM
RAS ---> Free radius ----> Proxy Radius
1) I want to echo the free radius accounting request with modified two radius attributes to another proxy radius server.
See copy-acct-to-home-server virtual server.
2) but another radius server will not send any aknowledgement back to freeradius server.
And freeradius will mark it as dead and stop sending packets to it. Why would you want to break the home server so it would stop responding?
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Aug 24, 2009 at 5:35 PM, ganesh nagpure<gnagpure_mtnl@yahoo.com> wrote:
Hi,
Thanks for your mail.
I want to send the radius accounting packets to home server but the home server is not radius server. It will take that accounting packet and procees for billing
In that case why bother proxying radius packets? Why not simply write the acct packets to a database and have your billing application read the database?
and I also need the following thing in echo request
username= user1@doamain.com calling-station-id= user1
username= user2@doamain.com calling-station-id= user2
should be easy from freeradius' default radacct table. -- Fajar
Alan DeKok ?????:
Anton G. wrote:
I have a strange problem with CoA-Ack receive
Which version of the software are you using? git/stable from Aug 13 10:07 GMT
It works for me with the latest git "stable" tree...
get today git/stable and tried - same result.. ( Alan, can you please provide me some tips to do further debug of this? Not mentioning radiusd CoA, i`m pretty puzzled why radclient doesn`t want to handle CoA-ACK from nas.. some# /usr/local/bin/radclient -t20 -r 1 -c 1 -f ./coa.rad -x 10.200.27.3:1700 coa su29 Sending CoA-Request of id 223 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" Framed-IP-Address = 10.200.27.42 ERX-Service-Activate:2 = "setmv(10.200.27.42,00:0e:0c:b9:31:41,vrf_nat1)" ERX-Service-Timeout:2 = 20 rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=223, length=20 radclient: received response to request we did not send. (id=223 socket 3) radclient: no response from server for ID 223 socket 3 some# tcpdump and radsniff didn`t show anything strange some# radsniff -x -I /home/ak/coa.dump -f udp PCAP filter: [udp] RADIUS secret: [testing123] CoA-Request Id 223 10.200.3.4:56318 -> 10.200.27.3:1700 (1 packets) +0.000 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" Framed-IP-Address = 10.200.27.42 ERX-Service-Activate:2 = "setmv(10.200.27.42,00:0e:0c:b9:31:41,vrf_nat1)" ERX-Service-Timeout:2 = 20 CoA-ACK Id 223 10.200.27.3:1700 -> 10.200.3.4:56318 (2 packets) +7.069 Done sniffing some#
Anton G. wrote:
get today git/stable and tried - same result.. (
Are you sure you're using *that* version, and that you don't have multiple versions of the software installed?
Alan, can you please provide me some tips to do further debug of this?
It involves looking through the hashes in src/lib/packet.c. It's not pretty...
Not mentioning radiusd CoA, i`m pretty puzzled why radclient doesn`t want to handle CoA-ACK from nas..
I don't know... others have got this to work. What's the OS / CPU? Alan DeKok.
Alan DeKok ?????:
Anton G. wrote:
get today git/stable and tried - same result.. (
Are you sure you're using *that* version, and that you don't have multiple versions of the software installed?
Yes, checked it twice..
Alan, can you please provide me some tips to do further debug of this?
It involves looking through the hashes in src/lib/packet.c. It's not pretty...
well, i have no choice, i should dig it out
Not mentioning radiusd CoA, i`m pretty puzzled why radclient doesn`t want to handle CoA-ACK from nas..
I don't know... others have got this to work.
i understand, radclient have coa support for a long time..
What's the OS / CPU? FreeBSD 7.1-RELEASE-p3 jail
Could it be OS specific? or NAS specific ?
participants (5)
-
Alan DeKok -
Anton G. -
Fajar A. Nugraha -
ganesh nagpure -
Ivan Kalik