Accounting packets not received
Good day, We have several branches configured for RADIUS. We are using freeradius 2.1.12 from CentOS 6.4 repo, plus daloradius 0.9.9, and MySQL. The problem is that accounting packets are not received here in our head office when accessing other branches' switches. When we access our own switches, everything is logged into the db. Branches connection is Head office > firewall > point-to-point to retail > retail > isp > branch Firewall connection to branches is allow-all, so this is the confusing part Requests are logged in freeradius log file, but it is incomplete and what we would like to accomplish is accounting packets to be recorded With accounting packet: http://pastebin.com/M5XPYjQG Without accounting packet: http://pastebin.com/XVCTxug6
On 08/01/2013 08:51 AM, Gab Quidilla wrote:
Good day,
We have several branches configured for RADIUS. We are using freeradius 2.1.12 from CentOS 6.4 repo, plus daloradius 0.9.9, and MySQL. The problem is that accounting packets are not received here in our head office when accessing other branches' switches. When we access our own switches, everything is logged into the db.
Branches connection is Head office > firewall > point-to-point to retail
retail > isp > branch
Firewall connection to branches is allow-all, so this is the confusing part
Are you sure the NAS is sending accouting packets?
Requests are logged in freeradius log file, but it is incomplete and what we would like to accomplish is accounting packets to be recorded
If the accounting packets don't reach FreeRADIUS, then FreeRADIUS can't do anything with them. Check the NAS is actually sending accounting packets. If it is, tcpdump on the server to see if it arrives.
Hi, thanks for the reply. I'm pretty sure that every NAS is sending accounting packets, because I am using the same config on the switches here and for other branches, the only difference is the shared secret used. On the first post is Pastebin links, with the accounting packet received after authentication. When accessing the switches here at the head office, it would not pass through the firewall. Accessing the branches passess through the firewall, but the fw WAN link is configured for accepting all packets Authentication and authorization works fine, but accounting packets are not received. Is there any setting in the config files that I should check/modify? On Thu, Aug 1, 2013 at 4:04 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Are you sure the NAS is sending accouting packets?
If the accounting packets don't reach FreeRADIUS, then FreeRADIUS can't do anything with them. Check the NAS is actually sending accounting packets. If it is, tcpdump on the server to see if it arrives. - List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
On 1 Aug 2013, at 09:35, Gab Quidilla <gbquidilla21@gmail.com> wrote:
Hi, thanks for the reply.
I'm pretty sure that every NAS is sending accounting packets, because I am using the same config on the switches here and for other branches, the only difference is the shared secret used.
On the first post is Pastebin links, with the accounting packet received after authentication. When accessing the switches here at the head office, it would not pass through the firewall. Accessing the branches passess through the firewall, but the fw WAN link is configured for accepting all packets
Authentication and authorization works fine, but accounting packets are not received. Is there any setting in the config files that I should check/modify?
Run radsniff. Make sure you see packets. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Hi, I ran radsniff. I had someone at our branch login to the switches, and still no accounting packets, while when I log into our switches, the accounting packet is received. This is somewhat network-related yes? If it helps, here's the pic of the radsniff's output: http://i41.tinypic.com/2zp5g78.jpg On Thu, Aug 1, 2013 at 4:44 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
Run radsniff. Make sure you see packets.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 01/08/13 10:02, Gab Quidilla wrote:
Hi,
I ran radsniff. I had someone at our branch login to the switches, and still no accounting packets, while when I log into our switches, the accounting packet is received. This is somewhat network-related yes?
Entirely. If the accounting packets don't arrive, then they're either not getting sent, or getting dropped.
On 1 Aug 2013, at 11:21, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 01/08/13 10:02, Gab Quidilla wrote:
Hi,
I ran radsniff. I had someone at our branch login to the switches, and still no accounting packets, while when I log into our switches, the accounting packet is received. This is somewhat network-related yes?
Entirely. If the accounting packets don't arrive, then they're either not getting sent, or getting dropped.
^ (by the network) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 08/01/2013 09:35 AM, Gab Quidilla wrote:
office, it would not pass through the firewall. Accessing the branches passess through the firewall, but the fw WAN link is configured for accepting all packets
Yeah... sorry, but we hear that a lot on this mailing list, and quite often the firewall was not, in fact, configured to "permit all"
Authentication and authorization works fine, but accounting packets are not received. Is there any setting in the config files that I should check/modify?
Like I said, use tcpdump to *confirm* the accounting packets are actually arriving at the server before focussing on the server. As for settings to check - you said the shared secrets are different, so check and double-check those, and that the correct "client" statements are matching.
participants (3)
-
Arran Cudbard-Bell -
Gab Quidilla -
Phil Mayers