How to proxy accounting requests to multiple destinations
Hi, I'm running FreeRADIUS 2.1.6 on FreeBSD 7.2 and I need to proxy incoming radius accounting requests to two different ports at the same destination ip. I'm quite inexperienced with freeradius and I'm not sure I've understood completely what I need to do. I've set up realms, home_servers and home_server_pools in proxy.conf. I've also made two instances of copy-acct-to-home-server in /sites-enabled and an extra detail file in a separate directory, which one copy-acct-to-home-server reads. With the configurations I've made accounting requests are being proxied to one port of the destination ip, and the debug output reports for the second instance: [suffix] Request already proxied. Ignoring. Am I correct in the assumption that I need to rewrite the accounting packet so it will be allowed to proxy again? How can I achieve this? Or is there another way to do things? I'm also puzzled by how I can send to two different home_servers when the packet will of course only match one realm? -- Dánial
Hi again, This subject is misleading and should rather read: How to proxy an accounting request to the same destination twice I've now also tried with robust-proxy-accounting but it only sends to one of the home_servers. Any advice or pointers in the right direction will be greatly appreciated! -- Dánial -----Original Message----- From: freeradius-users-bounces+dol=ft.fo@lists.freeradius.org [mailto:freeradius-users-bounces+dol=ft.fo@lists.freeradius.org] On Behalf Of Dánial Olsen Sent: Thursday, September 03, 2009 3:34 PM To: freeradius-users@lists.freeradius.org Subject: How to proxy accounting requests to multiple destinations Hi, I'm running FreeRADIUS 2.1.6 on FreeBSD 7.2 and I need to proxy incoming radius accounting requests to two different ports at the same destination ip. I'm quite inexperienced with freeradius and I'm not sure I've understood completely what I need to do. I've set up realms, home_servers and home_server_pools in proxy.conf. I've also made two instances of copy-acct-to-home-server in /sites-enabled and an extra detail file in a separate directory, which one copy-acct-to-home-server reads. With the configurations I've made accounting requests are being proxied to one port of the destination ip, and the debug output reports for the second instance: [suffix] Request already proxied. Ignoring. Am I correct in the assumption that I need to rewrite the accounting packet so it will be allowed to proxy again? How can I achieve this? Or is there another way to do things? I'm also puzzled by how I can send to two different home_servers when the packet will of course only match one realm? -- Dánial - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I suspect you'll need to treat it like two unique servers, and create two (2) copy-acct-to-home-server instances (or double up the entries in the one). Unless I'm mistaken, you'll also need two detail files for the relaying of the information. ----- Original Message ----- From: "Dánial Olsen" <DOL@ft.fo> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, September 03, 2009 6:12 PM Subject: RE: How to proxy accounting requests to multiple destinations Hi again, This subject is misleading and should rather read: How to proxy an accounting request to the same destination twice I've now also tried with robust-proxy-accounting but it only sends to one of the home_servers. Any advice or pointers in the right direction will be greatly appreciated! -- Dánial -----Original Message----- From: freeradius-users-bounces+dol=ft.fo@lists.freeradius.org [mailto:freeradius-users-bounces+dol=ft.fo@lists.freeradius.org] On Behalf Of Dánial Olsen Sent: Thursday, September 03, 2009 3:34 PM To: freeradius-users@lists.freeradius.org Subject: How to proxy accounting requests to multiple destinations Hi, I'm running FreeRADIUS 2.1.6 on FreeBSD 7.2 and I need to proxy incoming radius accounting requests to two different ports at the same destination ip. I'm quite inexperienced with freeradius and I'm not sure I've understood completely what I need to do. I've set up realms, home_servers and home_server_pools in proxy.conf. I've also made two instances of copy-acct-to-home-server in /sites-enabled and an extra detail file in a separate directory, which one copy-acct-to-home-server reads. With the configurations I've made accounting requests are being proxied to one port of the destination ip, and the debug output reports for the second instance: [suffix] Request already proxied. Ignoring. Am I correct in the assumption that I need to rewrite the accounting packet so it will be allowed to proxy again? How can I achieve this? Or is there another way to do things? I'm also puzzled by how I can send to two different home_servers when the packet will of course only match one realm? -- Dánial - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________ Information from ESET Smart Security, version of virus signature database 4392 (20090903) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 4392 (20090903) __________ The message was checked by ESET Smart Security. http://www.eset.com
Yes, this has also been my assumption and I've tried this but I've failed in making both instances proxy the packet. There must be something I'm not getting because I don't see how I can have two realms with one pool and home_server each in proxy.conf and match the accounting packet against both realms? Currently I'm testing with this line in acct_users: DEFAULT Proxy-To-Realm := "myrealm" -- Dánial -----Original Message----- From: freeradius-users-bounces+dol=ft.fo@lists.freeradius.org [mailto:freeradius-users-bounces+dol=ft.fo@lists.freeradius.org] On Behalf Of Craig Campbell Sent: Thursday, September 03, 2009 11:28 PM To: FreeRadius users mailing list Subject: Re: How to proxy accounting requests to multiple destinations I suspect you'll need to treat it like two unique servers, and create two (2) copy-acct-to-home-server instances (or double up the entries in the one). Unless I'm mistaken, you'll also need two detail files for the relaying of the information. ----- Original Message ----- From: "Dánial Olsen" <DOL@ft.fo> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, September 03, 2009 6:12 PM Subject: RE: How to proxy accounting requests to multiple destinations Hi again, This subject is misleading and should rather read: How to proxy an accounting request to the same destination twice I've now also tried with robust-proxy-accounting but it only sends to one of the home_servers. Any advice or pointers in the right direction will be greatly appreciated! -- Dánial -----Original Message----- From: freeradius-users-bounces+dol=ft.fo@lists.freeradius.org [mailto:freeradius-users-bounces+dol=ft.fo@lists.freeradius.org] On Behalf Of Dánial Olsen Sent: Thursday, September 03, 2009 3:34 PM To: freeradius-users@lists.freeradius.org Subject: How to proxy accounting requests to multiple destinations Hi, I'm running FreeRADIUS 2.1.6 on FreeBSD 7.2 and I need to proxy incoming radius accounting requests to two different ports at the same destination ip. I'm quite inexperienced with freeradius and I'm not sure I've understood completely what I need to do. I've set up realms, home_servers and home_server_pools in proxy.conf. I've also made two instances of copy-acct-to-home-server in /sites-enabled and an extra detail file in a separate directory, which one copy-acct-to-home-server reads. With the configurations I've made accounting requests are being proxied to one port of the destination ip, and the debug output reports for the second instance: [suffix] Request already proxied. Ignoring. Am I correct in the assumption that I need to rewrite the accounting packet so it will be allowed to proxy again? How can I achieve this? Or is there another way to do things? I'm also puzzled by how I can send to two different home_servers when the packet will of course only match one realm? -- Dánial - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________ Information from ESET Smart Security, version of virus signature database 4392 (20090903) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 4392 (20090903) __________ The message was checked by ESET Smart Security. http://www.eset.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dánial Olsen wrote:
Yes, this has also been my assumption and I've tried this but I've failed in making both instances proxy the packet.
So.... what does the debug log say?
There must be something I'm not getting because I don't see how I can have two realms with one pool and home_server each in proxy.conf and match the accounting packet against both realms?
I think you're missing something simple. The suggestion was to use two detail files. It looks like you're not doing that. 1) write incoming packets to 2 detail files 2) configure TWO versions of copy-acct-to-home-server 3) profit
Currently I'm testing with this line in acct_users: DEFAULT Proxy-To-Realm := "myrealm"
You need to do that *differently* for *each* virtual server. Delete the "files" entry from the preaccounting section of each virtual server, and replace it with: update control { Proxy-To-Realm := foo } You can then change the destination realm in each virtual server. Alan DeKok.
Yes, this has also been my assumption and I've tried this but I've failed in making both instances proxy the packet.
So.... what does the debug log say?
There must be something I'm not getting because I don't see how I can have two realms with one pool and home_server each in proxy.conf and match the accounting packet against both realms?
I think you're missing something simple. The suggestion was to use two detail files. It looks like you're not doing that.
1) write incoming packets to 2 detail files 2) configure TWO versions of copy-acct-to-home-server 3) profit
I did already do step 1 and 2 - but was missing 3
Currently I'm testing with this line in acct_users: DEFAULT Proxy-To-Realm := "myrealm"
You need to do that *differently* for *each* virtual server. Delete the "files" entry from the preaccounting section of each virtual server, and replace it with:
update control { Proxy-To-Realm := foo }
You can then change the destination realm in each virtual server.
Yes! This was exactly what I was missing...kachiiing..!!! -- Dánial
Home_server is a firewall which forwards them to two different servers which are not directly accessible. This setup has previously been achieved with freeradius 1.x using combined logs and two radrelays on two subinterfaces. -- Dánial ________________________________________ From: freeradius-users-bounces+dol=ft.fo@lists.freeradius.org [freeradius-users-bounces+dol=ft.fo@lists.freeradius.org] On Behalf Of Ivan Kalik [tnt@kalik.net] Sent: Friday, September 04, 2009 0:01 To: FreeRadius users mailing list Subject: RE: How to proxy accounting requests to multiple destinations
This subject is misleading and should rather read: How to proxy an accounting request to the same destination twice
Why? What is home server supposed to do with the duplicate packet (that it couldn't do with the first one)? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Craig Campbell -
Dánial Olsen -
Ivan Kalik