RV: Freeradius does not save avpair sent by ASR1002 - Delegated-IPv6-Prefix
Hi! I have the following scenario. An ASR1002 with software version 03.13.10.S. The ASR has configured the IPv6 prefixes to assign to the clients, and once it assigns them it sends the avpairs to a Freeradius. The problem is that in the packet capture you can see that the ASR sends it to the avpair in the "accounting-request" packet to the freeradius, but the freeradius does not store it. What I mean by freeradius not storing, is that after a query is made from a platform to freeradius to see what ipv6 is assigned to each client and does not show it. This on another router, an ASR9000 works fine, the issue may be is in the ASR1002. this is a packet capture on freeradius. The problem is that I don't know if it is something to set in the ASR1002 to store it in freeradius or if it is freeradius itself. RADIUS Protocol Code: Accounting-Request (4) Packet identifier: 0xa7 (167) Length: 560 Authenticator: 991cd55b999e09f0aae58fadfba325e1 Attribute Value Pairs AVP: t=Acct-Session-Id(44) l=20 val=0/1/0/640_007BB7FE AVP: t=Vendor-Specific(26) l=24 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=26 vnd=ciscoSystems(9) AVP: t=Framed-Protocol(7) l=6 val=PPP(1) AVP: t=Framed-IPv6-Prefix(97) l=20 val=2001:X:X::/64 AVP: t=Framed-Interface-Id(96) l=10 val=218d36286581b516 AVP: t=Framed-IP-Address(8) l=6 val=X.X.X.153 AVP: t=Delegated-IPv6-Prefix(123) l=20 val=2001:X:X:X::/64 AVP: t=User-Name(1) l=10 val=dsl99902 AVP: t=Vendor-Specific(26) l=35 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=31 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=31 vnd=ciscoSystems(9) AVP: t=Acct-Session-Time(46) l=6 val=321 AVP: t=Acct-Input-Octets(42) l=6 val=2736962 AVP: t=Acct-Output-Octets(43) l=6 val=2746557 AVP: t=Vendor-Specific(26) l=38 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=39 vnd=ciscoSystems(9) AVP: t=Acct-Input-Packets(47) l=6 val=6797 AVP: t=Acct-Output-Packets(48) l=6 val=6902 AVP: t=Vendor-Specific(26) l=36 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=37 vnd=ciscoSystems(9) AVP: t=Acct-Authentic(45) l=6 val=RADIUS(1) AVP: t=Acct-Status-Type(40) l=6 val=Interim-Update(3) AVP: t=Calling-Station-Id(31) l=14 val=c0c9e3af6747 AVP: t=NAS-Port-Type(61) l=6 val=Ethernet(15) AVP: t=NAS-Port(5) l=6 val=134218368 AVP: t=NAS-Port-Id(87) l=11 val=0/1/0/640 AVP: t=Vendor-Specific(26) l=41 vnd=ciscoSystems(9) AVP: t=Class(25) l=3 val=30 AVP: t=Service-Type(6) l=6 val=Framed(2) AVP: t=NAS-IP-Address(4) l=6 val=X.X.X.207 AVP: t=PMIP6-Home-HN-Prefix(151) l=10 val=[invalid reserved byte for IPv6 prefix] AVP: t=Acct-Delay-Time(41) l=6 val=0 **Config in ASR1002:** aaa authentication login default group tacacs+ local enable line aaa authentication ppp ADSL group radius local aaa authentication ppp viaTACACS group tacacs+ local aaa authentication ppp NINGUNO none aaa authorization console aaa authorization exec default group tacacs+ local if-authenticated aaa authorization network ADSL group radius local if-authenticated aaa authorization network viaTACACS group tacacs+ local if-authenticated aaa authorization network NINGUNO none aaa authorization configuration IA_PD group radius aaa accounting send counters ipv6 aaa accounting delay-start all aaa accounting update periodic 3 aaa accounting include auth-profile delegated-ipv6-prefix aaa accounting commands 15 default action-type start-stop group tacacs+ ! aaa accounting network ADSL action-type start-stop periodic interval 5 group radius ! ipv6 dhcp pool DHCPv6Local prefix-delegation pool ClientesDinamicos lifetime 7200 300 address prefix 2001:X:X::/64 lifetime 7200 300 dns-server 2001:X:X::65 dns-server 2001:X:X::66 sntp address 2001:X:X:X::1 accounting ADSL ! interface Virtual-Template46 description Servicio PPPoE con IPv6 ip unnumbered Loopback0 ipv6 enable no ipv6 nd prefix framed-ipv6-prefix ipv6 nd other-config-flag ipv6 nd router-preference High no ipv6 nd ra suppress ipv6 nd ra lifetime 7200 ipv6 nd ra interval 5 ipv6 dhcp server DHCPv6Local peer default ip address pool LNS1-POOL peer default ipv6 pool LinksPE-CE ppp authentication pap ADSL ppp authorization ADSL ppp accounting ADSL ppp ipcp dns X.X.X.65 X.X.X.65 ppp ipv6cp address unique ! **pool LNS1-POOL and pool LinksPE-CE are defined in the config.** **this is an example of the queries to the freeradius database, in the avpair of delegatedipv6prefix nothing is returned:** <DATA> <ROW> <radacctid>913607839</radacctid> <acctsessionid>0/1/0/640_004EB3C1</acctsessionid> <acctuniqueid>7a73d0dd85554bbb30a9ce57b3804b46</acctuniqueid> <username>dsl99902</username> <realm></realm> <nasipaddress>X.X.X.207</nasipaddress> <nasportid>0/1/0/640</nasportid> <nasporttype>Ethernet</nasporttype> <acctstarttime>2021-05-18 10:33:15</acctstarttime> <acctupdatetime>2021-05-19 13:14:56</acctupdatetime> <acctstoptime>NULL</acctstoptime> <acctinterval>62</acctinterval> <acctsessiontime>96101</acctsessiontime> <acctauthentic>RADIUS</acctauthentic> <connectinfo_start></connectinfo_start> <connectinfo_stop></connectinfo_stop> <acctinputoctets>2341181058</acctinputoctets> <acctoutputoctets>2496301024</acctoutputoctets> <calledstationid></calledstationid> <callingstationid>c47154448e08</callingstationid> <acctterminatecause></acctterminatecause> <servicetype>Framed-User</servicetype> <framedprotocol>PPP</framedprotocol> <framedipaddress>X.X.X.172</framedipaddress> <framedipv6address></framedipv6address> <framedipv6prefix>2001:X:X::/64</framedipv6prefix> <framedinterfaceid>0:3b61:0:3b58</framedinterfaceid> <delegatedipv6prefix></delegatedipv6prefix> </ROW> </DATA> if someone can give me some help or guide me where I can focus my analysis, I would appreciate it. Best Regards!
On Jul 27, 2021, at 11:13 AM, Gustavo Saracho <gustavosaracho@live.com.ar> wrote:
An ASR1002 with software version 03.13.10.S. The ASR has configured the IPv6 prefixes to assign to the clients, and once it assigns them it sends the avpairs to a Freeradius.
As.... what attribute?
The problem is that in the packet capture
We don't need to see packet captures. PLEASE follow the documentation: http://wiki.freeradius.org/list-help
you can see that the ASR sends it to the avpair in the "accounting-request" packet to the freeradius, but the freeradius does not store it.
Yes, the server doesn't store ALL attributes in SQL. It only stores some common ones. To see what it's doing, read the debug output. As the documentation says,
What I mean by freeradius not storing, is that after a query is made from a platform to freeradius to see what ipv6 is assigned to each client and does not show it.
I have no idea what FreeRADIUS is going, because you're not posting the debug output.
this is a packet capture on freeradius.
That's not helpful.
**Config in ASR1002:**
That's not helpful.
**this is an example of the queries to the freeradius database, in the avpair of delegatedipv6prefix nothing is returned:**
That's also not helpful.
if someone can give me some help or guide me where I can focus my analysis, I would appreciate it.
Where else do we need to add documentation which says "PLEASE POST THE DEBUG OUTPUT" ? Alan DeKok.
participants (2)
-
Alan DeKok -
Gustavo Saracho