prepaid volume quota with cisco nas
Hello, i am working with Cisco NAS, it supports enforcing volume based quota. On first authorizations, i am expected to send QV value. When user runs out of quota, NAS wants to reauthorize. No problem on NAS side [1]. I am on freeradius-3.0.4 from Centos 7 repositories. Accounting is on PostgresSQL backend, acctinputoctets and acctoutputoctets are updated every 5 minutes. I can use following query for sqlcounter check on last session end expire it hourly: query = "\ SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct \ WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime \ > '%b'" I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes). Counters are cumulative for session so i have identified so far these options: 1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works. 2. i can use a trigger for update on radacct table which will insert delta of old and new value with timestamp to kind of "stats" table and use this one for sqlcounter query, counting data for last 12 5-minute intervals or so. 3. modify radacct table/update query to do the same as point 2. If you have some other ideas, please let me know.
From the future upgrade compatibility point of view, the 2 looks best.
[1] http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/isg/configuration/xe-3s/asr... Thanks for feedback r.
On Dec 28, 2015, at 5:52 AM, riki <phobie@axfr.org> wrote:
I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes).Counters are cumulative for session so i have identified so far these options:
1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works.
Sending a disconnect packet is probably the best choice. Alan DeKok.
Hello, well this one is working for me. But correct me if i am wrong, but it will not solve the state where user downloads first hour only 1MB, second hour 2MB and it is still within 5MB quota in 1 over 2 hours. So still need to use a described trigger system in case 2 to populate stats table. Or is there some other preferred way to do this correctly? Thanks for your time. r. On 12/28/2015 02:53 PM, Alan DeKok wrote:
On Dec 28, 2015, at 5:52 AM, riki <phobie@axfr.org> wrote:
I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes).Counters are cumulative for session so i have identified so far these options:
1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works.
Sending a disconnect packet is probably the best choice.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, Check this out if it helps. You want to renew data quota every hour to 5 MB, and whenever the data limit is reached you want to deny the access for that hour. Right? So two cases are made out of this: To deauth user whenever limit is reached**** - Check accounting packets on every packet run a query on radacct to check if limit is reached for this hour, if it has, send a disconnect. This will enter a "admin-reset" in accounting stop packet in radacct table. To stop user from authenticating when limit is reached**** - Run a query on sql radacct to check whether the user has been "admin-reset"(this would be sent from case 1 where limit is reached) for this hour, if it has, reject the request. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 30 Dec 2015, 23:37 +0530, riki<phobie@axfr.org>, wrote:
Hello,
well this one is working for me. But correct me if i am wrong, but it will not solve the state where user downloads first hour only 1MB, second hour 2MB and it is still within 5MB quota in 1 over 2 hours.
So still need to use a described trigger system in case 2 to populate stats table.
Or is there some other preferred way to do this correctly?
Thanks for your time.
r.
On 12/28/2015 02:53 PM, Alan DeKok wrote:
On Dec 28, 2015, at 5:52 AM, riki<phobie@axfr.org>wrote:
I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes).Counters are cumulative for session so i have identified so far these options:
1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works.
Sending a disconnect packet is probably the best choice.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello,
Check this out if it helps. You want to renew data quota every hour to 5 MB, and whenever the data limit is reached you want to deny the access for that hour. Right?
So two cases are made out of this:
To deauth user whenever limit is reached**** - Check accounting packets on every packet run a query on radacct to check if limit is reached for this hour, if it has, send a disconnect. This will enter a "admin-reset" in accounting stop packet in radacct table.
The way queries.conf is written for accounting-update packets will not allow you to query for last hour, as there is only timestamp for beginning and end of session. So if user will consume 1MB in first hour, 2MB in second hour, and 3MB third hour (still one session as there is limit reached only in 3rd hour) your suggested way will not allow him to use 5MB in 3rd hour, only 2MB. I am not asking how to do this, but how to do this correctly, e.g. what is common best practice. Thanks, r.
Hi, Oh yes, sorry you can run a cronjob for every hour and fetch data for active* users and subtract it from total usage to decide the limit in an extra table :) hope this would solve the problem. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 31 Dec 2015, 14:00 +0530, riki<phobie@axfr.org>, wrote:
Hello,
Check this out if it helps. You want to renew data quota every hour to 5 MB, and whenever the data limit is reached you want to deny the access for that hour. Right?
So two cases are made out of this:
To deauth user whenever limit is reached**** - Check accounting packets on every packet run a query on radacct to check if limit is reached for this hour, if it has, send a disconnect. This will enter a "admin-reset" in accounting stop packet in radacct table.
The way queries.conf is written for accounting-update packets will not allow you to query for last hour, as there is only timestamp for beginning and end of session. So if user will consume 1MB in first hour, 2MB in second hour, and 3MB third hour (still one session as there is limit reached only in 3rd hour) your suggested way will not allow him to use 5MB in 3rd hour, only 2MB.
I am not asking how to do this, but how to do this correctly, e.g. what is common best practice.
Thanks,
r. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, You can check the last accounting session if current hour == acctstoptime hour. And reason == admin reset then do access reject .. And you can check in accounting also i guess that is easy just check it in current hour. Hope this helps BR, Anirudh Malhotra NKN Sent from a handheld device, Sorry for typos.
On 28-Dec-2015, at 16:22, riki <phobie@axfr.org> wrote:
Hello,
i am working with Cisco NAS, it supports enforcing volume based quota. On first authorizations, i am expected to send QV value. When user runs out of quota, NAS wants to reauthorize. No problem on NAS side [1].
I am on freeradius-3.0.4 from Centos 7 repositories. Accounting is on PostgresSQL backend, acctinputoctets and acctoutputoctets are updated every 5 minutes.
I can use following query for sqlcounter check on last session end expire it hourly:
query = "\ SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct \ WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime \
'%b'"
I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes). Counters are cumulative for session so i have identified so far these options:
1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works.
2. i can use a trigger for update on radacct table which will insert delta of old and new value with timestamp to kind of "stats" table and use this one for sqlcounter query, counting data for last 12 5-minute intervals or so.
3. modify radacct table/update query to do the same as point 2.
If you have some other ideas, please let me know.
From the future upgrade compatibility point of view, the 2 looks best.
[1] http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/isg/configuration/xe-3s/asr...
Thanks for feedback
r. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Anirudh Malhotra -
Anirudh Malhotra -
riki