IPSec client is alternating between two IP addresses
We are using freeradius version (debian) 2.1.12+dfsg-1.2 to manage an ip-pool for an ipsec vpn gateway. The gateway does xauth to the radius server for authentication and IP assignment as well as accounting to e.g. clean up the IP address. Upon re-keying the user gets a new IP address (which is the same as the second to last one), so its basically alternating between two IP addresses. We are using the ippool-module (not SQL) and I already found the notes on the key-parameter. Its currently set to "%{NAS-IP-Address} %{User-Name}" which is unique for each dailed in client. Before we configured accounting on the vpn gateway the reason for the alternating IPs was quite obvious to me (from looking at the module code: "Found a stale entry for ip") but with accounting properly configured I can't find a reason why its still the same: Before accounting was on: Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] Searching for an entry for key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] Found a stale entry for ip: 10.151.222.215 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] num: 0 Jan 5 14:52:43 s030v0047 freeradius[26299]: rlm_ippool: Allocating ip to key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] num: 1 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] Allocated ip 10.151.222.20 to client key: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 5 14:52:43 s030v0047 freeradius[26299]: +++[s030v0047-test_pool] returns ok Now with accounting its looking like this upon re-keying: Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Searching for an entry for key: '1.1.1.2 C023A0667' Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Deallocated entry for ip: 10.151.222.215 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] num: 0 ... Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Searching for an entry for key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 8 21:37:37 s030v0047 freeradius[30859]: rlm_ippool: Allocating ip to key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] num: 1 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Allocated ip 10.151.222.39 to client key: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: +++[s030v0047-test_pool] returns ok Is it because deallocation and reallocation are to close (in time) to each other? Thank you.
On Jan 8, 2018, at 3:46 PM, Artur Jaroschek <artur@jaroschek.net> wrote:
We are using freeradius version (debian) 2.1.12+dfsg-1.2
You really need to upgrade to 2.2.10. You don't have to change anything in your configuration.
to manage an ip-pool for an ipsec vpn gateway. The gateway does xauth to the radius server for authentication and IP assignment as well as accounting to e.g. clean up the IP address. Upon re-keying the user gets a new IP address (which is the same as the second to last one), so its basically alternating between two IP addresses. We are using the ippool-module (not SQL) and I already found the notes on the key-parameter. Its currently set to "%{NAS-IP-Address} %{User-Name}" which is unique for each dailed in client. Before we configured accounting on the vpn gateway the reason for the alternating IPs was quite obvious to me (from looking at the module code: "Found a stale entry for ip") but with accounting properly configured I can't find a reason why its still the same:
If the IP is still active, AND the query uses the same IP, then it should be renewed. But... 2.1.12 is 6 years old. You should really upgrade. And take a serious look at v3, too.
Now with accounting its looking like this upon re-keying:
Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Searching for an entry for key: '1.1.1.2 C023A0667' Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Deallocated entry for ip: 10.151.222.215
In 2.2.10, it only prints "Deallocated entry" when the NAS sends an accounting STOP. i.e. when the session is closed. Running the server in debugging mode will tell you what's going on... But if the NAS sends a STOP before renewing the IP, well, that explains everything. The original session is gone, so a new lease is allocated. Alan DeKok.
participants (2)
-
Alan DeKok -
Artur Jaroschek