I am using Freeradius as a Secondary Radius. The issue is sometimes not always but 98% of the time A user when they connect to the secondary (freeradius) and connect accounting packet start and then when they disconnect no accounting packet stop gets to the secondary Reason its going to the primary radius (VOPRAdius) Thus the problem being the secondary thinks they are still connected. The nas's are not onn site these are from level3 networks Does anyone know what to do for this? Since freeradius is not being used as a primary too I am at a stump on this one.
Jeff wrote:
I am using Freeradius as a Secondary Radius.
The issue is sometimes not always but 98% of the time
A user when they connect to the secondary (freeradius) and connect
accounting packet start and then when they disconnect no accounting packet stop gets to the secondary
Reason its going to the primary radius (VOPRAdius)
Thus the problem being the secondary thinks they are still connected.
The nas's are not onn site these are from level3 networks
Does anyone know what to do for this?
Since freeradius is not being used as a primary too
I am at a stump on this one.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The issue can only be NAS side, accounting packets are completely disconnected from one another, the only thing they share is a session ID (included in the packets) , which FreeRADIUS uses to correlate the start stop and interim update packets. If VopRADIUS can use SQL as an accounting database , you could point them both at a single database instance. Theres no reason why stop, start and interim packets couldn't go to different RADIUS servers.
VOPRadius does use sql it puts its accounting records directly into our billing package rodopi I see what you are getting at is Basically both use the same sql and sync up their records _____ From: Arran Cudbard-Bell [mailto:A.Cudbard-Bell@sussex.ac.uk] To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Sat, 09 Jun 2007 15:09:36 -0400 Subject: Re: Freeradius as a secondary Jeff wrote:
I am using Freeradius as a Secondary Radius.
The issue is sometimes not always but 98% of the time
A user when they connect to the secondary (freeradius) and connect
accounting packet start and then when they disconnect no accounting packet stop gets to the secondary
Reason its going to the primary radius (VOPRAdius)
Thus the problem being the secondary thinks they are still connected.
The nas's are not onn site these are from level3 networks
Does anyone know what to do for this?
Since freeradius is not being used as a primary too
I am at a stump on this one.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The issue can only be NAS side, accounting packets are completely disconnected from one another, the only thing they share is a session ID (included in the packets) , which FreeRADIUS uses to correlate the start stop and interim update packets. If VopRADIUS can use SQL as an accounting database , you could point them both at a single database instance. Theres no reason why stop, start and interim packets couldn't go to different RADIUS servers. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jeff wrote:
VOPRadius does use sql it puts its accounting records directly into our billing package rodopi I see what you are getting at is Basically both use the same sql and sync up their records
Yep, though I'm not sure how VOPRadius generates it's accounting records, but you may need to modify the insert queries in FreeRADIUS to adjust for the VOP schema , and alter which attributes make up the unique ID. Of course the best solution would be to find out why for 2% of packets your NAS is sending the accounting data to the secondary... Is the primary under much load ? could it be network timeouts ?
*From:* Arran Cudbard-Bell [mailto:A.Cudbard-Bell@sussex.ac.uk] *To:* FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] *Sent:* Sat, 09 Jun 2007 15:09:36 -0400 *Subject:* Re: Freeradius as a secondary
Jeff wrote: > > I am using Freeradius as a Secondary Radius. > > The issue is sometimes not always but 98% of the time > > A user when they connect to the secondary (freeradius) and connect > > accounting packet start and then when they disconnect no accounting > packet stop gets to the secondary > > Reason its going to the primary radius (VOPRAdius) > > Thus the problem being the secondary thinks they are still connected. > > The nas's are not onn site these are from level3 networks > > Does anyone know what to do for this? > > Since freeradius is not being used as a primary too > > I am at a stump on this one. > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The issue can only be NAS side, accounting packets are completely disconnected from one another, the only thing they share is a session ID (included in the packets) , which FreeRADIUS uses to correlate the start stop and interim update packets.
If VopRADIUS can use SQL as an accounting database , you could point them both at a single database instance. Theres no reason why stop, start and interim packets couldn't go to different RADIUS servers. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sat 09 Jun 2007, Jeff wrote:
I am using Freeradius as a Secondary Radius.
The issue is sometimes not always but 98% of the time
A user when they connect to the secondary (freeradius) and connect
accounting packet start and then when they disconnect no accounting packet stop gets to the secondary
Reason its going to the primary radius (VOPRAdius)
Thus the problem being the secondary thinks they are still connected.
The nas's are not onn site these are from level3 networks
Does anyone know what to do for this?
Since freeradius is not being used as a primary too
I am at a stump on this one.
An easy way to handle this that doesn't involve database clustering is to have your secondary radius accounting server not write accounting data to sql, but rather to relay all packets it receives back to the primary using radrelay. If they primary is down, the packets should be queued, and delivered when it comes back up. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
ok I like that solution Which prompts two questions. 1. Question not wriring to sql locally, how can I tell when users are connected and disconnect from the secondary 2. Where is the best howto doc on the radrelay module. Thanks _____ From: Peter Nixon [mailto:listuser@peternixon.net] To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Sun, 10 Jun 2007 08:36:29 -0400 Subject: Re: Freeradius as a secondary On Sat 09 Jun 2007, Jeff wrote:
I am using Freeradius as a Secondary Radius.
The issue is sometimes not always but 98% of the time
A user when they connect to the secondary (freeradius) and connect
accounting packet start and then when they disconnect no accounting packet stop gets to the secondary
Reason its going to the primary radius (VOPRAdius)
Thus the problem being the secondary thinks they are still connected.
The nas's are not onn site these are from level3 networks
Does anyone know what to do for this?
Since freeradius is not being used as a primary too
I am at a stump on this one.
An easy way to handle this that doesn't involve database clustering is to have your secondary radius accounting server not write accounting data to sql, but rather to relay all packets it receives back to the primary using radrelay. If they primary is down, the packets should be queued, and delivered when it comes back up. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jeff wrote:
ok I like that solution Which prompts two questions.
1. Question not wriring to sql locally, how can I tell when users are connected and disconnect from the secondary 2. Where is the best howto doc on the radrelay module.
Thanks
Yeah agreed much better idea. hmm do you *have* to use radrelay though ? . Can't you just use proxy-to-realm in the accounting section ? in cvs pre 2 that would be update config { Proxy-To-Realm = "realm" } update request { Realm = "realm" } prior to cvs pre 2 you could have something like DEFAULT Proxy-To-Realm := "realm" in accounting users. You'd just need to set up a realm with your primary server in.
I am using the version installed through software update on opensuse Its 1. something but not sure exactly radrelay is installed tested but i its creating the work file,etc no errors but nothing showing up at primary when doing a test as to proxy to realm in proxy section You are saying I could setup to proxy the accounting back to the primary radius and not use radrelay? The below to realms heres what i have now on the secondary realm globalco.net { type = radius authhost = LOCAL accthost = LOCAL } # realm go-globalusa.net { type = radius authhost = LOCAL accthost = LOCAL } _____ From: Arran Cudbard-Bell [mailto:A.Cudbard-Bell@sussex.ac.uk] To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Sun, 10 Jun 2007 11:05:25 -0400 Subject: Re: Freeradius as a secondary Jeff wrote:
ok I like that solution Which prompts two questions.
1. Question not wriring to sql locally, how can I tell when users are connected and disconnect from the secondary 2. Where is the best howto doc on the radrelay module.
Thanks
Yeah agreed much better idea. hmm do you *have* to use radrelay though ? . Can't you just use proxy-to-realm in the accounting section ? in cvs pre 2 that would be update config { Proxy-To-Realm = "realm" } update request { Realm = "realm" } prior to cvs pre 2 you could have something like DEFAULT Proxy-To-Realm := "realm" in accounting users. You'd just need to set up a realm with your primary server in. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jeff wrote:
I am using the version installed through software update on opensuse Its 1. something but not sure exactly radrelay is installed tested but i its creating the work file,etc no errors but nothing showing up at primary when doing a test Have you added the secondary server as an authorised client on the primary ?
as to proxy to realm in proxy section
You are saying I could setup to proxy the accounting back to the primary radius and not use radrelay? The below to realms
heres what i have now on the secondary realm globalco.net { type = radius authhost = LOCAL accthost = LOCAL } # realm go-globalusa.net { type = radius authhost = LOCAL accthost = LOCAL } Ok so your acct host would be the address of your primary radius server. You'd also need to add your secondary server as an authorised client on your primary, and setup a shared secret between them.
You'd then add this line to accounting users DEFAULT Proxy-To-Realm := "globalco" Peters solution is probably more what you looking for though, and like he said it does have the advantage of being able to que up accounting packets if your primary goes down, so no data is lost. Just proxying means you only have to worry about one process, and it's slightly neater.
Yes I did its added.. Mybe its just the fact I am using the ntradping to test with and not throwing enough attributes for it to start logging correctly on the primary maybe if I wait till someone actually its it again from a real client it will give me accurate results _____ From: Arran Cudbard-Bell [mailto:A.Cudbard-Bell@sussex.ac.uk] To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Sun, 10 Jun 2007 14:17:25 -0400 Subject: Re: Freeradius as a secondary Jeff wrote:
I am using the version installed through software update on opensuse Its 1. something but not sure exactly radrelay is installed tested but i its creating the work file,etc no errors but nothing showing up at primary when doing a test Have you added the secondary server as an authorised client on the primary ?
as to proxy to realm in proxy section
You are saying I could setup to proxy the accounting back to the primary radius and not use radrelay? The below to realms
heres what i have now on the secondary realm globalco.net { type = radius authhost = LOCAL accthost = LOCAL } # realm go-globalusa.net { type = radius authhost = LOCAL accthost = LOCAL } Ok so your acct host would be the address of your primary radius server. You'd also need to add your secondary server as an authorised client on your primary, and setup a shared secret between them.
You'd then add this line to accounting users DEFAULT Proxy-To-Realm := "globalco" Peters solution is probably more what you looking for though, and like he said it does have the advantage of being able to que up accounting packets if your primary goes down, so no data is lost. Just proxying means you only have to worry about one process, and it's slightly neater. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sun 10 Jun 2007, Jeff wrote:
I am using the version installed through software update on opensuse
You may wish to use my updated packages at: http://software.opensuse.org/download/network:/aaa/ Just add is as a software repository in YaST. (ie. http://software.opensuse.org/download/network:/aaa/openSUSE_10.2/) Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
Ok new issue thats eluding me I uninstalled version 1. then installed version 2 anyway. i resetup the configs and made sure my services file is 1645 radius and 1646 for acct as before anyway when i do a auth with ntradping all connects aok when i do anykind of an accouting request, stop start update i get error 10054 which i read may mean check the port which it apperas i am set aok unless i am missing something NEXT Nothing is going into the radacct dir for detail file either or is it being created Also when i do a /etc/init.d/freeradius start or restart everything is aok when i do a /etc/init.d/freeradius reload I see in the radius log that its saying there is errors in the radius config Anyway anyone have any ideas? _____ From: Peter Nixon [mailto:listuser@peternixon.net] To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] Sent: Sun, 10 Jun 2007 19:43:58 -0400 Subject: Re: Freeradius as a secondary On Sun 10 Jun 2007, Jeff wrote:
I am using the version installed through software update on opensuse
You may wish to use my updated packages at: http://software.opensuse.org/download/network:/aaa/ Just add is as a software repository in YaST. (ie. http://software.opensuse.org/download/network:/aaa/openSUSE_10.2/) Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Arran Cudbard-Bell -
Jeff -
Peter Nixon