Problem with F5 BigIP accouting : hexadecimal attribute
Dear all, I'm using Radius for authenticating admin users on different network equipments. "group authorize {...}" works fine with rlm_ldap and group management. But I have some problem for accounting on F5 BigIP LTM / GTM. In fact, my radius accounting server is receiving accounting-request like this : Accounting-Request packet from host 10.10.10.10 port 36875, id=29, length=281 NAS-IP-Address = [IP address unknown, not corresponding to NAS interfaces] F5-Attr-14 = [Hexa decimal output starting with 0x .] WARNING: Empty section. Using default return values. +- entering group accounting {...} [sql] expand: packet has no accounting status type. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> packet has no accounting status type. [user '', nas '[nas IP unknown]'] [sql] packet has no accounting status type. [user '', nas '[nas IP unknown]'] ++[sql] returns invalid Finished request 37. Cleaning up request 37 ID Did someone here already use accounting with F5 BigIP LTM or GTM ? I'm looking to make this working by changing audit_forward TCL script provided with F5 (syslog-ng) but I wasn't able to produce something different . I also tried to edit the dictionnary for F5 in /usr/share/freeradius/dictionary.f5 ATTRIBUTE F5-LTM-User-Info-1 12 string ATTRIBUTE F5-LTM-User-Info-2 13 string ++ ATTRIBUTE F5-Attr-14 14 octets Thanks in advance for your help ! Fabien VINCENT <mailto:fabien.vincent@coreye.fr> fabien.vincent@coreye.fr
NAS-IP-Address = *[IP address unknown, not corresponding to NAS interfaces] * Did you added your F5 IP address to NAS Table ? Regards Suman * On Mon, Oct 17, 2011 at 4:56 PM, Vincent, Fabien <fabien.vincent@coreye.fr>wrote:
Dear all,****
** **
I’m using Radius for authenticating admin users on different network equipments. “group authorize {...}” works fine with rlm_ldap and group management.****
** **
But I have some problem for accounting on F5 BigIP LTM / GTM.****
** **
In fact, my radius accounting server is receiving accounting-request like this :****
** **
Accounting-Request packet from host 10.10.10.10 port 36875, id=29, length=281****
NAS-IP-Address = *[IP address unknown, not corresponding to NAS interfaces]*****
F5-Attr-14 = *[Hexa decimal output starting with 0x …]*****
WARNING: Empty section. Using default return values.****
+- entering group accounting {...}****
[sql] expand: packet has no accounting status type. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> packet has no accounting status type. [user '', nas '*[nas IP unknown]*']****
[sql] packet has no accounting status type. [user '', nas '*[nas IP unknown]*']****
++[sql] returns invalid****
Finished request 37.****
Cleaning up request 37 ID****
** **
Did someone here already use accounting with F5 BigIP LTM or GTM ? I’m looking to make this working by changing audit_forward TCL script provided with F5 (syslog-ng) but I wasn’t able to produce something different …****
** **
I also tried to edit the dictionnary for F5 in * /usr/share/freeradius/dictionary.f5*
*ATTRIBUTE F5-LTM-User-Info-1 12 string*
*ATTRIBUTE F5-LTM-User-Info-2 13 string*
*++ ATTRIBUTE F5-Attr-14 14 octets*
** **
Thanks in advance for your help !****
** **
*Fabien VINCENT*****
fabien.vincent@coreye.fr****
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
NAS-IP-Address = [IP address unknown, not corresponding to NAS interfaces] * Did you added your F5 IP address to NAS Table ? Yes I have added the F5 IP address, authorize works fine using the SQL NAS Table, but the IP returned by the F5 Accounting packet isn't a valid Self IPs of the corresponding F5. I think it's return by the F5 in hexa (as the F5-Attr-14), that's why I request help about this strange behavior . Regards Suman On Mon, Oct 17, 2011 at 4:56 PM, Vincent, Fabien <fabien.vincent@coreye.fr> wrote: Dear all, I'm using Radius for authenticating admin users on different network equipments. "group authorize {...}" works fine with rlm_ldap and group management. But I have some problem for accounting on F5 BigIP LTM / GTM. In fact, my radius accounting server is receiving accounting-request like this : Accounting-Request packet from host 10.10.10.10 port 36875, id=29, length=281 NAS-IP-Address = [IP address unknown, not corresponding to NAS interfaces] F5-Attr-14 = [Hexa decimal output starting with 0x .] WARNING: Empty section. Using default return values. +- entering group accounting {...} [sql] expand: packet has no accounting status type. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> packet has no accounting status type. [user '', nas '[nas IP unknown]'] [sql] packet has no accounting status type. [user '', nas '[nas IP unknown]'] ++[sql] returns invalid Finished request 37. Cleaning up request 37 ID Did someone here already use accounting with F5 BigIP LTM or GTM ? I'm looking to make this working by changing audit_forward TCL script provided with F5 (syslog-ng) but I wasn't able to produce something different . I also tried to edit the dictionnary for F5 in /usr/share/freeradius/dictionary.f5 ATTRIBUTE F5-LTM-User-Info-1 12 string ATTRIBUTE F5-LTM-User-Info-2 13 string ++ ATTRIBUTE F5-Attr-14 14 octets Thanks in advance for your help ! Fabien VINCENT <mailto:fabien.vincent@coreye.fr> fabien.vincent@coreye.fr - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Ce message a ete verifie par MailScanner.
Vincent, Fabien wrote:\
/Yes I have added the F5 IP address, authorize works fine using the SQL NAS Table, but the IP returned by the F5 Accounting packet isn’t a valid Self IPs of the corresponding F5…/
The NAS-IP-Address attribute can be ANYTHING. It has little or no correspondence to the IP address of the NAS. The reasons why aren't complicated, but aren't important here.
/I think it’s return by the F5 in hexa (as the F5-Attr-14), that’s why I request help about this strange behavior …/
Go ask F5 what their attributes mean. If we knew, they would be in the dictionary file. Alan DeKok.
On 17/10/11 12:26, Vincent, Fabien wrote:
F5-Attr-14 = /[Hexa decimal output starting with 0x …]/
This happens when an unknown attribute is found. The attribute is assumed to be type "octets" and is rendered at hex.
*/++ ATTRIBUTE F5-Attr-14 14 octets/*
This won't help at all. This is ALREADY what FreeRADIUS assumes for unknown attributes. Try: ATTRIBUTE F5-Attr-14 14 string ...and see if it's readable.
Thanks for your replies/help. I set in the dictionary.f5 the following value : ATTRIBUTE F5-Acct 14 string First for the F5 NAS-IP-Address, it's equal to 127.1.1.1, which I suspect a strange behavior of the F5 syslog-ng / audit forwarder. But this is not a problem, I will find how to set it through tmsh or bigpipe shells. Now, I have the correct output in F5-Acct attribute I've set in the dictionary. Thanks all for your help ! If you have any experience with F5 BigIP LTM/GTM accounting, please share your feedbacks with me (in private of course). For the specific VSA provided here, is it possible to add by default in FreeRadius repo ? Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits Niveau 3 - Infrastructure & Produits -----Message d'origine----- De : freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org [mailto:freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.o rg] De la part de Phil Mayers Envoyé : lundi 17 octobre 2011 16:51 À : freeradius-users@lists.freeradius.org Objet : Re: Problem with F5 BigIP accouting : hexadecimal attribute On 17/10/11 12:26, Vincent, Fabien wrote:
F5-Attr-14 = /[Hexa decimal output starting with 0x ]/
This happens when an unknown attribute is found. The attribute is assumed to be type "octets" and is rendered at hex.
*/++ ATTRIBUTE F5-Attr-14 14 octets/*
This won't help at all. This is ALREADY what FreeRADIUS assumes for unknown attributes. Try: ATTRIBUTE F5-Attr-14 14 string ...and see if it's readable. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Ce message a ete verifie par MailScanner.
Hi, add that to the following: VENDOR F5 3375 BEGIN-VENDOR F5 ATTRIBUTE F5-LTM-User-Role 1 integer ATTRIBUTE F5-LTM-User-Role-Universal 2 integer # enable/disable ATTRIBUTE F5-LTM-User-Partition 3 string ATTRIBUTE F5-LTM-User-Console 4 integer # enable/disable ATTRIBUTE F5-LTM-User-Shell 5 string # supported values are disable, tmsh, and bpsh ATTRIBUTE F5-LTM-User-Context-1 10 integer ATTRIBUTE F5-LTM-User-Context-2 11 integer ATTRIBUTE F5-LTM-User-Info-1 12 string ATTRIBUTE F5-LTM-User-Info-2 13 string VALUE F5-LTM-User-Role Administrator 0 VALUE F5-LTM-User-Role Resource-Admin 20 VALUE F5-LTM-User-Role User-Manager 40 VALUE F5-LTM-User-Role Manager 100 VALUE F5-LTM-User-Role App-Editor 300 VALUE F5-LTM-User-Role Operator 400 VALUE F5-LTM-User-Role Guest 700 VALUE F5-LTM-User-Role Policy-Editor 800 VALUE F5-LTM-User-Role No-Access 900 VALUE F5-LTM-User-Role-Universal Disabled 0 VALUE F5-LTM-User-Role-Universal Enabled 1 VALUE F5-LTM-User-Console Disabled 0 VALUE F5-LTM-User-Console Enabled 1 END-VENDOR F5 then it can go in the distro? PS when dealing with vendor kit I tend to actually ask the vendor what their kit is doing...what the RADIUS stuff is...what issues you may have with eg accounting (F5, like other vendors, have some very active user-forums where all sorts of things get discussed). alan
participants (5)
-
Alan Buxey -
Alan DeKok -
Phil Mayers -
Suman Dash -
Vincent, Fabien