Hi All, This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this. I'm trying to drop a session using radclient: Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid@example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002" rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found But regardless of what I try I can't seem to send the right attrs to get (ie. find) an active session dropped. The NAS is a Juniper Edge Routing Switch ERX-310. Best I can tell I have the right attrs. Including others results in Unsupported attr error. Omitting either of these two results in attr missing error. Does anybody know the what should be passed? Here is the radacct record for the session: radacctid: 959301 acctsessionid: erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002 acctuniqueid: d0c22edd21381824 username: someid@example.com groupname: realm: nasipaddress: 204.101.13.1 nasportid: 124498 nasporttype: Virtual acctstarttime: 2015-11-19 10:28:55 acctstoptime: NULL acctsessiontime: 3600 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: NULL acctinputoctets: 6638966 acctoutputoctets: 140935633 calledstationid: callingstationid: GigabitEthernet 5/0/4.1300052:130-52=23587452684=2 acctterminatecause: servicetype: Framed-User framedprotocol: PPP framedipaddress: 204.101.88.246 acctstartdelay: 0 acctstopdelay: NULL xascendsessionsvrkey: Bill
On Nov 19, 2015, at 12:11 PM, Bill Schoolfield <bill@billmax.com> wrote:
This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this.
Oh, yes.
I'm trying to drop a session using radclient:
Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid@example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002"
You would think that would work, right? I spent a *long* time in the IETF RADEXT working group arguing that RFC 5176 should allow that. The vendors refused... because all of their equipment would immediately become non-compliant.
rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found
Yup.
But regardless of what I try I can't seem to send the right attrs to get (ie. find) an active session dropped.
Yup. And if you send *too many* attributes, it will complain with "Unsupported attribute".
The NAS is a Juniper Edge Routing Switch ERX-310. Best I can tell I have the right attrs. Including others results in Unsupported attr error. Omitting either of these two results in attr missing error.
Does anybody know the what should be passed? Here is the radacct record for the session:
Typically send the same attributes you see in an Accounting-Request packet. And hope for the best. Alan DeKok.
Alan, Thanks. I ran radius in debug mode and examined the request. Its data matches what I'm using so I'm back to square one. When you say "RFC 5176 should allow that" what specifically are you referring to? Bil On 11/19/2015 11:16 AM, Alan DeKok wrote:
On Nov 19, 2015, at 12:11 PM, Bill Schoolfield <bill@billmax.com> wrote:
This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this. Oh, yes.
I'm trying to drop a session using radclient:
Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid@example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002" You would think that would work, right?
I spent a *long* time in the IETF RADEXT working group arguing that RFC 5176 should allow that. The vendors refused... because all of their equipment would immediately become non-compliant.
rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found Yup.
But regardless of what I try I can't seem to send the right attrs to get (ie. find) an active session dropped. Yup. And if you send *too many* attributes, it will complain with "Unsupported attribute".
The NAS is a Juniper Edge Routing Switch ERX-310. Best I can tell I have the right attrs. Including others results in Unsupported attr error. Omitting either of these two results in attr missing error.
Does anybody know the what should be passed? Here is the radacct record for the session: Typically send the same attributes you see in an Accounting-Request packet. And hope for the best.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 19, 2015, at 12:55 PM, Bill Schoolfield <bill@billmax.com> wrote:
Thanks. I ran radius in debug mode and examined the request. Its data matches what I'm using so I'm back to square one.
Ask Juniper how their software works. You would hope that this is documented somewhere.
When you say "RFC 5176 should allow that" what specifically are you referring to?
I meant that I was involved in the update before RFC 5176 was released. I argued for sanity. CoA should use Acct-Session-Id to identify sessions. The working group decided that the RFC should instead make no recommendations about which attributes can be used to identify sessions. I think it's stupid, but I don't (yet) control all of the RADIUS RFCs. :( Alan DeKok.
Bill Schoolfield <bill@billmax.com> writes:
Hi All,
This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this.
I'm trying to drop a session using radclient:
Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid@example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002" rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found
Did you try with either User-Name or Acct-Session-Id, but not both? It's been a long time since I played with this on ERXes, and it doesn't look like any of our lab boxes are powered on anymore, so I cannot say for sure how it works. But I believe I initially wrote the code we are using for MXes trying to maintain ERX compatibility, and that code uses only Acct-Session-Id. Worth trying if you haven't already. Bjørn
This is a followup on a resolution. Posted here so someone else won't have to go through this pain. After trying Juniper support (they were clueless) and dozens of other changes, I decided that perhaps the format of the Acct-Session-Id value was the issue. The one used included interface info as well as hex encoded session number. The router has a command to change this format to a normal decimal number: routername(config)#radius acct-session-id-format decimal Once set, the disconnect requests work. Bill On 11/19/2015 11:11 AM, Bill Schoolfield wrote:
Hi All,
This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this.
I'm trying to drop a session using radclient:
Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid@example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002" rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found
But regardless of what I try I can't seem to send the right attrs to get (ie. find) an active session dropped.
The NAS is a Juniper Edge Routing Switch ERX-310. Best I can tell I have the right attrs. Including others results in Unsupported attr error. Omitting either of these two results in attr missing error.
Does anybody know the what should be passed? Here is the radacct record for the session:
radacctid: 959301 acctsessionid: erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002 acctuniqueid: d0c22edd21381824 username: someid@example.com groupname: realm: nasipaddress: 204.101.13.1 nasportid: 124498 nasporttype: Virtual acctstarttime: 2015-11-19 10:28:55 acctstoptime: NULL acctsessiontime: 3600 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: NULL acctinputoctets: 6638966 acctoutputoctets: 140935633 calledstationid: callingstationid: GigabitEthernet 5/0/4.1300052:130-52=23587452684=2 acctterminatecause: servicetype: Framed-User framedprotocol: PPP framedipaddress: 204.101.88.246 acctstartdelay: 0 acctstopdelay: NULL xascendsessionsvrkey:
Bill
On Nov 20, 2015, at 5:42 PM, Bill Schoolfield <bill@billmax.com> wrote:
This is a followup on a resolution. Posted here so someone else won't have to go through this pain. After trying Juniper support (they were clueless)
As expected.
and dozens of other changes, I decided that perhaps the format of the Acct-Session-Id value was the issue. The one used included interface info as well as hex encoded session number.
The router has a command to change this format to a normal decimal number:
routername(config)#radius acct-session-id-format decimal
Once set, the disconnect requests work.
Uh... so their software doesn't like the Acct-Session-Id value it sends out? That's stupid. It's like they tried *hard* to break everything. Alan DeKok.
participants (3)
-
Alan DeKok -
Bill Schoolfield -
Bjørn Mork