We have a setup for l2tp ADSL and other connections using freeradius. All is generally working fine - I am building some coa functionality. The good news is that this in general works fine - I have however one problem and while I can see hints on the list and on the freeradius site I would appreciate some clarification. We have currently 2 LNS Servers. Sessions to us can end up on either one of our LNS Servers. However I can't easily say which of the LNS devices to send the request to - the NAS IP we hold in radact is actually the Wholesale providers NAS IP not the LNS IP address. What I would ideally like to do (simple solution) is send the coa request to both LNS routers - one will obviously say 'no match' the other will correctly affect the session. With the pool set to failover I find that second LNS is not sent the coa as the first LNS replied (albeit saying no match), load balance works 50/50. Is there a simple way to configure coa to send the request to both here. I'm also open to any betrter routes to do this coa config is currently --- listen { type = coa ipaddr = * port = 3799 server = coa } server coa { recv-coa { update control { Home-Server-Pool := firebrick_pool } ok } send-coa { ok } } --- proxy.conf is currently: --- home_server firebrick-1 { type = coa ipaddr = 2.3.4.5 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server firebrick-2 { type = coa ipaddr = 1.2.3.4 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool firebrick_pool { type = load-balance home_server = firebrick-1 home_server = firebrick-2 } --- Any pointers would be gratefully received -- Richard Palmer
Richard J Palmer wrote:
What I would ideally like to do (simple solution) is send the coa request to both LNS routers - one will obviously say 'no match' the other will correctly affect the session. With the pool set to failover I find that second LNS is not sent the coa as the first LNS replied (albeit saying no match), load balance works 50/50.
That's a terrible solution.
Is there a simple way to configure coa to send the request to both here.
No. Packets go to ONE destination, and ONLY one destination.
I'm also open to any betrter routes to do this
Add a column to the accounting table. It should be "LNS IP Address". Then, update the accounting queries to store Packet-Src-IP-Address there. For CoA, you just look up the session in the accounting table, and sent the CoA packet to the LNS IP Address. Alan DeKok.
On 5 Jan 2014, at 01:20, Richard J Palmer <richard@merula.net> wrote:
We have a setup for l2tp ADSL and other connections using freeradius.
All is generally working fine - I am building some coa functionality.
The good news is that this in general works fine - I have however one problem and while I can see hints on the list and on the freeradius site I would appreciate some clarification.
We have currently 2 LNS Servers. Sessions to us can end up on either one of our LNS Servers. However I can't easily say which of the LNS devices to send the request to - the NAS IP we hold in radact is actually the Wholesale providers NAS IP not the LNS IP address.
What about the src IP address of the RADIUS accounting packets? Does that match an interface on the LNS?
What I would ideally like to do (simple solution) is send the coa request to both LNS routers - one will obviously say 'no match' the other will correctly affect the session. With the pool set to failover I find that second LNS is not sent the coa as the first LNS replied (albeit saying no match), load balance works 50/50.
You may be able to use the replicate module. You'll have to change the NAS-Identifier/NAS-IP-Address in the CoA request when you send it to each of the devices. Note that the rlm_replicate module does not process responses, so there'll be no retransmissions for the device the packets were replicated to. The feature you're asking for is actually quite difficult to implement. We are considering something that may enable setups like that, but the earliest it'll appear is FreeRADIUS 4.x.x and that's probably a few years away.
Is there a simple way to configure coa to send the request to both here. I'm also open to any betrter routes to do this
Try and determine the LNS from information received in Accounting-Requests and direct the CoA-Requests accordingly. %{Packet-SRC-IP-Address} will expand to the src ip address in the packet. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Richard J Palmer