We at Bristol have used FreeRADIUS with no problems for some time, but I would like to alter the way that accounting is performed, but I am unsure of how to do it. Currently all the accounting is sent to a MySQL database. The 'radacct' table tells me the start/stop of each session and the amount of traffic passed in that time. However the traffic figures are only updated when the user's session terminates. Is there a way to get up-to-date statistics that can be polled, say, on an hourly basis? What I'm getting at is that I want each user to have a daily/weekly/etc traffic quota so the radius server should repeatedly check to see if it has been exceeded. Appropriate action will be taken elsewhere is this is exceeded. Does anyone have any pointers? e.g. can the radius server be queried intermittently for traffic figures? Can the radacct table be updated hourly without forcing a disconnection? Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------
Your NAS' need support for Radius Extensions... the Interm-Accounting attributes. Then, once this is working, you can always add a script to the accouting section to process the limits you want to impose. Kind Regards Etienne Pretorius Network Administrator Kingsley Technologies <http://www.kingsley.co.za> Email: admin@kingsley.co.za <mailto:admin@kingsley.co.za> Tel: 086 11 KTECH Local Fax: 086 611 5001 International Fax: +27 21 761 9930 Email Disclaimer <http://www.kingsley.co.za/index.php?id=109> Acceptable Use Policy <http://www.kingsley.co.za/index.php?id=107> www.kingsley.co.za Jonathan Gazeley wrote:
We at Bristol have used FreeRADIUS with no problems for some time, but I would like to alter the way that accounting is performed, but I am unsure of how to do it.
Currently all the accounting is sent to a MySQL database. The 'radacct' table tells me the start/stop of each session and the amount of traffic passed in that time. However the traffic figures are only updated when the user's session terminates. Is there a way to get up-to-date statistics that can be polled, say, on an hourly basis?
What I'm getting at is that I want each user to have a daily/weekly/etc traffic quota so the radius server should repeatedly check to see if it has been exceeded. Appropriate action will be taken elsewhere is this is exceeded.
Does anyone have any pointers? e.g. can the radius server be queried intermittently for traffic figures? Can the radacct table be updated hourly without forcing a disconnection?
Cheers, Jonathan
---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, Aug 07, 2008 at 11:05:00AM +0100, Jonathan Gazeley wrote:
We at Bristol have used FreeRADIUS with no problems for some time, but I would like to alter the way that accounting is performed, but I am unsure of how to do it.
Currently all the accounting is sent to a MySQL database. The 'radacct' table tells me the start/stop of each session and the amount of traffic passed in that time. However the traffic figures are only updated when the user's session terminates. Is there a way to get up-to-date statistics that can be polled, say, on an hourly basis?
Your NAS needs to support interim accounting. If it does already, it might be as simple as adding: DEFAULT Acct-Interim-Interval = 1800, Fall-Through = yes ...to the "users" file; modify as appropriate of course for your config. The "sql.conf" file will need to have the interim queries defined of course; the default configs do. If your NAS doesn't support interim accoutning (some ethernet switches don't, irritatingly) then you'll need to resort to something like snmp, netflow or pmacct, and go from ip->mac and then mac (callingstationid) to username.
What I'm getting at is that I want each user to have a daily/weekly/etc traffic quota so the radius server should repeatedly check to see if it has been exceeded. Appropriate action will be taken elsewhere is this is exceeded.
Yeah, we do this. It works very well. If you want to contact me offline I can give you the details.
Phil Mayers wrote:
Your NAS needs to support interim accounting. Thanks for your help. After your recommendation I did some reading and came across this: http://www.netexpertise.eu/en/freeradius/daily-accounting.html
We are using Cisco WiSMs, which don't seem to support the command "aaa accounting update periodic 180" (After "aaa" the only available option is "auth"). I can't find anything useful on Google. Can anyone verify if this is type of setup is possible with WiSMs? The author of the article refers to a "Cisco router" which I took to mean WiSMs as I do not believe our routers here have anything to do with the AAA process. Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------
Phil Mayers wrote:
Your NAS needs to support interim accounting.
If it does already, it might be as simple as adding:
DEFAULT Acct-Interim-Interval = 1800, Fall-Through = yes
...to the "users" file; modify as appropriate of course for your config.
I have added the lines above to my "users" file, replacing 1800 with a value of 20. However, the updates do not occur every 20 minutes. Do I also need to enable something on my NAS (Cisco WiSMs) to allow it to provide accounting on demand? I did also try to edit the config on my WiSMs to push the accounting every 20 minutes but was unable to get that to work. The guy who primarily looks after the WiSMs is away at the moment. How is interim accounting normally done? I don't mind if the accounting is pushed or pulled, whatever works. Thanks, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------
20 would mean 20 seconds not 20 minutes. Does the interim attribute appear in the Access-Accept packet? You can set up interim accounting by passing that radius attribute or it can be fixed in the NAS configuration. Ivan Kalik Kalik Informatika ISP Dana 12/8/2008, "Jonathan Gazeley" <jonathan.gazeley@bristol.ac.uk> piše:
Phil Mayers wrote:
Your NAS needs to support interim accounting.
If it does already, it might be as simple as adding:
DEFAULT Acct-Interim-Interval = 1800, Fall-Through = yes
...to the "users" file; modify as appropriate of course for your config.
I have added the lines above to my "users" file, replacing 1800 with a value of 20. However, the updates do not occur every 20 minutes. Do I also need to enable something on my NAS (Cisco WiSMs) to allow it to provide accounting on demand?
I did also try to edit the config on my WiSMs to push the accounting every 20 minutes but was unable to get that to work. The guy who primarily looks after the WiSMs is away at the moment.
How is interim accounting normally done? I don't mind if the accounting is pushed or pulled, whatever works.
Thanks, Jonathan
---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jonathan Gazeley wrote:
Phil Mayers wrote:
Your NAS needs to support interim accounting.
If it does already, it might be as simple as adding:
DEFAULT Acct-Interim-Interval = 1800, Fall-Through = yes
...to the "users" file; modify as appropriate of course for your config.
I have added the lines above to my "users" file, replacing 1800 with a value of 20. However, the updates do not occur every 20 minutes. Do I also need to enable something on my NAS (Cisco WiSMs) to allow it to provide accounting on demand?
Not sure. It definitely works; we have it working here. Are you getting *any* accounting from the WISM? You'll need: radius acct add $server_id $server 1813 ascii secret wlan radius_server acct add $wlan_id $server_id I notice we've got: wlan session-timeout $wlan_id 1800 ...statements in our config, but I'm not an expert on the WISMs so I don't know if that's required.
I did also try to edit the config on my WiSMs to push the accounting every 20 minutes but was unable to get that to work. The guy who primarily looks after the WiSMs is away at the moment.
How is interim accounting normally done? I don't mind if the accounting is pushed or pulled, whatever works.
Accounting is always pushed from the NAS to the Radius server.
Thanks, Jonathan
---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Etienne Pretorius -
Ivan Kalik -
Jonathan Gazeley -
Phil Mayers