proxying accounting records
I've had a proxy configuration setup to forward copies of accounting updates to two other radius servers for several years. Recently, I added a third (which one of the original two will be moving to), however it's not working: while the original ones get the expected start/stop/interim-updates, the new one only gets "accounting-on" packets while the updates just pile up in the detail file. That particular server ignores anything but start, stop and interim-update records (it's a vendor I have no control over). In monitoring what gets sent out, after restarting the radius server, I do not see Accounting-On getting sent to the original ones, so I don't understand why it's happening with the new one. The configurations are identical except for the detail file name and the ip address (I only included the configs for the two related proxy targets for simplicity): mods: detail detail-calix { filename = ${radacctdir}/detail-calix escape_filenames = no permissions = 0600 header = "%t" } detail detail-newcalix { filename = ${radacctdir}/detail-newcalix escape_filenames = no permissions = 0600 header = "%t" } replicate { Replicate-To-Realm = calix Replicate-To-Realm = newcalix } sites: server relay-calix { listen { type = detail filename = ${radacctdir}/detail-calix load_factor = 10 } preacct { update control { Proxy-To-Realm := "calix" } } accounting { ok } pre-proxy { } post-proxy { } } server relay-newcalix { listen { type = detail filename = ${radacctdir}/detail-newcalix load_factor = 10 } preacct { update control { Proxy-To-Realm := "newcalix" } } accounting { ok } pre-proxy { } post-proxy { } } proxy.conf: proxy server { default_fallback = no } # /usr/bin/radrelay -S /etc/raddb/secret.calix -r 199.71.142.73 detail-calix home_server calix { type = acct ipaddr = 199.71.142.73 port = 1813 secret = xxx status_check = none check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool calix_pool { type = fail-over home_server = calix } realm calix { acct_pool = calix_pool } # /usr/bin/radrelay -S /etc/raddb/secret.newcalix -r 199.71.142.73 detail-newcalix home_server newcalix { type = acct ipaddr = 199.71.143.36 port = 1813 secret = xxx status_check = none check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool newcalix_pool { type = fail-over home_server = newcalix } realm newcalix { acct_pool = newcalix_pool }
On Jan 21, 2019, at 4:01 PM, Alan Batie <alan@peak.org> wrote:
I've had a proxy configuration setup to forward copies of accounting updates to two other radius servers for several years. Recently, I added a third (which one of the original two will be moving to), however it's not working: while the original ones get the expected start/stop/interim-updates, the new one only gets "accounting-on" packets while the updates just pile up in the detail file.
The debug log should show *why* that's happening.
That particular server ignores anything but start, stop and interim-update records (it's a vendor I have no control over).
It's a ridiculous thing to do. That seems to be the habit with RADIUS.
In monitoring what gets sent out, after restarting the radius server, I do not see Accounting-On getting sent to the original ones, so I don't understand why it's happening with the new one. The configurations are identical except for the detail file name and the ip address (I only included the configs for the two related proxy targets for simplicity):
The server doesn't really care about the contents of the packets it's proxying. They're all the same. So something is different in your configuration, and treats the packets differently. What is it? The default configuration doesn't do anything special with proxying accounting "on" versus "start" or "stop". If there's nothing special in the config, see the debug output for what's going on. Alan DeKok.
On 1/21/19 2:32 PM, Alan DeKok wrote:
That particular server ignores anything but start, stop and interim-update records (it's a vendor I have no control over).
It's a ridiculous thing to do. That seems to be the habit with RADIUS.
No argument there... So, before I posted, I'd restarted the radius server to see if it sent accounting-on packets to the first server (no). After your response, I did the full debug mode...and it sent the right updates. I restarted normally...and it kept doing updates. I must have fed the gremlins after midnight again.
participants (2)
-
Alan Batie -
Alan DeKok