Freeradius 2.1 - Accouting packets mirring
Hello everyone, I'll apologize in advance for asking something that have been already asked in this list, but the answers for those previous questions couldn't help me a lot. I work at an ISP and we have an instance of Freeradius 2.1 that is responsible for accounting, authentication and IP address redistribution. We are testing a new equipment from Allot (Netenforcer) that can do traffic analysis and traffic shaping, in order for this equipment to work correctly and recognize our subscribers traffic, it needs to receive a copy of our radius accounting requests and responses, as I said before, I've found some information about 'copy-acct-to-home-server' file and radrelay, the problem is that in the comments in this file it says something about 'detail' file and stuff, I don't know nothing about it, I just know that my server is configured to store the accounting information into a mysql table, I just need it to send a identical copy of this packets to the appliance. What's the easiest way to do this without messing up with my current configuration? Thanks a lot. --
Hi,
copy of this packets to the appliance. What's the easiest way to do this without messing up with my current configuration?
you just need to edit your current configuration...not mess it up. so something along the lines of symlink or copy copy-acct-to-home-server into the sites-enabled directory so that it will be used/active but wait! that file needs this 'detail' file, right? well, edit the modules/detail file (if not using it already) and make sure it writes 'detailfile' to the correct place (ie that line matches what the read line in the copy-acct-to-home-server says! then in the accounting section of your main server (here I guess its just 'default' you ensure you have a call to 'detail' in your accounting {} section eg if (Acct-Session-Time != 0) { detail } else { ok } (this example has a protection wrapper to ensure certain NAS junk doesnt mess up things!) now...at this point this new VS is going to be quite dumb - it will read in packets from the detail file and then act on them just as you've told it to - ie it will take the packets in and follow rules already set in proxy.conf for how to handle the packets.... so, what you have to do is, in the copy-acct-to-home-server VS, edit the preacct part to have eg preacct { update control { Proxy-To-Realm := "new_appliance" } } and then in proxy.conf have eg realm new_appliance { type = radius accthost = x.x.x.x:1813 secret = SECRET } obviously replacing x.x.x.x and SECRET as required!!!!! ;-) done. alan
On 26 Feb 2014, at 13:48, Antonio Modesto Amaral Sousa <modesto@isimples.com.br> wrote:
Hello everyone,
I'll apologize in advance for asking something that have been already asked in this list, but the answers for those previous questions couldn't help me a lot. I work at an ISP and we have an instance of Freeradius 2.1 that is responsible for accounting, authentication and IP address redistribution. We are testing a new equipment from Allot (Netenforcer) that can do traffic analysis and traffic shaping, in order for this equipment to work correctly and recognize our subscribers traffic, it needs to receive a copy of our radius accounting requests and responses, as I said before, I've found some information about 'copy-acct-to-home-server' file and radrelay, the problem is that in the comments in this file it says something about 'detail' file and stuff, I don't know nothing about it, I just know that my server is configured to store the accounting information into a mysql table, I just need it to send a identical copy of this packets to the appliance. What's the easiest way to do this without messing up with my current configuration?
use rlm_replicate and you probably don't need to send responses. https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/modules/re... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 26.02.2014 14:48, Antonio Modesto Amaral Sousa wrote:
We are testing a new equipment from Allot (Netenforcer) that can do traffic analysis and traffic shaping, in order for this equipment to work correctly and recognize our subscribers traffic, it needs to receive a copy of our radius accounting requests and responses
We had to do the same for the Identity-Awarness of our new checkpoint firewalls. That's how I did it : 1. define a home_server, home_server_pool and realm for your Allot #### Allot #### home_server my.allot.box { type = acct ipaddr = x.x.x.x port = 1813 proto = udp secret = 123456 require_message_authenticator = no } home_server_pool ALLOT { type = fail-over home_server = my.allot.box } realm ACCT-ALLOT { acct_pool = ALLOT nostrip } Then in your VS config file, in preacct {} add : update control { Replicate-to-Realm := ACCT-ALLOT } replicate You can read the raddb/modules/replicate file for more information on how it works This will send a copy of any accounting messages received by your freeradius. freeradius doesn't expect any reply to those message so the performance impact is null. It works like a charm in our case ;) Regards, Olivier B. -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Antonio Modesto Amaral Sousa -
Arran Cudbard-Bell -
Olivier Beytrison