Greetings! I am trying to understand the conception of coa server. What functionality does it brings ? Is it a some kind of proxy ? For example, I have a NAS server with configured coa port. I can send a disconnect request directly into it. If I configure a coa server on a freeradius server, will I be able to send a disconnect request to the freeradius instead and that is all? Thanks in advance for your answers! -- Best regards, Yuriy Ivkin
Greetings! After few hours of googling I think I understood. The only not clear thing: how freeradius deside to send a CoA message or not ? Comments from sites-available/originate-coa: # CoA packets can be originated when a normal Access-Request or # Accounting-Request packet is received. Simply update the # "coa" list: # # update coa { # &User-Name = "%{User-Name}" # &Acct-Session-Id = "%{Acct-Session-Id}" # &NAS-IP-Address = "%{NAS-IP-Address}" # } # # And the CoA packet will be sent. You can also send Disconnect # packets by using "update disconnect { ...". # What is the "Simply update the "coa" list" means ? Changing of a site configuration in accounting section like this update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } and restart service ? Will the CoA message be generated in response for every acct request of active sessions ? That has no sense... 03.03.2023 11:33, Yuriy Ivkin пишет:
Greetings!
I am trying to understand the conception of coa server. What functionality does it brings ? Is it a some kind of proxy ?
For example, I have a NAS server with configured coa port. I can send a disconnect request directly into it. If I configure a coa server on a freeradius server, will I be able to send a disconnect request to the freeradius instead and that is all?
Thanks in advance for your answers!
-- Best regards, Yuriy Ivkin
On Mar 3, 2023, at 8:43 AM, Yuriy Ivkin <y.ivkin@corp.rtln.ru> wrote:
After few hours of googling I think I understood.
The documentation tries to be as clear as possible. But it assumes some familiarity with RADIUS.
The only not clear thing: how freeradius deside to send a CoA message or not ?
It doesn't. *You* update the configuration to say "please send a CoA packet". There are two "coa" related visual servers: coa receive CoA packets and do whatever you want with them coa-relay receive CoA packets, look up user information in a DB, and proxy them to the NAS. From your previous message:
For example, I have a NAS server with configured coa port. I can send a disconnect request directly into it. If I configure a coa server on a freeradius server, will I be able to send a disconnect request to the freeradius instead and that is all?
The user is connected to the NAS, not to FreeRADIUS. Sending a CoA packet to FreeRADIUS (and not to the NAS) will do nothing.
What is the "Simply update the "coa" list" means ? Changing of a site configuration in accounting section like this
That is what it says.
Will the CoA message be generated in response for every acct request of active sessions ? That has no sense...
The point is not to send a CoA packet on every accounting request. The point is to document HOW to send CoA packets. The next step is for you to figure out WHEN you want to send CoA packets. And then write the policy: if (... I need to send a CoA packet) { update coa { ... } } As with almost everything in the server, we don't (and can't) document every possible policy. We can't provide a default configuration which works for everyone, and does what everyone wants. Instead, we document how the server works. It's up to you to figure out how to turn that into local policies. Alan DeKok.
Greetings Alan! Thank you for your answer!
The next step is for you to figure out WHEN you want to send CoA packets.
Some thing like this ? update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } if(User-Name != ""){ update control { Send-CoA-Request = "%{sql: SELECT sendCoaForUser('%{User-Name}')}" } } else { update control { Send-CoA-Request = Yes } } 03.03.2023 16:55, Alan DeKok пишет:
On Mar 3, 2023, at 8:43 AM, Yuriy Ivkin<y.ivkin@corp.rtln.ru> wrote:
After few hours of googling I think I understood. The documentation tries to be as clear as possible. But it assumes some familiarity with RADIUS.
The only not clear thing: how freeradius deside to send a CoA message or not ? It doesn't. *You* update the configuration to say "please send a CoA packet".
There are two "coa" related visual servers:
coa receive CoA packets and do whatever you want with them
coa-relay receive CoA packets, look up user information in a DB, and proxy them to the NAS.
From your previous message:
For example, I have a NAS server with configured coa port. I can send a disconnect request directly into it. If I configure a coa server on a freeradius server, will I be able to send a disconnect request to the freeradius instead and that is all? The user is connected to the NAS, not to FreeRADIUS. Sending a CoA packet to FreeRADIUS (and not to the NAS) will do nothing.
What is the "Simply update the "coa" list" means ? Changing of a site configuration in accounting section like this That is what it says.
Will the CoA message be generated in response for every acct request of active sessions ? That has no sense... The point is not to send a CoA packet on every accounting request. The point is to document HOW to send CoA packets. The next step is for you to figure out WHEN you want to send CoA packets. And then write the policy:
if (... I need to send a CoA packet) { update coa { ... } }
As with almost everything in the server, we don't (and can't) document every possible policy. We can't provide a default configuration which works for everyone, and does what everyone wants.
Instead, we document how the server works. It's up to you to figure out how to turn that into local policies.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
-- Best regards, Yuriy Ivkin Right Line LLC Telephone: +7 499 517 9695 Address: Varshavskoe highway 26, office 213 Site:https://rtln.ru
On Mar 3, 2023, at 9:07 AM, Yuriy Ivkin <y.ivkin@corp.rtln.ru> wrote:
Greetings Alan!
Thank you for your answer!
The next step is for you to figure out WHEN you want to send CoA packets.
Some thing like this ?
That's really not what I suggested. There is absolutely no need to *always* do "update coa", and then later say "no ,we don't need it". Policies like this are difficult to understand, and prone to errors. It is much better to figure out when you want to send CoA packets, and only then do "update coa".
if(User-Name != ""){
Which system is sending empty User-Name attributes? This is not permitted by the RFCs. This check is useless, and will do nothing. Alan DeKok.
Alan, I understood. Thank you! 03.03.2023 17:39, Alan DeKok пишет:
On Mar 3, 2023, at 9:07 AM, Yuriy Ivkin<y.ivkin@corp.rtln.ru> wrote:
Greetings Alan!
Thank you for your answer!
The next step is for you to figure out WHEN you want to send CoA packets. Some thing like this ? That's really not what I suggested.
There is absolutely no need to *always* do "update coa", and then later say "no ,we don't need it".
Policies like this are difficult to understand, and prone to errors.
It is much better to figure out when you want to send CoA packets, and only then do "update coa".
if(User-Name != ""){ Which system is sending empty User-Name attributes? This is not permitted by the RFCs.
This check is useless, and will do nothing.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
-- Best regards, Yuriy Ivkin
\ AK
On 3 Mar 2023, at 19:43, Yuriy Ivkin <y.ivkin@corp.rtln.ru> wrote:
Greetings!
After few hours of googling I think I understood. The only not clear thing: how freeradius deside to send a CoA message or not ?
Comments from sites-available/originate-coa:
# CoA packets can be originated when a normal Access-Request or # Accounting-Request packet is received. Simply update the # "coa" list: # # update coa { # &User-Name = "%{User-Name}" # &Acct-Session-Id = "%{Acct-Session-Id}" # &NAS-IP-Address = "%{NAS-IP-Address}" # } # # And the CoA packet will be sent. You can also send Disconnect # packets by using "update disconnect { ...". #
What is the "Simply update the "coa" list" means ? Changing of a site configuration in accounting section like this
update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" }
and restart service ?
Will the CoA message be generated in response for every acct request of active sessions ? That has no sense...
Yes, in this case fr will reply for every acct packet. But , for example we send disconnect only for acct-update and also checking attrs in packet( class and some others)
03.03.2023 11:33, Yuriy Ivkin пишет:
Greetings!
I am trying to understand the conception of coa server. What functionality does it brings ? Is it a some kind of proxy ?
For example, I have a NAS server with configured coa port. I can send a disconnect request directly into it. If I configure a coa server on a freeradius server, will I be able to send a disconnect request to the freeradius instead and that is all?
Thanks in advance for your answers!
-- Best regards, Yuriy Ivkin - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Anatoliy Kushner -
Yuriy Ivkin