Proxy and copy-acct-to-home-server
Hello List, I am redoing our radius setup into FreeRadius 2.0.4 and I need some advise. Lets say I have 3 FreeRadius servers (A,B,C) and I would like to sync the accounting packet between them. On server A, I created copy-acct-to-home-server for B and C; On server B, I created copy-acct-to-home-server for A and C; On server C, I created copy-acct-to-home-server for A and B; Now in proxy.conf.... i need to define home_servers: On server A, created home_server B and home_server C (type=acct); On server B, created home_server A and home_server C (type=acct); On server C, created home_server A and home_server B (type=acct); But now on server_pool I seem to have an issue, I desire that A only sends copies to B and C - while B and C do not send those packets back to A or to each other respectively. Like wise with the other two servers ( ie when one of the servers I administer proxies a packet, the receiver should not proxy it any further ). How would I define this? Would I need one home_server_pool with both home_servers defined, but defined with what "type="? Mind if I use multiple pools then I need both in each of my realm statements... is that even allowed. Sorry for the vagueness... any assistance would be great Kind Regards, Etienne
Etienne Pretorius wrote:
Lets say I have 3 FreeRadius servers (A,B,C) and I would like to sync the accounting packet between them.
On server A, I created copy-acct-to-home-server for B and C; On server B, I created copy-acct-to-home-server for A and C; On server C, I created copy-acct-to-home-server for A and B; ... I desire that A only sends copies to B and C - while B and C do not send those packets back to A or to each other respectively. Like wise with the other two servers ( ie when one of the servers I administer proxies a packet, the receiver should not proxy it any further ).
Yes, that makes sense.
How would I define this? Would I need one home_server_pool with both home_servers defined, but defined with what "type="?
Read the documentation on "type" for home_server_pools. There is nothing that fits what you want.
Mind if I use multiple pools then I need both in each of my realm statements... is that even allowed.
No. What you need is a simple rule: if NOT from (other two servers) copy to other two servers e.g. if ((Packet-Src-IP-Address != A) && (Packet-Src-IP-Address != B)) { copy-acct-to-home-server-A copy-acct-to-home-server-B } Alan DeKok.
Alan DeKok wrote:
What you need is a simple rule:
if NOT from (other two servers) copy to other two servers
e.g.
if ((Packet-Src-IP-Address != A) && (Packet-Src-IP-Address != B)) { copy-acct-to-home-server-A copy-acct-to-home-server-B }
Alan DeKok.
Thank you Alan, but would I place this in acct_users? You see as I see how this approach works is that the detail (detail-B, detail-C) files are created and filled up with contents from server instance-A. While the detail-reader-B and detail-reader-C are based from copy-acct-to-home-server. (So I see now how the packets enter back into the server, but how to configure the server to send detail-B's contents to server B and likewise with C is where I am having trouble..) Some guidance will be appreciated.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Etienne Pretorius wrote:
Thank you Alan, but would I place this in acct_users?
No. In the pre-acct section. See "man unlang" for documentation.
You see as I see how this approach works is that the detail (detail-B, detail-C) files are created and filled up with contents from server instance-A.
Yes...
While the detail-reader-B and detail-reader-C are based from copy-acct-to-home-server.
Yes.
(So I see now how the packets enter back into the server, but how to configure the server to send detail-B's contents to server B and likewise with C is where I am having trouble..)
You can configure a virtual server per listener. (i.e. detail file reader). In that, just force proxying in pre-acct: update control { Proxy-To-Realm := "B" } Alan DeKok.
Alan, Could you please tell me what attributes I should use in the Accounting section to achieve the following: if ((Packet-Src-IP-Address != A) && (Packet-Src-IP-Address != B)) { copy-acct-to-home-server-A copy-acct-to-home-server-B } I have tried Client-IP-Address, and it does not get resolved. Etienne
Etienne Pretorius wrote:
Could you please tell me what attributes I should use in the Accounting section to achieve the following:
if ((Packet-Src-IP-Address != A) && (Packet-Src-IP-Address != B)) { copy-acct-to-home-server-A copy-acct-to-home-server-B }
I had hoped that was relatively clear. The "Packet-Src-IP-Address" is the source IP of the packet... i.e. the client's IP address.
I have tried Client-IP-Address, and it does not get resolved.
Why did you try that? Alan DeKok.
Alan DeKok wrote:
Etienne Pretorius wrote:
Could you please tell me what attributes I should use in the Accounting section to achieve the following:
if ((Packet-Src-IP-Address != A) && (Packet-Src-IP-Address != B)) { copy-acct-to-home-server-A copy-acct-to-home-server-B }
I had hoped that was relatively clear. The "Packet-Src-IP-Address" is the source IP of the packet... i.e. the client's IP address.
Forgive me for my ignorance, but I tried to change it because when I was looking at the debug information this stood out: expand: %{control:Packet-Src-IP-Address} -> ?? Evaluating ("%{control:Packet-Src-IP-Address}" != "XXX.XXX.XXX.XXX") -> TRUE OR when I took the condition verbatim from you: +- entering group accounting ++? if ((Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX")) (Attribute Packet-Src-IP-Address was not found) And well I was trying to find out where an accounting loop was occurring... and all my radrelayed data was entering this section that I wanted to exclude
I have tried Client-IP-Address, and it does not get resolved.
Why did you try that?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Etienne Pretorius wrote:
expand: %{control:Packet-Src-IP-Address} -> ?? Evaluating ("%{control:Packet-Src-IP-Address}" != "XXX.XXX.XXX.XXX")
That isn't what I suggested.
-> TRUE
OR when I took the condition verbatim from you:
+- entering group accounting ++? if ((Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX")) (Attribute Packet-Src-IP-Address was not found)
Which version are you running? That *should* work in recent versions.
And well I was trying to find out where an accounting loop was occurring... and all my radrelayed data was entering this section that I wanted to exclude
Yes... key off of the source IP, and write the packets to the "detail" file for proxying ONLY when they come from the local NASes. Alan DeKok.
Alan DeKok wrote:
Etienne Pretorius wrote:
expand: %{control:Packet-Src-IP-Address} -> ?? Evaluating ("%{control:Packet-Src-IP-Address}" != "XXX.XXX.XXX.XXX")
That isn't what I suggested.
-> TRUE
OR when I took the condition verbatim from you:
+- entering group accounting ++? if ((Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX")) (Attribute Packet-Src-IP-Address was not found)
Which version are you running? That *should* work in recent versions.
FreeRadius 2.0.4 Distro: Debian Stable (lenny)
And well I was trying to find out where an accounting loop was occurring... and all my radrelayed data was entering this section that I wanted to exclude
Yes... key off of the source IP, and write the packets to the "detail" file for proxying ONLY when they come from the local NASes.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan DeKok wrote:
Etienne Pretorius wrote:
FreeRadius 2.0.4 Distro: Debian Stable (lenny)
Upgrade.
Alan, Thank you for your help. Will do... starting upgrade.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Etienne Pretorius wrote:
Alan DeKok wrote:
Etienne Pretorius wrote:
FreeRadius 2.0.4 Distro: Debian Stable (lenny)
Upgrade.
Alan, Thank you for your help. Will do... starting upgrade. Upgraded to FreeRadius 2.1.8 Distro: Debian Testing (Sid)
Same error: +- entering group accounting ++? if ((Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX") && (Packet-Src-IP-Address != "XXX.XXX.XXX.XXX")) (Attribute Packet-Src-IP-Address was not found)
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Etienne Pretorius