sqlippool IP conflict problem
Hi, FreeRadius. while frame IP address to user there are three stage in sqlippool clear find update clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired. This will cause IP conflict. does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user? -- С уважением, Коньков mailto:kes-kes@yandex.ru
2011/12/20 Коньков Евгений <kes-kes@yandex.ru>:
Hi, FreeRadius.
while frame IP address to user there are three stage in sqlippool
clear find update
clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired.
That is how sqlippool works
This will cause IP conflict.
Not if you configure it correctly.
does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user?
For sqlipool to work correctly, the NAS needs to send accounting packets, and interim updates must be enabled. You'd then set sqlippool's lease-duration to a reasonable value (two times Acct-Interim-Interval would be a good choice). Follow that, and you won't have IP address conflict. -- Fajar
Здравствуйте, Fajar. Вы писали 20 декабря 2011 г., 8:30:36: FAN> 2011/12/20 Коньков Евгений <kes-kes@yandex.ru>:
Hi, FreeRadius.
while frame IP address to user there are three stage in sqlippool
clear find update
clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired.
FAN> That is how sqlippool works
This will cause IP conflict.
FAN> Not if you configure it correctly.
does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user?
FAN> For sqlipool to work correctly, the NAS needs to send accounting FAN> packets, and interim updates must be enabled. You'd then set FAN> sqlippool's lease-duration to a reasonable value (two times FAN> Acct-Interim-Interval would be a good choice). Follow that, and you FAN> won't have IP address conflict. sql/mysql/ippool.conf allocate-update = ... ... expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ I see that expire_time keep updated while radiusd will receive interim-update packets. BUT radius listen on UPD port and this mean that: no garantee that server will receive interim-update packet. So there is a chance to lose two interim packets for current user. Therefore IP leased for current user will be countered as expired and may be leased for other user causing IP conflict error. I think there must be a mechanism to force check that IP is *really* unused before freeing or 're lease' it. -- С уважением, Коньков mailto:kes-kes@yandex.ru
Здравствуйте, Коньков. Вы писали 20 декабря 2011 г., 9:22:27: КЕ> Здравствуйте, Fajar. КЕ> Вы писали 20 декабря 2011 г., 8:30:36: FAN>> 2011/12/20 Коньков Евгений <kes-kes@yandex.ru>:
Hi, FreeRadius.
while frame IP address to user there are three stage in sqlippool
clear find update
clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired.
FAN>> That is how sqlippool works
This will cause IP conflict.
FAN>> Not if you configure it correctly.
does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user?
FAN>> For sqlipool to work correctly, the NAS needs to send accounting FAN>> packets, and interim updates must be enabled. You'd then set FAN>> sqlippool's lease-duration to a reasonable value (two times FAN>> Acct-Interim-Interval would be a good choice). Follow that, and you FAN>> won't have IP address conflict. КЕ> sql/mysql/ippool.conf КЕ> allocate-update = ... КЕ> ... КЕ> expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ КЕ> I see that expire_time keep updated while radiusd will receive КЕ> interim-update packets. BUT radius listen on UPD port and this КЕ> mean that: no garantee that server will receive interim-update packet. So there КЕ> is a chance to lose two interim packets for current user. КЕ> Therefore IP leased for current user will be countered as expired and may be КЕ> leased for other user causing IP conflict error. КЕ> I think there must be a mechanism to force check that IP is *really* КЕ> unused before freeing or 're lease' it. Or may be force radius to listen TCP port. Is it possible? -- С уважением, Коньков mailto:kes-kes@yandex.ru
2011/12/20 Коньков Евгений <kes-kes@yandex.ru>:
I see that expire_time keep updated while radiusd will receive interim-update packets. BUT radius listen on UPD port and this mean that: no garantee that server will receive interim-update packet. So there is a chance to lose two interim packets for current user.
Correct.
Therefore IP leased for current user will be countered as expired and may be leased for other user causing IP conflict error.
That's why I suggested two times Acct-Interim-Interval would be a good choice. If one packet goes missing hopefully we'll be able to get the next one. If you're feeling paranoid you could use a big timeout value (e.g. 10x Acct-Interim-Interval), with the consequence that it will take longer before IP addresses used by stale sessions can be reused.
I think there must be a mechanism to force check that IP is *really* unused before freeing or 're lease' it.
It's a tradeoff, really. In theory, you COULD write your own module that verifies whether a user is online. Kinda like what simultaneous use using radutmp & checkrad does, which performs checking using snmp/telnet/ssh to the NAS. However that would inflict heavy performance penalty. It might be acceptable if you only handle (for example) 10 AAA/minute, but it won't be feasible if you need to handle 10 AAA/second. For most practical purposes, the current sqlippool is good enough. Not perfect, but good enough. -- Fajar
Здравствуйте, Fajar. Вы писали 20 декабря 2011 г., 9:37:41: FAN> 2011/12/20 Коньков Евгений <kes-kes@yandex.ru>:
I see that expire_time keep updated while radiusd will receive interim-update packets. BUT radius listen on UPD port and this mean that: no garantee that server will receive interim-update packet. So there is a chance to lose two interim packets for current user.
FAN> Correct.
Therefore IP leased for current user will be countered as expired and may be leased for other user causing IP conflict error.
FAN> That's why I suggested two times Acct-Interim-Interval would be a good FAN> choice. If one packet goes missing hopefully we'll be able to get the FAN> next one. If you're feeling paranoid you could use a big timeout value FAN> (e.g. 10x Acct-Interim-Interval), with the consequence that it will FAN> take longer before IP addresses used by stale sessions can be reused. I have Acct-Interim-Interval = 300 And I have script that ckeck zombie sessions once per 15min Date: Sun, 18 Dec 2011 21:15:01 +0000 (UTC) $VAR1 = [ { 'NASPORT' => 193, 'ID' => 1221104, 'USERNAME' => '10228', 'TERMINATECAUSE' => 'OnLine', 'FRAMEDIPADDRESS' => '192.168.16.195', 'SESSIONID' => 'dfe6caf212e8f842', 'BILL' => undef, 'BYTESOUT' => '53208742', 'STARTTIME' => '2011-12-18 19:02:49', 'CALLTO' => '10.5.0.17', 'STOPTIME' => '2011-12-18 20:49:03', 'BYTESIN' => '9158505', 'CALLFROM' => '10.7.30.58 / 00:24:54:5d:1a:b5 / vlan76', 'ONLINETIME' => 6375 } ]; It check 'OnLine' and STOPTIME more that 15min (3times AcctInterimInterval) As you see 20:49:03 was last acct-interim-interval was received script was runned at 21:15:01 so 25min are passed from last AcctInterimInterval it is 5times. Per day I get about from 5 to 10 such sessions. It is noising ( NAS server and freeradius both are on localhost and there is about 50%Idle on CPU there are about 200-300users online with 5min acctInterimInterval. Is it possible to force FreeRadius to listen on TCP port?
I think there must be a mechanism to force check that IP is *really* unused before freeing or 're lease' it.
FAN> It's a tradeoff, really. In theory, you COULD write your own module FAN> that verifies whether a user is online. Kinda like what simultaneous FAN> use using radutmp & checkrad does, which performs checking using FAN> snmp/telnet/ssh to the NAS. However that would inflict heavy FAN> performance penalty. It might be acceptable if you only handle (for FAN> example) 10 AAA/minute, but it won't be feasible if you need to handle FAN> 10 AAA/second. FAN> For most practical purposes, the current sqlippool is good enough. Not FAN> perfect, but good enough. -- С уважением, Коньков mailto:kes-kes@yandex.ru
2011/12/20 Коньков Евгений <kes-kes@yandex.ru>:
I have Acct-Interim-Interval = 300 And I have script that ckeck zombie sessions once per 15min
Does it also remove the zombie sessions? If yes, set lease-duration = 900 on your sqlippool.conf.
NAS server and freeradius both are on localhost and there is about 50%Idle on CPU there are about 200-300users online with 5min acctInterimInterval.
Is it possible to force FreeRadius to listen on TCP port?
No. That's not how radius work. There's radsec, but I doubt your NAS supports it. Lost accounting packets are common, even in big carriers. Configure your system to deal with it properly. -- Fajar
participants (2)
-
Fajar A. Nugraha -
Коньков Евгений