Replicated Acctounting blocks replys
Hi, I need a configuration that works as follows regarding accounting data: NAS sends Accounting Request ->radius svr1 radius svr1 writes to acct db and sends Accounting Request -> radius svr2 radius svr1 sends Accounting Response back to NAS Using my current configuration, I have defined a home server for the NULL realm and in the accounting section of sites-enabled/default, I have added "replicate" This sort of works, but when the response comes from radius svr2, it is rejected by radius svr1, I believe because "replicate" is fire and forget. In any case, an Accounting Response is never sent back to the NAS so the NAS tries to start the process over. I don't require an ACK response from svr2 to svr1, but I do need a response from svr1 to the NAS. Is replicate the right way to go? Freeradius version=radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu sites-enabled/default (acct sections) ----- preacct { preprocess update control { Replicate-To-Realm := 'NULL' } acct_unique suffix files } accounting { sql replicate } proxy.conf -------------- home_server sv { type = acct ipaddr = 10.101.248.112 port = 1813 secret = testing123 require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool sv_pool { type = fail-over home_server = sv } realm LOCAL { } realm NULL { acct_pool = sandvine_pool }
On 2 May 2014, at 23:13, Dalton Porter <daltonporter@yahoo.com> wrote:
Hi, I need a configuration that works as follows regarding accounting data:
NAS sends Accounting Request ->radius svr1 radius svr1 writes to acct db and sends Accounting Request -> radius svr2 radius svr1 sends Accounting Response back to NAS
Using my current configuration, I have defined a home server for the NULL realm and in the accounting section of sites-enabled/default, I have added "replicate"
This sort of works, but when the response comes from radius svr2, it is rejected by radius svr1, I believe because "replicate" is fire and forget.
If by rejected do you mean completely ignored? If so, yes that's expected behaviour.
In any case, an Accounting Response is never sent back to the NAS so the NAS tries to start the process over.
Provide debug.
I don't require an ACK response from svr2 to svr1, but I do need a response from svr1 to the NAS.
Is replicate the right way to go?
To a Sandvine DPI box, sure. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Dalton Porter wrote:
NAS sends Accounting Request ->radius svr1 radius svr1 writes to acct db and sends Accounting Request -> radius svr2 radius svr1 sends Accounting Response back to NAS
Are you sure? What does debug mode say?
Using my current configuration, I have defined a home server for the NULL realm and in the accounting section of sites-enabled/default, I have added "replicate"
This sort of works, but when the response comes from radius svr2, it is rejected by radius svr1, I believe because "replicate" is fire and forget.
If you ran the server in debugging mode, you would see the *exact* error. It's important to see the exact error, rather than saying some imprecise summary.
In any case, an Accounting Response is never sent back to the NAS so the NAS tries to start the process over.
And if you run the server in debugging mode, you'll see why.
Freeradius version=radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu
sites-enabled/default (acct sections)
None of which is relevant. The FAQ, "man" page, web pages, and daily messages on this list say to run the server in debug mode. Why aren't you doing that? The answers are almost always in the debug output. It boggles my mind why people are so opposed to looking at it. Alan DeKok.
I solved this issue with some prompting from Allen. This is what I wanted NAS send acct req to radius R1 R1 replicate acct req to R2 R1 respond to NAS I simply could not get R1 to respond to the NAS when the replicate was in the configuration, so the NAS would continue to send acct req packets to R1 and after a few trys, mark R1 as down. It appears to be an issue with freeradius-2.1.12. Upgrading to 2.2.4 seems to have fixed the issue. Here are some details for those interested. I make no claims about this being the best way, it's just "a way". Building a 2.2.4 rpm for my version of centos was a bit of trouble as well. I followed this and got it done: http://adriansmith.blogspot.co.uk/2014/01/building-freeradius-rpm-for-el5.ht... Follow the instructions but change the version and release in the spec file to values that match your freeradius source rpm. I had to add one additional step which was to add this line to the spec file: %config(noreplace) /etc/raddb/panic.gdb To configure radius to do a replicate (fire and forget) to an accounting server: in sites-enabled/default in the accounting { } section, add update control and replicate items like this: # daily update control { Replicate-to-Realm='Acct2' } replicate # Update the wtmp file in proxy.conf, define a home_server, a pool, and a realm as follows (use your IP and password values) home_server_acct2 { type = acct ipaddr = 10.10.1.1 port = 1813 secret = testing123 # src_ipaddr = 127.0.0.1 require_message_authenticator = yes response_window = 20 # no_response_fail = no zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool acct2_pool { type = fail-over home_server = acct2 } realm Acct2 { acct_pool = acct2_pool }
Alan, I did run in debugging mode. I didn't notice any error. I'm attaching here in case I have missed something. Attaching debug. NAS=10.106.1.45 radius svr 2 = 10.101.248.112 What I see is after the Access Req/Resp, the NAS keeps sending Accounting Reqs. Looking at tcpdump, I can see the Acct Response packet makes it from svr2 to srv1, but there is an ICMP port not reachable, which I interpret to mean svr1 is not listening on that port (expected because replicate is fire and forget) But then why doesn't svr1 respond to the NAS with an Accounting Response? It fails to do so, so in a few sec, the NAS sends another accounting req. This cycle repeats a few times - sometimes NAS just won't give up. rad_recv: Access-Request packet from host 10.106.1.45 port 35711, id=121, length=191 User-Name = "QAQAQA_00" User-Password = "testing" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" NAS-IP-Address = 10.106.1.45 Cisco-AVPair = "ip:source-ip=96.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "QAQAQA_00", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "QAQAQA_00" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> QAQAQA_00 [sql] sql_set_user escaped user --> 'QAQAQA_00' rlm_sql (sql): Reserving sql socket id: 19 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'QAQAQA_00' ORDER BY id [sql] User found in radcheck table [sql] expand: <snip> [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'QAQAQA_00' ORDER BY priority rlm_sql (sql): Released sql socket id: 19 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 121 to 10.106.1.45 port 35711 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Address := 172.24.0.1 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 10.106.1.45 port 57645, id=122, length=185 User-Name = "QAQAQA_00" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.24.0.1 Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" Acct-Status-Type = Start Acct-Delay-Time = 0 Acct-Session-Id = "7B600012" Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 Vendor-3076-Attr-151 = 0x00000005 NAS-IP-Address = 10.106.1.45 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok ++[control] returns ok [acct_unique] Hashing 'NAS-Port = 77824,Client-IP-Address = 10.106.1.45,NAS-IP-Address = 10.106.1.45,Acct-Session-Id = "7B600012",User-Name = "QAQAQA_00"' [acct_unique] Acct-Unique-Session-ID = "252b24a78b654e27". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "QAQAQA_00", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "QAQAQA_00" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user QAQAQA_00 to realm NULL [suffix] Preparing to proxy accounting request to realm "NULL" ++[suffix] returns updated ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [sql] expand: %{User-Name} -> QAQAQA_00 [sql] sql_set_user escaped user --> 'QAQAQA_00' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct... <snip> rlm_sql (sql): Reserving sql socket id: 18 rlm_sql (sql): Released sql socket id: 18 ++[sql] returns ok [replicate] Replicating packet to Realm NULL Sending Accounting-Request of id 114 to 10.101.248.112 port 1813 User-Name = "QAQAQA_00" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.24.0.1 Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" Acct-Status-Type = Start Acct-Delay-Time = 0 Acct-Session-Id = "7B600012" Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 Vendor-3076-Attr-151 = 0x00000005 NAS-IP-Address = 10.106.1.45 ++[replicate] returns ok Finished request 1. Cleaning up request 1 ID 122 with timestamp +18 Going to the next request Waking up in 3.7 seconds. Cleaning up request 0 ID 121 with timestamp +17 Ready to process requests. rad_recv: Accounting-Request packet from host 10.106.1.45 port 57645, id=123, length=185 User-Name = "QAQAQA_00" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.24.0.1 Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" Acct-Status-Type = Start Acct-Delay-Time = 5 Acct-Session-Id = "7B600012" Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 Vendor-3076-Attr-151 = 0x00000005 NAS-IP-Address = 10.106.1.45 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok ++[control] returns ok [acct_unique] Hashing 'NAS-Port = 77824,Client-IP-Address = 10.106.1.45,NAS-IP-Address = 10.106.1.45,Acct-Session-Id = "7B600012",User-Name = "QAQAQA_00"' [acct_unique] Acct-Unique-Session-ID = "252b24a78b654e27". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "QAQAQA_00", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "QAQAQA_00" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user QAQAQA_00 to realm NULL [suffix] Preparing to proxy accounting request to realm "NULL" ++[suffix] returns updated ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [sql] expand: %{User-Name} -> QAQAQA_00 [sql] sql_set_user escaped user --> 'QAQAQA_00' [sql] expand: %{Acct-Delay-Time} -> 5 [sql] expand: INSERT INTO radacct ...<snip> rlm_sql (sql): Reserving sql socket id: 17 rlm_sql (sql): Released sql socket id: 17 ++[sql] returns ok [replicate] Replicating packet to Realm NULL Sending Accounting-Request of id 118 to 10.101.248.112 port 1813 User-Name = "QAQAQA_00" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.24.0.1 Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" Acct-Status-Type = Start Acct-Delay-Time = 5 Acct-Session-Id = "7B600012" Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 Vendor-3076-Attr-151 = 0x00000005 NAS-IP-Address = 10.106.1.45 ++[replicate] returns ok Finished request 2. Cleaning up request 2 ID 123 with timestamp +23 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 10.106.1.45 port 57645, id=124, length=185 User-Name = "QAQAQA_00" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.24.0.1 Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" Acct-Status-Type = Start Acct-Delay-Time = 10 Acct-Session-Id = "7B600012" Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 Vendor-3076-Attr-151 = 0x00000005 NAS-IP-Address = 10.106.1.45 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok ++[control] returns ok [acct_unique] Hashing 'NAS-Port = 77824,Client-IP-Address = 10.106.1.45,NAS-IP-Address = 10.106.1.45,Acct-Session-Id = "7B600012",User-Name = "QAQAQA_00"' [acct_unique] Acct-Unique-Session-ID = "252b24a78b654e27". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "QAQAQA_00", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "QAQAQA_00" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user QAQAQA_00 to realm NULL [suffix] Preparing to proxy accounting request to realm "NULL" ++[suffix] returns updated ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [sql] expand: %{User-Name} -> QAQAQA_00 [sql] sql_set_user escaped user --> 'QAQAQA_00' [sql] expand: %{Acct-Delay-Time} -> 10 [sql] expand: INSERT INTO radacct ...<snip> rlm_sql (sql): Reserving sql socket id: 16 rlm_sql (sql): Released sql socket id: 16 ++[sql] returns ok [replicate] Replicating packet to Realm NULL Sending Accounting-Request of id 122 to 10.101.248.112 port 1813 User-Name = "QAQAQA_00" NAS-Port = 77824 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.24.0.1 Called-Station-Id = "XX.25.104.52" Calling-Station-Id = "XX.226.96.135" Acct-Status-Type = Start Acct-Delay-Time = 10 Acct-Session-Id = "7B600012" Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "XX.226.96.135" Vendor-3076-Attr-146 = 0x4d6f62696c65587072657373696f6e Vendor-3076-Attr-150 = 0x00000001 Vendor-3076-Attr-151 = 0x00000005 NAS-IP-Address = 10.106.1.45 ++[replicate] returns ok Finished request 3. Cleaning up request 3 ID 124 with timestamp +28 Going to the next request Ready to process requests.
Dalton Porter wrote:
Alan, I did run in debugging mode. I didn't notice any error. I'm attaching here in case I have missed something.
That's really the point.
Attaching debug. NAS=10.106.1.45 radius svr 2 = 10.101.248.112 What I see is after the Access Req/Resp, the NAS keeps sending Accounting Reqs.
You'll also see that FreeRADIUS doesn't reply/
Looking at tcpdump, I can see the Acct Response packet makes it from svr2 to srv1, but there is an ICMP port not reachable, which I interpret to mean svr1 is not listening on that port (expected because replicate is fire and forget)
OK.
But then why doesn't svr1 respond to the NAS with an Accounting Response?
Because it's been misconfigured. The default configuration has the server respond to Accounting-Request packets. If it doesn't respond, it's usually because you edited something, and broke it. Or, it's because there's a bug in 2.1.12. Which is many years old. Upgrade to 2.2.5.
It fails to do so, so in a few sec, the NAS sends another accounting req. This cycle repeats a few times - sometimes NAS just won't give up.
Which is what the NAS is supposed to do for accounting packets.
++[replicate] returns ok Finished request 3. Cleaning up request 3 ID 124 with timestamp +28
i.e. it doesn't send an Accounting-Response. THAT is the source of the problem. I suggest just upgrading. Alan DeKok.
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Dalton Porter