couldn't reconnect to the home server
Hi All, I have configured freeradius 3.0.19 as proxy server which forwards radius accounting packets to specific home servers based on NAS IP. The problem I am having is once the connectivity to the home server goes down, the radius proxy can not reestablish the connection to the home server. If I delete detail and detail.work files and restart the freeradius service everything starts working well. I was wondering if I am missing something in configuration that is causing this problem. Here is the log detail (/var/log/freeradius/radacct/detail): Read packet from /var/log/freeradius/radacct/detail.work Acct-Session-Id = "5D8840F4-8E040D01" Framed-IP-Address = 192.168.0.1 Acct-Multi-Session-Id = "3087d99a131824da33a490c45d8840f5000d" Acct-Link-Count = 1 Acct-Status-Type = Interim-Update Acct-Authentic = RADIUS User-Name = "abcd@abcd.co.nz" NAS-IP-Address = 10.0.0.10 NAS-Identifier = "30-8D-D9-9D-13-18" NAS-Port = 1 Called-Station-Id = "30-8D-D9-9D-13-18:ABC" Calling-Station-Id = "24-DD-33-44-90-CA" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11b/g/n" Event-Timestamp = "Sep 23 2019 16:15:14 NZST" Class = 0x436f6e74656e7446696c7465722d4a6e7253747564656e74 Ruckus-SSID = "ABC" Ruckus-BSSID = 0x308dd99d1318 Ruckus-VLAN-ID = 999 Ruckus-SCG-CBlade-IP = 167837962 Ruckus-SCG-DBlade-IP = 167838210 Acct-Input-Packets = 41552 Acct-Output-Packets = 100454 Acct-Input-Octets = 3768396 Acct-Output-Octets = 130474153 Ruckus-Sta-RSSI = 50 Acct-Session-Time = 1500 Proxy-State = 0x3338 Huntgroup-Name = "NEWFortigateRealm" SQL-User-Name = "abcd@abcd.co.nz" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "58e58a8fd7fbccadf08241d278e4d940" Packet-Original-Timestamp = "Sep 23 2019 16:16:32 NZST" Acct-Delay-Time = 65240 Packet-Transmit-Counter = 2172 (38207) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/copy-acct-to-home-server (38207) preacct { (38207) [preprocess] = ok (38207) if (request:User-Name =~ /@/){ (38207) if (request:User-Name =~ /@/) -> TRUE (38207) if (request:User-Name =~ /@/) { (38207) if (request:Huntgroup-Name != ''){ (38207) if (request:Huntgroup-Name != '') -> TRUE (38207) if (request:Huntgroup-Name != '') { (38207) update control { (38207) Proxy-To-Realm := request:Huntgroup-Name -> 'NEWFortigateRealm' (38207) } # update control = noop (38207) } # if (request:Huntgroup-Name != '') = noop (38207) } # if (request:User-Name =~ /@/) = noop (38207) } # preacct = ok (38207) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/copy-acct-to-home-server (38207) accounting { (38207) [ok] = ok (38207) } # accounting = ok (38207) ERROR: Failed to find live home server: Cancelling proxy (38207) WARNING: No home server selected (38207) Clearing existing &reply: attributes (38207) Found Post-Proxy-Type Fail-Accounting (38207) Post-Proxy-Type sub-section not found. Ignoring. (38207) detail (/var/log/freeradius/radacct/detail): No response to request. Will retry in 30 seconds (38207) Finished request (38207) Cleaning up request packet ID 23 with timestamp +339624 Waking up in 6.1 seconds. No response to status check 38206 ID 139 for home server xx.xx.xx.xx port 1813 Waking up in 1.5 seconds. PING: Waiting 10 seconds for response to ping (38208) Sent Status-Server Id 97 from 0.0.0.0:49764 to xx.xx.xx.xx:1813 length 0 (38208) Message-Authenticator := 0x00 (38208) NAS-Identifier := "Status Check 6430. Are you alive?" PING: Next status packet in 10 seconds Waking up in 9.5 seconds. PING: Waiting 10 seconds for response to ping (38209) Sent Status-Server Id 119 from 0.0.0.0:49764 to xx.xx.xx.xx:1813 length 0 (38209) Message-Authenticator := 0x00 (38209) NAS-Identifier := "Status Check 6431. Are you alive?" PING: Next status packet in 10 seconds Waking up in 0.4 seconds. No response to status check 38208 ID 97 for home server 210.55.219.165 port 1813 Waking up in 9.5 seconds. -- Kind Regards Prem
On Sep 23, 2019, at 7:34 PM, Prem Khanal <prem.khanal@n4l.co.nz> wrote:
I have configured freeradius 3.0.19 as proxy server which forwards radius accounting packets to specific home servers based on NAS IP. The problem I am having is once the connectivity to the home server goes down, the radius proxy can not reestablish the connection to the home server.
See the documentation in proxy.conf.
If I delete detail and detail.work files and restart the freeradius service everything starts working well. I was wondering if I am missing something in configuration that is causing this problem.
You've configured the server to do status checks:
No response to status check 38206 ID 139 for home server xx.xx.xx.xx port 1813 Waking up in 1.5 seconds. PING: Waiting 10 seconds for response to ping (38208) Sent Status-Server Id 97 from 0.0.0.0:49764 to xx.xx.xx.xx:1813 length 0 (38208) Message-Authenticator := 0x00 (38208) NAS-Identifier := "Status Check 6430. Are you alive?" PING: Next status packet in 10 seconds Waking up in 9.5 seconds. PING: Waiting 10 seconds for response to ping (38209) Sent Status-Server Id 119 from 0.0.0.0:49764 to xx.xx.xx.xx:1813 length 0 (38209) Message-Authenticator := 0x00 (38209) NAS-Identifier := "Status Check 6431. Are you alive?" PING: Next status packet in 10 seconds Waking up in 0.4 seconds. No response to status check 38208 ID 97 for home server 210.55.219.165 port 1813
The home server isn't responding to status checks, so FreeRADIUS thinks it's still dead. Make the home server respond to status checks. Or, configure Access-Request status checks. Or, disable status checks completely. This is all documented in proxy.conf. Alan DeKok.
participants (2)
-
Alan DeKok -
Prem Khanal