misbehaving nas's send accounting to both primary and secondary servers
What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries. This results in multiple accounting records in sql, with duplicate acctsessionid and acctuniqueid values. Assuming the NAS cannot be properly configured, either for technical or other reasons, these are the potential options. - configure only one of the primary or secondary on the NAS - get the server to recognize the existing record and update it instead of inserting a new one Now there is account_start_query_alt, but that appears to only be called if the account_start_query fails. With the default mysql schema, I dont think there is anything to cause that query to ever fail. Tips and advice are greatly appreciated. Thanks, Joe
Joe Maimon wrote:
What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries.
Throw it away, and buy a real NAS. I guess I should learn to *not* be shocked by how bad the NAS equipment is.
This results in multiple accounting records in sql, with duplicate acctsessionid and acctuniqueid values.
The NAS sends *different* Acct-Session-Id values for the same session? It's definitely a piece of garbage. What the heck would it do if it failed over from one RADIUS server to another? Change the session Id?
Assuming the NAS cannot be properly configured, either for technical or other reasons, these are the potential options.
- configure only one of the primary or secondary on the NAS
That MIGHT work. See above.
- get the server to recognize the existing record and update it instead of inserting a new one
What are the contents of the accounting packets? How could you use those contents to determine that two packets were about the "same" session? i.e. post some packet contents here. Odds are that you can look at NAS-IP-Address, NAS-Port, and maybe User-Name. If those all match, odds are it's for the same session, even if Acct-Session-Id is different.
Now there is account_start_query_alt, but that appears to only be called if the account_start_query fails.
With the default mysql schema, I dont think there is anything to cause that query to ever fail.
Tips and advice are greatly appreciated.
Tell the NAS vendor that their product is horrible. Get THEM to fix the problem. Having all of their customers deploy "work-arounds" just encourages idiots. If all of their customers called, complained, and threatened to return the equipment, you can bet it would get fixed in a hurry. Alan DeKok.
Alan DeKok wrote:
Joe Maimon wrote:
What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries.
Throw it away, and buy a real NAS.
The customer uses this nas for a product that is in its endoflife. It has been in place for quite some time. Previously, this "feature" was unwittingly used to have accounting sent to two different unrelated systems, where it was needed on both. So long as it works, there will be no more capital investments, which have been investigated to an extent.
I guess I should learn to *not* be shocked by how bad the NAS equipment is.
The nas has a concept of server groups, primary and secondary. Each group can be configured with up to three ip address destination/ports/secrets. However, failover when using just one group seems to be problematic. On the other hand, with both server groups enabled, duplicate accounting.
This results in multiple accounting records in sql, with duplicate acctsessionid and acctuniqueid values.
The NAS sends *different* Acct-Session-Id values for the same session?
No, those values are identical. Two rows in mysql are created with those identical values.
It's definitely a piece of garbage. What the heck would it do if it failed over from one RADIUS server to another? Change the session Id?
I think it could use a software update. Unfortunately, I cant find anywhere anyone offering official support, product line was sold, discontinued, it is EOL, something.
Assuming the NAS cannot be properly configured, either for technical or other reasons, these are the potential options.
- configure only one of the primary or secondary on the NAS
That MIGHT work. See above.
It would work fine, and since this setup uses anycast (sticky) not lose all that much in the way of redundancy. Its more or less how it is setup now - but I dont like it. The device is a 3com hiper arc, used for analog modem dialup.
- get the server to recognize the existing record and update it instead of inserting a new one
What are the contents of the accounting packets? How could you use those contents to determine that two packets were about the "same" session?
No, each server gets ONE start packet.
i.e. post some packet contents here. Odds are that you can look at NAS-IP-Address, NAS-Port, and maybe User-Name. If those all match, odds are it's for the same session, even if Acct-Session-Id is different.
They are the same.
Now there is account_start_query_alt, but that appears to only be called if the account_start_query fails.
With the default mysql schema, I dont think there is anything to cause that query to ever fail.
Tips and advice are greatly appreciated.
Tell the NAS vendor that their product is horrible. Get THEM to fix the problem.
Having all of their customers deploy "work-arounds" just encourages idiots. If all of their customers called, complained, and threatened to return the equipment, you can bet it would get fixed in a hurry.
Alan DeKok.
I agree with you but that time has passed, at least for this equipment. I suppose my question is when and how is the account_start_query_alt used, and can I use that to prevent duplicate accounting rows in sql?
What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries.
Throw it away, and buy a real NAS.
The customer uses this nas for a product that is in its endoflife. It has been in place for quite some time. Previously, this "feature" was unwittingly used to have accounting sent to two different unrelated systems, where it was needed on both.
So long as it works, there will be no more capital investments, which have been investigated to an extent.
Well, it doesn't work. At least not properly.
i.e. post some packet contents here. Odds are that you can look at NAS-IP-Address, NAS-Port, and maybe User-Name. If those all match, odds are it's for the same session, even if Acct-Session-Id is different.
They are the same.
Yes, because same packet was sent to two different servers.
With the default mysql schema, I dont think there is anything to cause that query to ever fail.
Tips and advice are greatly appreciated.
Break it than. Make AcctUniqueId unique: ALTER TABLE `radacct` ADD UNIQUE (`AcctUniqueId`) That should disable duplicated INSERT.
I suppose my question is when and how is the account_start_query_alt used, and can I use that to prevent duplicate accounting rows in sql?
Yes, when the INSERT fails, alt query (UPDATE) will be executed. It won't change a thing, but since you can't stop it (ie. NAS is junk) ... Ivan Kalik Kalik Informatika ISP
What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries.
First make sure that this is so. Debug accounting on the NAS. NAS should send several packets to first radius server before it fails over to second one. If debug does show NAS is getting replies from the first server see why are they ignored. It could be that you have configured radius server on the NAS with one IP address and server is replying from another (if it is multihomed). Such replies would be ignored. Ivan Kalik Kalik Informatika ISP
Ivan Kalik wrote:
What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries.
First make sure that this is so. Debug accounting on the NAS. NAS should send several packets to first radius server before it fails over to second one. If debug does show NAS is getting replies from the first server see why are they ignored. It could be that you have configured radius server on the NAS with one IP address and server is replying from another (if it is multihomed). Such replies would be ignored.
Ivan Kalik Kalik Informatika ISP
Packet captures show everything fine. The nas is no longer supported by any manufacturer I can find. The documentation refers to a setting that can be used to tell the nas to use both accounting server groups or one, but that setting doesnt exist on this nas, perhaps software revision or something.
participants (3)
-
Alan DeKok -
Ivan Kalik -
Joe Maimon