Freeradius not releasing IPs from pool
Hello, I have a problem with my pools in freeradius. The problems is that it is not releasing IPs from the pools. At least, not all of them, so after a while my users can't connect because the pool is full. I check that it is not releasing IPs because I get (I have replaced usernames with XXXX): root@vulpes21:/usr/share/doc/freeradius# radwho | grep 155.54.194 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:28 155.54.213.20 155.54.194.128 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:36 155.54.213.20 155.54.194.51 XXXXXXXX XXXXXXXXX PPP >999 Wed 10:42 155.54.213.20 155.54.194.8 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:33 155.54.213.20 155.54.194.115 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:37 155.54.213.20 155.54.194.101 XXXXXXXX XXXXXXXXX PPP >999 Wed 12:40 155.54.213.20 155.54.194.62 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:06 155.54.213.20 155.54.194.92 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:11 155.54.213.20 155.54.194.48 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:24 155.54.213.20 155.54.194.78 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:27 155.54.213.20 155.54.194.112 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:28 155.54.213.20 155.54.194.59 XXXXXXXX XXXXXXXXX PPP >999 Wed 13:29 155.54.213.20 155.54.194.134 but rlm_ippol_tool shows a lot of IP addresses in use: root@vulpes21:/etc/freeradius# rlm_ippool_tool -a pool_vpn.ippool pool_vpn.ipindex | wc -l 122 In my configuration I have: authorize { vpn_log vpn_syslog suffix files_vpn pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap-email } } preacct { suffix files_vpn } accounting { vpn_log unix pool_vpn pool_vpn_alu pool_vpn_ryt radutmp vpn_acc_syslog sql_log_um } session { } post-auth { pool_vpn pool_vpn_alu pool_vpn_ryt vpn_log vpn_syslog } pre-proxy { } post-proxy { } Any idea? Ah... I'm running 2.1.8 from ubuntu 10.04. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337
On 06/01/2011 04:02 PM, Angel L. Mateo wrote:
Hello,
I have a problem with my pools in freeradius. The problems is that it is not releasing IPs from the pools. At least, not all of them, so after a while my users can't connect because the pool is full.
Several quick questions: 1. Are you sure your pool is large enough? Average duration of a session/Number of new sessions per second should be taken in account. 2. Are you sure you don't miss any accounting messages? 3. Which attributes do you use to construct a pool key? Make sure all attributes exist in Accounting messages. Best Regards, George Chelidze
El 03/06/11 10:33, George Chelidze escribió:
On 06/01/2011 04:02 PM, Angel L. Mateo wrote:
Hello,
I have a problem with my pools in freeradius. The problems is that it is not releasing IPs from the pools. At least, not all of them, so after a while my users can't connect because the pool is full.
Several quick questions:
1. Are you sure your pool is large enough? Average duration of a session/Number of new sessions per second should be taken in account.
Yes. This server is an update from an existing one with the same configuration, the only difference is freeradius versions (from 1.1.7 to 2.1.8) and that now I'm using virtual servers.
2. Are you sure you don't miss any accounting messages?
I think not.
3. Which attributes do you use to construct a pool key? Make sure all attributes exist in Accounting messages.
The defaults, I'm not using the key option of the pool. I think the defaults are "%{NAS-IP-Address} %{NAS-Port}". NAS-IP-Address is always the same (our VPN server)and NAS-Port changes from users. Is that correct? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337
Hello, I have found the problem... I have my freeradius servers being monitored by a system. This monitoring user was assigned to a pool, but it didn't send any stop account record, so IPs were never released. I have configured this user to not being assigned to any pool and the system works now perfectly. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337
participants (2)
-
Angel L. Mateo -
George Chelidze