Hello, We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right. They said us, it could sometimes duplicate ip's on subscribers. Does someones knows something about this issue? Is it fixed on last versions? Best regards. Juanjo. Sent with Stampery <https://stampery.com/gmail>
Juanjo, We are using FreeRadius with MySQL, and this issue occurs. We solved this problem using MySQL triggers. Aurélio Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Juanjo, Complementing..... This is not a freeradius issue! It occours when Nas's didn't (or fail ) to send packets to freeradius. Aurlio Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Aurelio, Im trying to understand what is the issue..., Can it be the lost of accounting stop messages from NAS? Can i know how did you make the triggers on MySQL? Thank you. Sent with Stampery <https://stampery.com/gmail> 2016-04-25 12:44 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
Complementing.....
This is not a freeradius issue! It occours when Nas's didn't (or fail ) to send packets to freeradius.
Aurlio
Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ------------------------------------ Juanjo Abenza Sánchez CTO Free Technologies Excom, S.L. http://www.excom.es Tel. 902 02 02 34 Ext. 202 Fax 902 87 66 41 ----------------------------------- AVISO LEGAL *Este mensaje es CONFIDENCIAL, siendo para uso exclusivo de su destinatario. Si usted no es el destinatario,* *por favor, reenvíe el mensaje inmediatamente a la dirección remitente y proceda a su borrado.* *Free Technologies Excom, s.l. **incluirá su dirección de correo electrónico, así como los datos de contacto que* *le facilite en un fichero automatizado, con el fin de gestionar el envío de comunicaciones profesionales y/o* *personales. Para ejercitar sus derechos de acceso, rectificación, cancelación y oposición, remita su solicitud a:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).* LEGAL NOTICE *This message is CONFIDENTIAL, being for exclusive use of the addressee. If you are not the addressee, please* *forward this message to sender inmediately and arrange for its deletion.* *Free Technologies Excom, s.l. **will include your address and contact details in an automated file, in order to* *manage the delivery of business and personal communications. To exercise your rights of access, rectification,* *cancellation and opposition, send your request to:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).*
Juanjo, In my case I use Mikrotik as NAS. I made a correction in checkrad code (mikrotik_telnet) to make it work duplication checking logins and this has been greatly reduced the number of occurrences. Also I did a trigger in the database to check when the radacct receives a start package if there is the same user already connected from the same NAS, and if so I close the oldest connection in Radacct and clean the radippool IP record. Be careful if you allow multiple connections to the same login. Note that if the FreeRadius attempts to deliver a new IP to the user is asked for the NAS and not by a FreeRadius failure. Em 25/04/2016 08:13, Juanjo Abenza escreveu:
Aurelio,
Im trying to understand what is the issue..., Can it be the lost of accounting stop messages from NAS?
Can i know how did you make the triggers on MySQL?
Thank you.
Sent with Stampery <https://stampery.com/gmail>
2016-04-25 12:44 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
Complementing.....
This is not a freeradius issue! It occours when Nas's didn't (or fail ) to send packets to freeradius.
Aurlio
Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello, We migrated the Pool to freeradius and its works like a charm following your reccommendations. Our NAS is Mikrotik also we use it for PPPOE clients. Can you please, explain me the fourth possible problem? "4) the NAS lets the user stay online even after the IP has expired - this happens a LOT." (I guess this happend if accounting packets We can see the expiry_time in the database is one hour after the the IP lease, our users are still connected with the same IP address after this expiry time, i guess this expiry_time is renewed each accounting update gived from NAS. Am i corrent hoping this behaviour from freeradius? If so, we wouldn't have the fourth possible issue. Thank you very much. Juanjo. Sent with Stampery <https://stampery.com/gmail> 2016-04-25 14:07 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
In my case I use Mikrotik as NAS. I made a correction in checkrad code (mikrotik_telnet) to make it work duplication checking logins and this has been greatly reduced the number of occurrences.
Also I did a trigger in the database to check when the radacct receives a start package if there is the same user already connected from the same NAS, and if so I close the oldest connection in Radacct and clean the radippool IP record. Be careful if you allow multiple connections to the same login.
Note that if the FreeRadius attempts to deliver a new IP to the user is asked for the NAS and not by a FreeRadius failure.
Em 25/04/2016 08:13, Juanjo Abenza escreveu:
Aurelio,
Im trying to understand what is the issue..., Can it be the lost of accounting stop messages from NAS?
Can i know how did you make the triggers on MySQL?
Thank you.
Sent with Stampery <https://stampery.com/gmail>
2016-04-25 12:44 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
Complementing.....
This is not a freeradius issue! It occours when Nas's didn't (or fail ) to send packets to freeradius.
Aurlio
Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ------------------------------------ Juanjo Abenza Sánchez CTO Free Technologies Excom, S.L. http://www.excom.es Tel. 902 02 02 34 Ext. 202 Fax 902 87 66 41 ----------------------------------- AVISO LEGAL *Este mensaje es CONFIDENCIAL, siendo para uso exclusivo de su destinatario. Si usted no es el destinatario,* *por favor, reenvíe el mensaje inmediatamente a la dirección remitente y proceda a su borrado.* *Free Technologies Excom, s.l. **incluirá su dirección de correo electrónico, así como los datos de contacto que* *le facilite en un fichero automatizado, con el fin de gestionar el envío de comunicaciones profesionales y/o* *personales. Para ejercitar sus derechos de acceso, rectificación, cancelación y oposición, remita su solicitud a:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).* LEGAL NOTICE *This message is CONFIDENTIAL, being for exclusive use of the addressee. If you are not the addressee, please* *forward this message to sender inmediately and arrange for its deletion.* *Free Technologies Excom, s.l. **will include your address and contact details in an automated file, in order to* *manage the delivery of business and personal communications. To exercise your rights of access, rectification,* *cancellation and opposition, send your request to:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).*
I forgot to ask too, we have many users with the Framed-Ip-Address attributte, for give static IP address to some users, can we assign static ip's using the sqlippool module? Thanks in advantage. JJ Sent with Stampery <https://stampery.com/gmail> 2016-04-27 11:47 GMT+02:00 Juanjo Abenza <juanjo@excom.es>:
Hello,
We migrated the Pool to freeradius and its works like a charm following your reccommendations.
Our NAS is Mikrotik also we use it for PPPOE clients.
Can you please, explain me the fourth possible problem? "4) the NAS lets the user stay online even after the IP has expired - this happens a LOT." (I guess this happend if accounting packets
We can see the expiry_time in the database is one hour after the the IP lease, our users are still connected with the same IP address after this expiry time, i guess this expiry_time is renewed each accounting update gived from NAS. Am i corrent hoping this behaviour from freeradius? If so, we wouldn't have the fourth possible issue.
Thank you very much.
Juanjo.
Sent with Stampery <https://stampery.com/gmail>
2016-04-25 14:07 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
In my case I use Mikrotik as NAS. I made a correction in checkrad code (mikrotik_telnet) to make it work duplication checking logins and this has been greatly reduced the number of occurrences.
Also I did a trigger in the database to check when the radacct receives a start package if there is the same user already connected from the same NAS, and if so I close the oldest connection in Radacct and clean the radippool IP record. Be careful if you allow multiple connections to the same login.
Note that if the FreeRadius attempts to deliver a new IP to the user is asked for the NAS and not by a FreeRadius failure.
Em 25/04/2016 08:13, Juanjo Abenza escreveu:
Aurelio,
Im trying to understand what is the issue..., Can it be the lost of accounting stop messages from NAS?
Can i know how did you make the triggers on MySQL?
Thank you.
Sent with Stampery <https://stampery.com/gmail>
2016-04-25 12:44 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
Complementing.....
This is not a freeradius issue! It occours when Nas's didn't (or fail ) to send packets to freeradius.
Aurlio
Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--
------------------------------------ Juanjo Abenza Sánchez CTO Free Technologies Excom, S.L. http://www.excom.es Tel. 902 02 02 34 Ext. 202 Fax 902 87 66 41 -----------------------------------
AVISO LEGAL
*Este mensaje es CONFIDENCIAL, siendo para uso exclusivo de su destinatario. Si usted no es el destinatario,*
*por favor, reenvíe el mensaje inmediatamente a la dirección remitente y proceda a su borrado.*
*Free Technologies Excom, s.l. **incluirá su dirección de correo electrónico, así como los datos de contacto que*
*le facilite en un fichero automatizado, con el fin de gestionar el envío de comunicaciones profesionales y/o*
*personales. Para ejercitar sus derechos de acceso, rectificación, cancelación y oposición, remita su solicitud a:*
*Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,*
*Alcobendas (Madrid).*
LEGAL NOTICE
*This message is CONFIDENTIAL, being for exclusive use of the addressee. If you are not the addressee, please*
*forward this message to sender inmediately and arrange for its deletion.*
*Free Technologies Excom, s.l. **will include your address and contact details in an automated file, in order to*
*manage the delivery of business and personal communications. To exercise your rights of access, rectification,*
*cancellation and opposition, send your request to:*
*Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,*
*Alcobendas (Madrid).*
-- ------------------------------------ Juanjo Abenza Sánchez CTO Free Technologies Excom, S.L. http://www.excom.es Tel. 902 02 02 34 Ext. 202 Fax 902 87 66 41 ----------------------------------- AVISO LEGAL *Este mensaje es CONFIDENCIAL, siendo para uso exclusivo de su destinatario. Si usted no es el destinatario,* *por favor, reenvíe el mensaje inmediatamente a la dirección remitente y proceda a su borrado.* *Free Technologies Excom, s.l. **incluirá su dirección de correo electrónico, así como los datos de contacto que* *le facilite en un fichero automatizado, con el fin de gestionar el envío de comunicaciones profesionales y/o* *personales. Para ejercitar sus derechos de acceso, rectificación, cancelación y oposición, remita su solicitud a:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).* LEGAL NOTICE *This message is CONFIDENTIAL, being for exclusive use of the addressee. If you are not the addressee, please* *forward this message to sender inmediately and arrange for its deletion.* *Free Technologies Excom, s.l. **will include your address and contact details in an automated file, in order to* *manage the delivery of business and personal communications. To exercise your rights of access, rectification,* *cancellation and opposition, send your request to:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).*
Jaunjo, Em 27/04/2016 07:06, Juanjo Abenza escreveu:
I forgot to ask too, we have many users with the Framed-Ip-Address attributte, for give static IP address to some users, can we assign static ip's using the sqlippool module?
I don't use in my scenario static IP for my users, but yes, you can assign static IP using sqlippool module. Use the Framed-Ip-Address := IP clause in your database. Aurélio
Thank you very much for your clarification Aurelio. Regarding the static IP address, i tryed with "Framed-Ip-Address := IP" but it doesnt mark as used on the radippool database, Is there any way to mark this address as used when the address is assigned from this attribute? If not can we assign a static IP address using the sqlippool module? Best regards. Juanjo. 2016-04-27 12:53 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Jaunjo,
Em 27/04/2016 07:06, Juanjo Abenza escreveu:
I forgot to ask too, we have many users with the Framed-Ip-Address attributte, for give static IP address to some users, can we assign static ip's using the sqlippool module?
I don't use in my scenario static IP for my users, but yes, you can assign static IP using sqlippool module.
Use the Framed-Ip-Address := IP clause in your database.
Aurélio
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sent with Stampery <https://stampery.com/gmail> -- ------------------------------------ Juanjo Abenza Sánchez CTO Free Technologies Excom, S.L. http://www.excom.es -----------------------------------
Juanjo,
Thank you very much for your clarification Aurelio.
Regarding the static IP address, i tryed with "Framed-Ip-Address := IP" but it doesnt mark as used on the radippool database,
Is there any way to mark this address as used when the address is assigned from this attribute? If not can we assign a static IP address using the sqlippool module?
Best regards.
I'm sorry, I don't tested this solution for my users. Maybe another friend can help you better than me. Aurélio
On Apr 27, 2016, at 7:18 AM, Juanjo Abenza <juanjo@excom.es> wrote:
Regarding the static IP address, i tryed with "Framed-Ip-Address := IP" but it doesnt mark as used on the radippool database,
You need to delete static IPs from the pool. Pools are for dynamic IPs. The only IPs in the pool should be the ones which are managed by the pool. i.e. not static IPs. Alan DeKok.
On Apr 27, 2016, at 6:06 AM, Juanjo Abenza <juanjo@excom.es> wrote:
I forgot to ask too, we have many users with the Framed-Ip-Address attributte, for give static IP address to some users, can we assign static ip's using the sqlippool module?
No. Put the static users into a *different* table, keyed by MAC address. Then, just SELECT the IP. IP pools are for dynamic IPs. Alan DeKok.
Juanjo,
We migrated the Pool to freeradius and its works like a charm following your reccommendations.
Our NAS is Mikrotik also we use it for PPPOE clients.
Can you please, explain me the fourth possible problem? "4) the NAS lets the user stay online even after the IP has expired - this happens a LOT." (I guess this happend if accounting packets
We can see the expiry_time in the database is one hour after the the IP lease, our users are still connected with the same IP address after this expiry time, i guess this expiry_time is renewed each accounting update gived from NAS. Am i corrent hoping this behaviour from freeradius? If so, we wouldn't have the fourth possible issue.
You mixed my and Alan answers, but I will try to share my experience in implementing this solution. The FreeRadius is not checking whether the user is connected or not, unless he receives a new same user authentication request, so update EXPIRY_TIME is a NAS "obligation"through the interim-update packages. If for some reason the FreeRadius not receive these packages this information will be outdated. Note the file sql/mysql/ippool-dhcp.conf the FreeRadius give proper treatment to the management of the pool of IPs, but for that it needs to properly receive the packages. Aurelio
Thank you very much.
Juanjo.
Sent with Stampery <https://stampery.com/gmail>
2016-04-25 14:07 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
In my case I use Mikrotik as NAS. I made a correction in checkrad code (mikrotik_telnet) to make it work duplication checking logins and this has been greatly reduced the number of occurrences.
Also I did a trigger in the database to check when the radacct receives a start package if there is the same user already connected from the same NAS, and if so I close the oldest connection in Radacct and clean the radippool IP record. Be careful if you allow multiple connections to the same login.
Note that if the FreeRadius attempts to deliver a new IP to the user is asked for the NAS and not by a FreeRadius failure.
Em 25/04/2016 08:13, Juanjo Abenza escreveu:
Aurelio,
Im trying to understand what is the issue..., Can it be the lost of accounting stop messages from NAS?
Can i know how did you make the triggers on MySQL?
Thank you.
Sent with Stampery <https://stampery.com/gmail>
2016-04-25 12:44 GMT+02:00 Aurélio de Souza Ribeiro Neto < netolistas@mpc.com.br>:
Juanjo,
Complementing.....
This is not a freeradius issue! It occours when Nas's didn't (or fail ) to send packets to freeradius.
Aurlio
Em 25/04/2016 04:52, Juanjo Abenza escreveu:
Hello,
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
They said us, it could sometimes duplicate ip's on subscribers.
Does someones knows something about this issue? Is it fixed on last versions?
Best regards. Juanjo.
Sent with Stampery <https://stampery.com/gmail> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 27, 2016, at 5:47 AM, Juanjo Abenza <juanjo@excom.es> wrote:
We migrated the Pool to freeradius and its works like a charm following your recommendations.
Good.
Our NAS is Mikrotik also we use it for PPPOE clients.
Can you please, explain me the fourth possible problem? "4) the NAS lets the user stay online even after the IP has expired - this happens a LOT." (I guess this happend if accounting packets
That happens if the NAS ignores Session-Timeout, or it doesn't send accounting packets which say the user is still online. The only way for FreeRADIUS to know if the user is still online is if the NAS tells it. So.. if there are disagreements between the FreeRADIUS database and what the user is doing, blame the NAS.
We can see the expiry_time in the database is one hour after the the IP lease, our users are still connected with the same IP address after this expiry time, i guess this expiry_time is renewed each accounting update gived from NAS.
Yes.
Am i corrent hoping this behaviour from free radius?
Yes. Alan DeKok.
On Apr 25, 2016, at 3:52 AM, Juanjo Abenza <juanjo@excom.es> wrote:
We are planning to deploy a new freeradius Server, and we would like to manage the IP's from freeradius ip pool, but some time ago we heard that FreeRadis sometimes didnt manage the pool all right.
The only reason people say that is because they aren't sure how IP pool management works.
They said us, it could sometimes duplicate ip's on subscribers.
FreeRADIUS uses a database to manage IP pools. The only way for duplicate IPs to be assigned is: 1) freeradius ignores the database, and assigns duplicate IPs - this doesn't happen 2) the database is broken, and gives duplicate IPs to FreeRADIUS - this doesn't happen 3) You didn't configure the NAS to send accounting packets to FreeRADIUS - this happens sometimes 3) the NAS lets the user stay online even after the IP has expired - this happens a LOT. The simple explanation is that everyone *else* is using FreeRADIUS to assign IPs, and it works. So if it doesn't work for you, then the problem isn't FreeRADIUS.
Does someones knows something about this issue? Is it fixed on last versions?
Be sure that the NAS is sending accounting packets to FreeRADIUS. If it is sending accounting packets then take your NAS, throw it in the garbage, and buy a NAS that works. Alan DeKok.
participants (3)
-
Alan DeKok -
Aurélio de Souza Ribeiro Neto -
Juanjo Abenza