Hi, I am trying to use simualtaneous-use with radutmp file but cisco controller is always sending the same port to all devices and logs NAS-Port=1 for all devices in accounting detail file. Here is the typical log : Mon May 26 13:54:10 2014 User-Name = "anonymous@mwn.de" NAS-Port = 1 NAS-IP-Address = 192.168.1.1 Framed-IP-Address = 10.1.1.1 NAS-Identifier = "mytestNAS" Airespace-Wlan-Id = 300 Acct-Session-Id = "53833d09/b8:f6:b1:d1:cc:89/3584354" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=82d0a5f80004506053833d07" Acct-Authentic = RADIUS Event-Timestamp = "May 26 2014 13:54:10 GMT" Acct-Status-Type = Interim-Update Acct-Input-Octets = 274220 Acct-Input-Gigawords = 0 Acct-Output-Octets = 354276 Acct-Output-Gigawords = 0 Acct-Input-Packets = 2174 Acct-Output-Packets = 1529 Acct-Session-Time = 2681 Acct-Delay-Time = 0 Calling-Station-Id = "10.1.1.1" Called-Station-Id = "192.168.1.1" Cisco-AVPair = "nas-update=true" Acct-Unique-Session-Id = "df8c433d8fc2ee10" Realm = "DEFAULT" Timestamp = 1401112450 Request-Authenticator = Verified Can I not change that NAS-IP to actual wireless access point rather the controller IP address ? I tried changing /etc/raddb/acct_users file as : NAS-Identifier == "mytestNAS", NAS-IP-Address := "%{Framed-IP-Address:-%{NAS-IP-Address}}" but I still get the NAS-Port=1 for all the device. There must be users whose cisco wireless access points controlled by the controller - can someone point me ? Khapare
Khapare Joshi wrote:
I am trying to use simualtaneous-use with radutmp file but cisco controller is always sending the same port to all devices and logs NAS-Port=1 for all devices in accounting detail file.
The NAS-Port is created by the NAS.
Can I not change that NAS-IP to actual wireless access point rather the controller IP address ?
I wouldn't do that.
I tried changing /etc/raddb/acct_users file as : NAS-Identifier == "mytestNAS", NAS-IP-Address := "%{Framed-IP-Address:-%{NAS-IP-Address}}"
Framed-IP-Address is for the end user. It is *not* for the NAS. You should never set NAS-Identifier to be Framed-IP-Address.
but I still get the NAS-Port=1 for all the device.
Because you're editing NAS-Identifier, not NAS-Port. And you can't really change NAS-Port. It's created by the NAS> Alan DeKok.
Thanks Alan, How do I resolve my issue ? a) we have a wireless access points are controlled by stupid cisco controller b) I wanted to use radtump file for simualtaneous-user because WLcontroller always sends the NAS-Port=1 radutmp file is not properly updated hence when I do radwho i always see the last users is there anything that I can change in acct_users ? On Mon, May 26, 2014 at 2:11 PM, Alan DeKok <aland@deployingradius.com>wrote:
Khapare Joshi wrote:
I am trying to use simualtaneous-use with radutmp file but cisco controller is always sending the same port to all devices and logs NAS-Port=1 for all devices in accounting detail file.
The NAS-Port is created by the NAS.
Can I not change that NAS-IP to actual wireless access point rather the controller IP address ?
I wouldn't do that.
I tried changing /etc/raddb/acct_users file as : NAS-Identifier == "mytestNAS", NAS-IP-Address := "%{Framed-IP-Address:-%{NAS-IP-Address}}"
Framed-IP-Address is for the end user. It is *not* for the NAS. You should never set NAS-Identifier to be Framed-IP-Address.
but I still get the NAS-Port=1 for all the device.
Because you're editing NAS-Identifier, not NAS-Port.
And you can't really change NAS-Port. It's created by the NAS>
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
How do I resolve my issue ? a) we have a wireless access points are controlled by stupid cisco controller
well, simultaneous use for ADSL etc I can understand....but for WiFi? we're now seeing an avergae of almost 3 devices per person - smartphone, tablet and laptop seem to be the de rigueur these days - you want to either stop users getting on with their lives or give them three accounts? the NAS is the same because the controller is the same.....think of it as an extrapolated NAS...and think carefully about how wireless and mobility works - you want that the second they move to another AP that they break your count?
b) I wanted to use radtump file for simualtaneous-user
dont. just dont. its horrible, limited, slow and critically doesnt scale. if you REALLY REALLY want to do this sort of thing then look at using a proper database solution - and make sure that its fully tuned as putting a check for simultaneous usage into the live critical path for authentication can cause a bottleneck and therefore failures if not. might be better off using out-of-band DB (eg with detail file or robust accounting virtual server and then use CoA against the wireless controller when a breach of your rules is found. alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Khapare Joshi