Re: Problem - Duplicating IPs
Hi Alan, Forgive my ignorance, but are you implying DHCP is keeping up with accounting data? I tried to write a script to identify users via a web page to give some accounting stats and quickly reached the conclusion it was not real time (i.e. if done immediately upon login it would often show the previous user). When in Meru training they also confirmed me the delay when receiving accounting data could be up to 3 minutes for their equipment, if I am not wrong, giving the delay from the top of my head. So the idea I have is whilst accounting is very useful, it is not exactly real-time, correct? Regards
Message: 4 Date: Mon, 16 Feb 2015 08:44:22 -0500 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Problem - Duplicating IPs Message-ID: <067378F3-DD2D-4CAE-9CAE-9CD20275DACD@deployingradius.com> Content-Type: text/plain; charset=windows-1252
On Feb 16, 2015, at 7:37 AM, Marcelo Santoro <santoro.ice@gmail.com> wrote:
I am facing a problem here in my ISP.
I have radippool configured in my freeradius 3.0.6 server and some times my customers are receiving Duplicated IP address,
Fix your NAS so that it sends the correct accounting packets.
FreeRADIUS *assumes* that the accounting information in SQL is correct. If the NAS doesn’t behave properly, the data in SQL will be wrong. And the server will assign duplicate IPs.
Until you get a real NAS (or fix your current one), the best solution would be to write a script to read IPs from SQL, and then scan those in the network. If there’s a response, update SQL to mark the IPs as still in use.
Alan DeKok.
-- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434
On Tue, Feb 17, 2015 at 11:42 AM, Rui Ribeiro <ruyrybeyro@gmail.com> wrote:
Hi Alan,
Forgive my ignorance, but are you implying DHCP is keeping up with accounting data?
The OP asks about IP allocation during radius authentication, not really related to DHCP. However it is true that both can use the same module, e.g. rlm_sqlippool. For radius authentication case, rlm_sqlippool needs information from the NAS to determine whether an IP is being used or not. For example, see https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-confi... , look for "stop_clear" and "alive_update". When rlm_sqlippool allocates duplicate IP, it's possible that the server is misconfigured, or the NAS is not sending interim update fast enough so that rlm_sqlippool thinks the IP is "free" while in fact it is still being used.
I tried to write a script to identify users via a web page to give some accounting stats and quickly reached the conclusion it was not real time (i.e. if done immediately upon login it would often show the previous user). When in Meru training they also confirmed me the delay when receiving accounting data could be up to 3 minutes for their equipment, if I am not wrong, giving the delay from the top of my head.
So the idea I have is whilst accounting is very useful, it is not exactly real-time, correct?
How fast your backing store (e.g. db) is updated depends on a lot of factors, like how fast the NAS is sending out radius packets, how busy the db is, and whether you have something like decoupled accounting. So yes, there can be some delay if you're reading radacct table. The exact cause, and how long the delay is, depends on your setup. Running FR in debug mode can usually help identify it. -- Fajar
On Feb 16, 2015, at 11:42 PM, Rui Ribeiro <ruyrybeyro@gmail.com> wrote:
Forgive my ignorance, but are you implying DHCP is keeping up with accounting data?
Did I mention DHCP? No.
I tried to write a script to identify users via a web page to give some accounting stats and quickly reached the conclusion it was not real time
Accounting”update” packets are usually sent every 5-10 minutes. Accounting packets for session start / stop are sent immediately.
So the idea I have is whilst accounting is very useful, it is not exactly real-time, correct?
No. The session stop packet should be sent immediately. Put a little bit of thought into this. It helps. Would we be shipping an IP Pool module that handed out duplicate IPs for *everyone*? Or, are other networks fine, and yours is crap? Which possibility is more likely? Alan DeKok.
participants (3)
-
Alan DeKok -
Fajar A. Nugraha -
Rui Ribeiro