I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and freeradius ( 1.0.4) I am having problem when number of users (clients) increase from 6 and up. It worked fine when I have only 5 users (clients) using the system. I found the max_requests was set at 1024 in radiusd.conf and have inscrease the number up to 50 clients (50x256=12800) max_requests = 12800 However, It doesn't seem to have any effect. What am I doing wrong. One things I noticed. The two users that can not connect will sent incomplete information to the radius server from NAS (7204) such as: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.17.1:1645, id=200, length=95 NAS-IP-Address = 192.168.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen@abc.net" CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 192.168.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 209.101.222.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request *********** This is a log when it connected. It included the Tunnel server and client end point ********* rad_recv: Accounting-Request packet from host 192.168.17.1:1646, id=199, length=232 NAS-IP-Address = 192.168.17.1 NAS-Port = 6 NAS-Port-Type = ISDN User-Name = "knguyen@abc.net" Acct-Status-Type = Stop Acct-Authentic = RADIUS Service-Type = Framed-User Acct-Session-Id = "00000CD8" Framed-Protocol = PPP Tunnel-Server-Endpoint:0 = "10.10.6.5" Tunnel-Client-Endpoint:0 = "10.10.6.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "12345678" Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" Acct-Tunnel-Connection = "13441125" Framed-IP-Address = 209.101.222.12 Acct-Terminate-Cause = Admin-Reset Acct-Input-Octets = 281672 Acct-Output-Octets = 266074 Acct-Input-Packets = 4390 Acct-Output-Packets = 4154 Acct-Session-Time = 1967 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.17.17.1:1645, id=200, length=95 NAS-IP-Address = 172.17.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen@eintegration.net" CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 172.17.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 38.101.172.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request What am I missing here? thanks much, Tom
Tom Miller wrote:
I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and freeradius ( 1.0.4)
I am having problem when number of users (clients) increase from 6 and up.
It worked fine when I have only 5 users (clients) using the system.
I found the max_requests was set at 1024 in radiusd.conf and have inscrease the number up to 50 clients (50x256=12800)
max_requests = 12800
However, It doesn't seem to have any effect. What am I doing wrong.
One things I noticed. The two users that can not connect will sent incomplete information to the radius server from NAS (7204) such as:
Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.17.1:1645, id=200, length=95 NAS-IP-Address = 192.168.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen@abc.net" CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP
auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 192.168.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 209.101.222.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request
*********** This is a log when it connected. It included the Tunnel server and client end point *********
rad_recv: Accounting-Request packet from host 192.168.17.1:1646, id=199, length=232 NAS-IP-Address = 192.168.17.1 NAS-Port = 6 NAS-Port-Type = ISDN User-Name = "knguyen@abc.net" Acct-Status-Type = Stop Acct-Authentic = RADIUS Service-Type = Framed-User Acct-Session-Id = "00000CD8" Framed-Protocol = PPP Tunnel-Server-Endpoint:0 = "10.10.6.5" Tunnel-Client-Endpoint:0 = "10.10.6.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "12345678" Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" Acct-Tunnel-Connection = "13441125" Framed-IP-Address = 209.101.222.12 Acct-Terminate-Cause = Admin-Reset Acct-Input-Octets = 281672 Acct-Output-Octets = 266074 Acct-Input-Packets = 4390 Acct-Output-Packets = 4154 Acct-Session-Time = 1967 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf
This is an accounting stop record, as opposed to the access accept record you display above and below. It isn't necessarily indicative of what freeradius sent to the NAS, or anything else that happened when the client connected.
--- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.17.17.1:1645, id=200, length=95 NAS-IP-Address = 172.17.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen@eintegration.net" CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP
auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 172.17.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 38.101.172.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request
What am I missing here?
How are you authenticating and authorizing your users? users file, some sort of database or directory? Could you send some relevant excerpts from those sources, eg: some users file stanzas if you're using the users file, objects from your LDAP directory in LDIF if you're using LDAP? My hunch is that freeradius isn't configured to send the necessary attributes and your NAS is defaulting those attributes, but can't do that for more than 5 concurrent users. Unless you're observing considerable delay between the receipt of access-request and the sending of access-accept (ie: more than a couple of seconds), or freeradius is sending different attributes with the access-accept for the same user when things seem to be going wrong to when they're going right, I think you're missing some attributes or your NAS is misconfigured or both. Cheers, -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield@deakin.edu.au Website: http://www.deakin.edu.au
participants (2)
-
James Wakefield -
Tom Miller