802.1X wireless, FR, and accounting...

[sth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi folks,

I've deployed FR2 to service 802.1X wireless authentication (Cisco LWAPP
infrastructure), and it's working splendidly from the users'
perspective. Accounting, however, is acting weirdly, and I have yet to
determine why. 'radlast' gives output like this:

gsmith   029:CvbP6g   10.1.2.3         Tue Jan 13 17:48 - 17:54  (00:06)
mjones   029:CvbP9A   10.2.8.9         Tue Jan 13 17:25 - 17:34  (00:09)
mjones   029:CvbP9A   192.168.2.2      Tue Jan 13 17:25 - 17:25  (00:00)
bblack   029:CvbP9A   10.1.1.9         Tue Jan 13 17:24 - 17:25  (00:01)
cwhite   029:CvbP6g   10.1.2.4         Tue Jan 13 17:23 - 17:24  (00:00)
cwhite   029:CvbP6g   10.1.2.4         Tue Jan 13 17:23 - 17:23  (00:00)
cwhite   029:CvbP6g   10.250.59.255    Tue Jan 13 17:23 - 17:23  (00:00)
cwhite   029:CvbP6g   10.250.59.255    Tue Jan 13 17:23 - 17:23  (00:00)
mbrown   029:CvbP9A   10.9.8.7         Tue Jan 13 17:23 - 17:24  (00:00)
mbrown   029:CvbP9A   192.168.0.6      Tue Jan 13 17:23 - 17:23  (00:00)
...

(note the very brief session lengths)

'radwho' reacts accordingly, only listing those users whose very brief
window of "accounting existence" has not yet closed.

If you've heard this tune before, please feel free to send a link to the
appropriate mailing list thread or wiki article.

The LWAPP controllers send accounting start packets to the RADIUS server
as expected, but shortly thereafter, send accounting stop messages. I
fell asleep part of the way through RFC3580, so I humbly ask the
experts: is this "correct" behavior, consistent with the protocol (or at
least, most implementations of the protocol)? Do most 802.1X
authenticators not wait for actual port closure to send an accounting
stop message?

In a thread from back in June of 2008, (Vol 38, Issues 116, 121, and
122: "radacct/radutmp out of sync"), Alan refers to radutmp as a hack,
and recommends moving to an SQL database. Is this the way I should be
going? People around here like 'radwho', but I'm happy to write a script
called 'radwho' that performs an SQL query. And if this is a known
issue, is there a widely-accepted method for addressing the lack of
coincidence between the accounting stop messages and actual closure of
the port, or is everyone left to make their own assumptions about that?


Many thanks,

- -sth

sam hooker|http://www.noiseplant.com|i am between the internet
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkltH6sACgkQX8KByLv3aQ3s2ACeOfKWRSa9nZ3bSwebBcitcrL8
VqoAnjA8DoRUjwBUqkwMBs7qOiDmhGOd
=SXac
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.