robust-proxy-accounting
Peter Balsianok
balsianok.peter at gmail.com
Sat Apr 18 10:07:16 CEST 2015
Hi,
I`m testing configuration for robust-proxy-accounting.
Here is my configuration file (sites-enabled/robust-proxy-accounting):
# (1) Define two home servers.
home_server MVAS_BA {
type = acct
ipaddr = 213.151.250.21
port = 1813
secret = testing123
# Mark this home server alive ONLY when it starts being responsive
status_check = request
username = "test_user_status_check"
# Set the response timeout aggressively low.
# You MAY have to increase this, depending on tests with
# your local installation.
response_window = 2
}
home_server MVAS_BB {
type = acct
ipaddr = 213.151.250.149
port = 1813
secret = testing123
# Mark this home server alive ONLY when it starts being responsive
status_check = request
username = "test_user_status_check"
# Set the response timeout aggressively low.
# You MAY have to increase this, depending on tests with
# your local installation.
response_window = 2
}
# (2) Define a virtual server to be used when both of the
# home servers are down.
home_server acct_detail.local {
virtual_server = acct_detail.local
}
# Put all of the servers into a pool.
home_server_pool acct_pool.MVAS {
type = fail-over # other types are OK, too.
home_server = MVAS_BA
home_server = MVAS_BB
# add more home_server's here.
# If all home servers are down, try a home server that
# is a local virtual server.
fallback = acct_detail.local
# for pre/post-proxy policies
virtual_server = MVAS
}
# (3) Define a realm for these home servers.
# It should NOT be used as part of normal proxying decisions!
realm MVAS {
acct_pool = acct_pool.MVAS
}
# If we want to sent packet directly
realm MVAS_BA {
type = radius
accthost = 213.151.250.22:1813
secret = testing123
}
realm MVAS_BB {
type = radius
accthost = 213.151.250.148:1813
secret = testing123
}
# (4) Define a detail file writer.
# See raddb/modules/detail
# (5) Define the virtual server to write the packets to the detail file
# This will be called when ALL home servers are down, because of the
# "fallback" configuration in the home server pool.
server acct_detail.local {
accounting {
detail
}
}
# (6) Define a virtual server to handle pre/post-proxy re-writing
server MVAS {
pre-proxy {
# Insert pre-proxy rules here
}
post-proxy {
# Insert post-proxy rules here
# This will be called when the CURRENT packet failed
# to be proxied. This may happen when one home server
# suddenly goes down, even though another home server
# may be alive.
#
# i.e. the current request has run out of time, so it
# cannot fail over to another (possibly) alive server.
#
# We want to respond to the NAS, so that it can stop
# re-sending the packet. We write the packet to the
# "detail" file, where it will be read, and sent to
# another home server.
#
Post-Proxy-Type Fail {
detail
}
}
# Read accounting packets from the detail file(s) for
# the home server.
#
# Note that you can have only ONE "listen" section reading
# detail files from a particular directory. That is why the
# destination host name is used as part of the directory name
# below. Having two "listen" sections reading detail files
# from the same directory WILL cause problems. The packets
# may be read by one, the other, or both "listen" sections.
listen {
type = detail
#filename = "${radacctdir}/detail-*:*"
filename = "${radacctdir}/detail"
load_factor = 10
}
# All packets read from the detail file are proxied back to
# the home servers.
#
# The normal pre/post-proxy rules are applied to them, too.
#
# If the home servers are STILL down, then the server stops
# reading the detail file, and queues the packets for a later
# retransmission. The Post-Proxy-Type "Fail" handler is NOT
# called.
#
# When the home servers come back up, the packets are forwarded,
# and the detail file processed as normal.
accounting {
# You may want accounting policies here...
update control {
&Proxy-To-Realm := 'MVAS'
}
}
}
Debug log:
Copyright (C) 1999-2015 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file
/app/radius/freeradius-3.0.7/share/freeradius/dictionary
including dictionary file
/app/radius/freeradius-3.0.7/share/freeradius/dictionary.dhcp
including dictionary file
/app/radius/freeradius-3.0.7/share/freeradius/dictionary.vqp
including dictionary file ./dictionary
including configuration file ./radiusd.conf
including configuration file ./templates.conf
including configuration file ./proxy.conf
including configuration file ./clients.conf
including files in directory ./mods-enabled/
including configuration file ./mods-enabled/realm
including configuration file ./mods-enabled/attr_filter
including configuration file ./mods-enabled/expr
including configuration file ./mods-enabled/detail
including files in directory ./policy-enabled/
including configuration file ./policy-enabled/accounting
including files in directory ./sites-enabled/
including configuration file ./sites-enabled/robust-proxy-accounting
including configuration file ./sites-enabled/default
main {
name = "ggsn"
prefix = "/app/radius/freeradius-3.0.7"
localstatedir = "/app_log/radius/ggsn/"
sbindir = "/app/radius/freeradius-3.0.7/sbin"
logdir = "/app_log/radius/ggsn/"
run_dir = "/app_log/radius/ggsn/"
libdir = "/app/radius/freeradius-3.0.7/lib"
radacctdir = "/app_log/radius/ggsn/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/app_log/radius/ggsn/ggsn.pid"
checkrad = "/app/radius/freeradius-3.0.7/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
allow_vulnerable_openssl = "yes"
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server MVAS_BA {
ipaddr = 213.151.250.21
port = 1813
type = "acct"
secret = <<< secret >>>
response_window = 2.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "request"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
username = "test_user_status_check"
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server MVAS_BB {
ipaddr = 213.151.250.149
port = 1813
type = "acct"
secret = <<< secret >>>
response_window = 2.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "request"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
username = "test_user_status_check"
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server acct_detail.local {
virtual_server = "acct_detail.local"
port = 0
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "none"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
realm LOCAL {
authhost = LOCAL
accthost = LOCAL
}
realm NULL {
authhost = LOCAL
accthost = LOCAL
}
realm DEFAULT {
authhost = LOCAL
accthost = LOCAL
}
home_server_pool acct_pool.MVAS {
type = fail-over
virtual_server = MVAS
home_server = MVAS_BA
home_server = MVAS_BB
fallback = acct_detail.local
}
realm MVAS {
acct_pool = acct_pool.MVAS
}
realm MVAS_BA {
accthost = 213.151.250.22:1813
secret = testing123
}
realm MVAS_BB {
accthost = 213.151.250.148:1813
secret = testing123
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.64.192.1 {
ipaddr = 10.64.192.1
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_flexi01BB1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.64.64.1 {
ipaddr = 10.64.64.1
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_flexi01BA1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.64.64.3 {
ipaddr = 10.64.64.3
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_flexi03BA2"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.64.64.7 {
ipaddr = 10.64.64.7
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_flexi03BA2"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.13.224.3 {
ipaddr = 10.13.224.3
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_flexi03BB2"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.8.251.131 {
ipaddr = 10.8.251.131
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_ng03ba2"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.8.251.132 {
ipaddr = 10.8.251.132
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_ng03ba2"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.8.251.147 {
ipaddr = 10.8.251.147
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_ng03bb1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.8.251.148 {
ipaddr = 10.8.251.148
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn_ng03bb1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.8.251.153 {
ipaddr = 10.8.251.153
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn-04-BB1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 10.8.251.154 {
ipaddr = 10.8.251.154
require_message_authenticator = no
secret = <<< secret >>>
shortname = "ggsn-04-BB1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client VPDN-client {
ipaddr = 10.24.254.0
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 172.31.8.18 {
ipaddr = 172.31.8.18
require_message_authenticator = no
secret = <<< secret >>>
shortname = "spgw-01ba3"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 172.31.8.19 {
ipaddr = 172.31.8.19
require_message_authenticator = no
secret = <<< secret >>>
shortname = "spgw-01ba3"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 172.31.8.146 {
ipaddr = 172.31.8.146
require_message_authenticator = no
secret = <<< secret >>>
shortname = "spgw-01bb1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 172.31.8.147 {
ipaddr = 172.31.8.147
require_message_authenticator = no
secret = <<< secret >>>
shortname = "spgw-01bb1"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Found debugger attached
radiusd: #### Instantiating modules ####
instantiate {
}
modules {
# Loaded module rlm_realm
# Instantiating module "IPASS" from file ./mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Instantiating module "suffix" from file ./mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Instantiating module "realmpercent" from file ./mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Instantiating module "ntdomain" from file ./mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
# Loaded module rlm_attr_filter
# Instantiating module "attr_filter.post-proxy" from file
./mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename = "./mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
reading pairlist file ./mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file
./mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "./mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
reading pairlist file ./mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file
./mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "./mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file ./mods-config/attr_filter/access_reject
# Instantiating module "attr_filter.access_challenge" from file
./mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "./mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file ./mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file
./mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename = "./mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file ./mods-config/attr_filter/accounting_response
# Loaded module rlm_expr
# Instantiating module "expr" from file ./mods-enabled/expr
expr {
safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/��������������������������������������a����������������������������������������"
}
# Loaded module rlm_detail
# Instantiating module "detail" from file ./mods-enabled/detail
detail {
filename = "/app_log/radius/ggsn/radacct/detail"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file ./radiusd.conf
} # server
server acct_detail.local { # from file
./sites-enabled/robust-proxy-accounting
# Loading accounting {...}
} # server acct_detail.local
server MVAS { # from file ./sites-enabled/robust-proxy-accounting
# Loading accounting {...}
# Loading post-proxy {...}
} # server MVAS
server default { # from file ./sites-enabled/default
# Loading preacct {...}
# Loading accounting {...}
} # server default
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "detail"
listen {
filename = "/app_log/radius/ggsn/radacct/detail"
load_factor = 10
poll_interval = 1
retry_interval = 30
}
}
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.855170 sec
listen {
type = "acct"
ipv4addr = *
port = 2813
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.941565 sec
}
Listening on detail file /app_log/radius/ggsn/radacct/detail as server MVAS
Listening on acct address * port 2813 bound to server default
Opening new proxy socket 'proxy address * port 0'
Listening on proxy address * port 45416
Ready to process requests
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.891372 sec
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
1.032078 sec
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
1.143914 sec
(0) Received Accounting-Request Id 193 from 127.0.0.1:33976 to
127.0.0.1:2813 length 202
(0) X-Ascend-Dial-Number = '<U+0557>\331\025'
(0) Acct-Session-Id = 'd597d91572f51ab3'
(0) Service-Type = Framed-User
(0) Called-Station-Id = 'ORANGEWAP'
(0) Acct-Link-Count = 1
(0) X-Ascend-Metric = 1928665779
(0) Acct-Authentic = Local
(0) Acct-Status-Type = Start
(0) NAS-IP-Address = 10.64.192.1
(0) X-Ascend-PRI-Number-Type = 8
(0) 3GPP-SGSN-Address = 213.151.252.35
(0) Calling-Station-Id = '421905012405'
(0) X-Ascend-IPX-Alias = 4294967295
(0) Framed-Protocol = GPRS-PDP-Context
(0) User-Name = '421905012405'
(0) NAS-Identifier = 'ggsn-01-bb1.orange.sk'
(0) Acct-Multi-Session-Id = 'd597d9153962de6b'
(0) Framed-IP-Address = 10.10.1.1
(0) # Executing section preacct from file ./sites-enabled/default
(0) preacct {
(0) policy acct_unique {
(0) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) {
(0) EXPAND %{string:Class}
(0) -->
(0) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE
(0) else {
(0) update request {
(0) EXPAND
%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
(0) --> 3f8686a01d885a40dd9b2c3e425dbd1c
(0) &Acct-Unique-Session-Id := "3f8686a01d885a40dd9b2c3e425dbd1c"
(0) } # update request = noop
(0) } # else = noop
(0) } # policy acct_unique = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "421905012405", looking up realm NULL
(0) suffix: Found realm "NULL"
(0) suffix: Adding Stripped-User-Name = "421905012405"
(0) suffix: Adding Realm = "NULL"
(0) suffix: Accounting realm is LOCAL
(0) [suffix] = ok
(0) if (&3GPP-SGSN-Address) {
(0) if (&3GPP-SGSN-Address) -> TRUE
(0) if (&3GPP-SGSN-Address) {
(0) update request {
(0) EXPAND %{Called-Station-Id}.%{3GPP-SGSN-Address}
(0) --> ORANGEWAP.213.151.252.35
(0) Called-Station-Id := "ORANGEWAP.213.151.252.35"
(0) } # update request = noop
(0) } # if (&3GPP-SGSN-Address) = noop
(0) update control {
(0) Proxy-To-Realm := 'MVAS'
(0) } # update control = noop
(0) } # preacct = ok
(0) # Executing section accounting from file ./sites-enabled/default
(0) accounting {
(0) attr_filter.accounting_response: EXPAND %{User-Name}
(0) attr_filter.accounting_response: --> 421905012405
(0) attr_filter.accounting_response: Matched entry DEFAULT at line 15
(0) [attr_filter.accounting_response] = updated
(0) } # accounting = updated
(0) server MVAS {
(0) }
Opening new proxy socket 'proxy address * port 0'
Listening on proxy address * port 49317
(0) Proxying request to home server 213.151.250.21 port 1813 timeout
2.000000
(0) Sent Accounting-Request Id 164 from 0.0.0.0:49317 to 213.151.250.21:1813
length 222
(0) X-Ascend-Dial-Number = '<U+0557>\331\025'
(0) Acct-Session-Id = 'd597d91572f51ab3'
(0) Service-Type = Framed-User
(0) Acct-Link-Count = 1
(0) X-Ascend-Metric = 1928665779
(0) Acct-Authentic = Local
(0) Acct-Status-Type = Start
(0) NAS-IP-Address = 10.64.192.1
(0) X-Ascend-PRI-Number-Type = 8
(0) 3GPP-SGSN-Address = 213.151.252.35
(0) Calling-Station-Id = '421905012405'
(0) X-Ascend-IPX-Alias = 4294967295
(0) Framed-Protocol = GPRS-PDP-Context
(0) User-Name = '421905012405'
(0) NAS-Identifier = 'ggsn-01-bb1.orange.sk'
(0) Acct-Multi-Session-Id = 'd597d9153962de6b'
(0) Framed-IP-Address = 10.10.1.1
(0) Called-Station-Id := 'ORANGEWAP.213.151.252.35'
(0) Proxy-State = 0x313933
Waking up in 0.3 seconds.
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
1.138450 sec
Waking up in 0.1 seconds.
(0) Expecting proxy response no later than 1.499613 seconds from now
Waking up in 1.4 seconds.
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.764369 sec
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.770533 sec
(0) No proxy response, giving up on request and marking it done
Marking home server 213.151.250.21 port 1813 as zombie (it has not
responded in 2.000000 seconds).
PING: Waiting 4 seconds for response to ping
PING: Next status packet in 30 seconds
(0) ERROR: Failing proxied request for user "421905012405", due to lack of
any response from home server 213.151.250.21 port 1813
(0) Found Post-Proxy-Type Fail-Accounting
(0) server MVAS {
(0) # Executing group from file ./sites-enabled/robust-proxy-accounting
(0) }
(0) Not sending reply to client.
(0) Finished request
(0) <done>: Cleaning up request packet ID 193 with timestamp +4
Waking up in 3.9 seconds.
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.773042 sec
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.852001 sec
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
0.971866 sec
Polling for detail file /app_log/radius/ggsn/radacct/detail
Detail listener /app_log/radius/ggsn/radacct/detail state unopened waiting
1.013426 sec
No response to status check 1 for home server 213.151.250.21 port 1813
Waking up in 25.5 seconds.
As you can see packet is not written into disk (in the case of post proxy
fail via detail module).
Help me please. Thank you.
More information about the Freeradius-Users
mailing list