On Jan 11, 2013, at 6:38 PM, Alan DeKok <[email protected]> wrote:
Hi Alan, Thanks for the response > Ethan Hayon wrote: >> When I run the server in debug mode the Acct-Unique-Session-ID remains >> the same across the interim accounting updates. However, >> re-authentications don't seem to have a unique key associated with them. > > That makes no sense. There is *nothing* unique to each user you can > key off of? Name? MAC address? Yes, MAC address is unique for each user. The MAC should be a unique identifier when assigning IP's. > >> In my post-auth policy, I am updating control with the proper pool-name >> (with an unlang), changing some other reply attributes, then calling >> dhcp_sqlippool. What I am doing doesn't /feel/ right. I am very new to >> this, does this sound like the proper way of handling the serving of >> ip's on multiple subnets. DHCP-Domain-Name-Server and >> DHCP-Router-Address will change between pools. > > Get one thing working first. Only then look at the next thing. Good point > >> I guess I'm asking if I am approaching this correctly: Using unlang in >> policy.conf to handle these rules. > > unlang is for policy rules. Databases are for data. You've got some > kind of mixup between the two. Sorry for the misunderstanding. I understand this. I'm just making sure it is normal to use unlang in the policy.conf to perform sql queries and use the results to build up a response. Again, I need to get this working before worrying about that. > >> Sorry to put such a long debug message in here. I pulled out one >> authorization request, but they all look the same. It looks like > > They don't all look the same. They contain different information for > each user. How else does the server tell users apart? I am only using one device right now, so the auth requests look the same, hence why I only included one below. The auth requests will look different if i introduce more devices into the system. > >> This is what my authorization looks like: >> >> The request comes in with a framed ip of 192.168.0.43, but it tries to >> serve it 192.168.0.50. > > The default queries use Calling-Station-Id to track IP addresses. > They *also* assume that the NAS sends accounting packets, so that each > user has an accounting entry in SQL. > >> It reallocates a new IP for each auth every minute. > > Probably because the NAS isn't sending accounting data. So the IP is > never tracked in SQL. > > So... did you look in the SQL database to see what's there? Is it > tracking the IP? Does the user have an accounting record? Yes, the NAS is sending accounting data. This is what redacct looks like (some columns omitted) +-----------+------------------+------------------+-------------------+---------------+-------------------+-----------------+-----------------+ | radacctid | acctsessionid | acctuniqueid | username | nasipaddress | callingstationid | calledstationid | framedipaddress | +-----------+------------------+------------------+-------------------+---------------+-------------------+-----------------+-----------------+ | 17 | 9e90e1a3b02da713 | 068649e121f096f2 | b8:8d:12:10:8d:f6 | 98.109.201.89 | b8:8d:12:10:8d:f6 | 98.109.201.89 | 192.168.0.40 | | 18 | 61ebc2f61333e8d4 | 857f2f856c1ea384 | b8:8d:12:10:8d:f6 | 98.109.201.89 | b8:8d:12:10:8d:f6 | 98.109.201.89 | 192.168.0.43 | | 19 | a8aed7c0d9ce3bd1 | 541ef5a9672cc6e7 | b8:8d:12:10:8d:f6 | 98.109.201.89 | b8:8d:12:10:8d:f6 | 98.109.201.89 | 192.168.0.43 | | 20 | 5bd18f3ccb1edf8a | e3c55f048d9a680b | b8:8d:12:10:8d:f6 | 98.109.201.89 | b8:8d:12:10:8d:f6 | 98.109.201.89 | 192.168.0.43 | | 21 | 72ad87c6b43a08b4 | e427b47f54737c4f | b8:8d:12:10:8d:f6 | 98.109.201.89 | b8:8d:12:10:8d:f6 | 98.109.201.89 | 192.168.0.43 | | 22 | bff889e83c3b469b | 70ec2fe5fa197bcc | b8:8d:12:10:8d:f6 | 98.109.201.89 | b8:8d:12:10:8d:f6 | 98.109.201.89 | 192.168.0.43 | +-----------+------------------+------------------+-------------------+---------------+-------------------+-----------------+-----------------+ So there is an accounting record for each user and each user session. Right now, I'm thinking there is a mismatch either in the nasipaddress or some other attribute. The NAS has a WAN ip of 98.109.201.89 and a LAN IP of 192.168.1.1. The RADIUS server is on LAN at 192.168.1.2. I have noticed that sometimes the nasipaddress appears as 192.168.1.1 and other times as 98.109.201.89. I think I am going to start with a fresh install of freeradius. I messed with too many queries (such as adjusting the Pool-Key) and I am worried that I have created a mess. Ethan Hayon > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
