Scorsese712

Политики стали такими, абонент в биллинге - отключен, результат ниже policy-map type service REDIRECT 100 class type traffic REDIRECT-CLASS ! class type traffic default input drop ! ! policy-map type service OPENGRD 50 class type traffic OPENGRD-CLASS ! class type traffic default input drop ! ! policy-map type control ISG-CUSTOMERS-POLICY-IPOE class type control ISG-IP-UNAUTH event timed-policy-expiry 10 service disconnect ! class type control always event session-start 10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address 15 set-timer UNAUTH-TIMER 2 30 service-policy type service name OPENGRD 40 service-policy type service name REDIRECT ! class type control always event radius-timeout 1 service-policy type service name OPENGRD 2 service-policy type service name REDIRECT 4 set-timer UNAUTH-TIMER 2 ! class type control always event session-restart 10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address 20 set-timer UNAUTH-TIMER 1 30 service-policy type service name OPENGRD 40 service-policy type service name REDIRECT ! class type control always event account-logoff 10 service disconnect ! class type control always event service-stop 1 service-policy type service unapply identifier service-name ! ! ! Это же не норма ? ASR1002-X-COMMON#sh sss session uid 704 Type: IPv4, UID: 704, State: unauthen, Identity: x.x.x.x IPv4 Address: x.x.x.x Session Up-time: 00:05:04, Last Changed: 00:05:04 Switch-ID: 186806 Policy information: Authentication status: unauthen Rules, actions and conditions executed: subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event session-start 10 authorize aaa list ISG-AUTH-1 identifier source-ip-address subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event access-reject 10 service-policy type service name OPENGRD   У включенного абонета нижею мне кажется при реджекте примерно тот же вывод должен быть но с другими политиками,или не так ? Session Up-time: 8w4d , Last Changed: 8w4d Switch-ID: 139819 Policy information: Authentication status: authen Active services associated with session: name "INET_3072", applied before account logon Rules, actions and conditions executed: 10 aaa list ISG-AUTH-1 *UNCONFIGURED* subscriber rule-map default-internal-rule condition always event service-start 1 service-policy type service identifier service-name Classifiers: Class-id Dir Packets Bytes Pri. Definition 0 In 92807468 34401083811 0 Match Any 1 Out 164640315 186835310190 0 Match Any 230 In 92807495 34401089015 50 Match ACL INET 231 Out 164640343 186835316659 50 Match ACL INET 4294967294 In 0 0 - Drop 4294967295 Out 0 0 - Drop Template Id : 132 Features: Absolute Timeout: Class-id Timeout Value Time Remaining Source 0 0 infinite Peruser Accounting: Class-id Dir Packets Bytes Source 0 In 88786037 29298699509 Peruser 1 Out 138289529 151696066638 Peruser 230 In 88786037 29298699509 INET_3072 231 Out 138289529 151696066638 INET_3072 Policing: Class-id Dir Avg. Rate Normal Burst Excess Burst Source 230 In 3072000 983000 0 INET_3072 231 Out 3072000 983000 0 INET_3072 Configuration Sources: Type Active Time AAA Service ID Name SVC 8w4d 3170901965 INET_3072 USR 8w4d - Peruser INT 8w4d - TenGigabitEthernet0/2/0.922

а если этот класс вообще убрать, черт с ним путь при блокировке не будет ничего?

Еще странность. Сессия показывается unauthen, но интернет у абонента есть.

В таком виде оставить, или таймер поднять на верх? class type control always event access-reject 10 service-policy type service name OPENGRD 20 service-policy type service name REDIRECT 30 set-timer UNAUTH-TIMER 1

Тоже самое. ASR1002-X-COMMON#sh sss sess uid 1065 Type: IPv4, UID: 1065, State: unauthen, Identity: 93.88.94.218 IPv4 Address: 93.88.94.218 Session Up-time: 00:01:03, Last Changed: 00:01:03 Switch-ID: 384277 Policy information: Authentication status: unauthen Rules, actions and conditions executed: subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event session-start 10 authorize aaa list ISG-AUTH-1 identifier source-ip-address subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event access-reject 10 service-policy type service name OPENGRD Такое впечатление, что после навешивания опенгарден аксес листы блокируют доступ к радиусу. в опенгардене нужно предусмотреть доступ к радиусу ?

Самое интересное что сервис опенгарден он успевает навесить и все, убирал аксесс листы результат ноль. В таком виде работает policy-map type service REDIRECT 1 class type traffic REDIRECT-CLASS redirect to group TEC-REDIRECT ! class type traffic default input drop ! ! policy-map type service OPENGRD 1 class type traffic OPENGRD-CLASS ! class type traffic default input drop ! ! policy-map type control ISG-CUSTOMERS-POLICY-IPOE class type control ISG-IP-UNAUTH event timed-policy-expiry 10 service disconnect ! class type control always event session-start 10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address 30 service-policy type service name OPENGRD 40 service-policy type service name REDIRECT 50 set-timer UNAUTH-TIMER 2 ! class type control always event radius-timeout 1 service-policy type service name OPENGRD 2 service-policy type service name REDIRECT 4 set-timer UNAUTH-TIMER 1 ! class type control always event session-restart 10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address 20 set-timer UNAUTH-TIMER 1 30 service-policy type service name OPENGRD 40 service-policy type service name REDIRECT ! class type control always event access-reject 10 set-timer UNAUTH-TIMER 2 ! class type control always event account-logoff 10 service disconnect ! class type control always event service-stop 1 service-policy type service unapply identifier service-name ! Если же привести к виду ниже, то нет class type control always event access-reject 10 service-policy type service name OPENGRD 20 service-policy type service name REDIRECT 30 set-timer UNAUTH-TIMER 1

Проблема примерно локализована. Если в class type control always event access-reject убрать сервисы редирект и опенгарден то все отрабатывает на ура. теперь вопрос, чем может мешать один из этих сервисов?

aaa new-model ! ! aaa group server radius ISG-RADIUS server name ISG-RADIUS ip radius source-interface TenGigabitEthernet0/2/0.55 ! aaa group server radius LI-DELTA server name LI-DELTA ip radius source-interface GigabitEthernet0/0/1.3008 ! aaa authentication login ISG-AUTH-1 group ISG-RADIUS aaa authorization network ISG-AUTH-1 group ISG-RADIUS aaa authorization subscriber-service default local group ISG-RADIUS aaa accounting update newinfo periodic 1 aaa accounting network ISG-RADIUS start-stop broadcast group ISG-RADIUS group LI-DELTA aaa accounting network ISG-AUTH-1 action-type start-stop group ISG-RADIUS ! ! ! ! ! ! aaa server radius dynamic-author client 100.64.55.10 server-key 7 060506324F41 auth-type any ! aaa session-id common aaa policy interface-config allow-subinterface   Эти ?

Поднял таймер, картина стала такая. Но суть не поменялась, все равно не авторизуется ASR1002-X-COMMON#sh sss sessi uid 959 det Type: IPv4, UID: 959, State: unauthen, Identity: х.х.х.х IPv4 Address: х.х.х.х Session Up-time: 00:03:49, Last Changed: 00:03:49 Switch-ID: 295597 Policy information: Context 7F4C0BDF5810: Handle 62000205 AAA_id 0081B800: Flow_handle 0 Authentication status: unauthen Rules, actions and conditions executed: subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event session-start 10 authorize aaa list ISG-AUTH-1 identifier source-ip-address subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event access-reject 10 set-timer UNAUTH-TIMER 1 20 service-policy type service name OPENGRD

таймауты с радиуса приходят. если вы о session and idle timeout. Что есть det

вот все что есть... ASR1002-X-COMMON#show sss session uid 981 Type: IPv4, UID: 981, State: unauthen, Identity: х.х.х.х IPv4 Address: х.х.х.х Session Up-time: 00:02:58, Last Changed: 00:02:58 Switch-ID: 133027 Policy information: Authentication status: unauthen Rules, actions and conditions executed: subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event session-start 10 authorize aaa list ISG-AUTH-1 identifier source-ip-address subscriber rule-map ISG-CUSTOMERS-POLICY-IPOE condition always event access-reject 10 service-policy type service name OPENGRD

Есть идеи? Тупо висит и ждет ручного сброса 332 IPv4 unauthen Attempting 00:06:16 0

class-map type traffic match-any OPENGRD-CLASS match access-group input name OPENGARDEN-ACL match access-group output name OPENGARDEN-ACL ! class-map type traffic match-any REDIRECT-CLASS match access-group input name REDIRECT-ACL match access-group output name REDIRECT-ACL ! class-map type control match-all ISG-IP-UNAUTH match authen-status unauthenticated match timer UNAUTH-TIMER

Привел к виду. Все равно сессия остается не авторизованной, пока вручную не сбросить ее на циске.. Что еще может быть policy-map type control ISG-CUSTOMERS-POLICY-IPOE class type control ISG-IP-UNAUTH event timed-policy-expiry 1 service disconnect ! class type control always event session-start 10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address 20 set-timer UNAUTH-TIMER 1 30 service-policy type service name OPENGRD 40 service-policy type service name REDIRECT ! class type control always event radius-timeout 1 service-policy type service name OPENGRD 2 service-policy type service name REDIRECT 4 set-timer UNAUTH-TIMER 1 ! class type control always event access-reject 10 service-policy type service name OPENGRD 20 service-policy type service name REDIRECT 40 set-timer UNAUTH-TIMER 1 ! class type control always event session-restart 10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address 20 set-timer UNAUTH-TIMER 1 30 service-policy type service name OPENGRD 40 service-policy type service name REDIRECT

По идее тогда правильно, кроме class type control always event radius-timeout 1 service-policy type service name OPENGRD 2 service-policy type service name REDIRECT 4 set-timer IP_UNAUTH_TIMER 3 class-map type control match-all ISG-IP-UNAUTH match authen-status unauthenticated match timer UNAUTH-TIMER