Jump to content

Cisco ISG, CoA и account-logon

ugenk
 Share

Recommended Posts

ugenk

ugenk

Posted
Posted

Посылаю на ISG CoA, isg почему-то дает NACK.

Вот дебаг:

Nov 10 15:31:34.763: COA: 172.30.1.130 request queued

Nov 10 15:31:34.763: RADIUS: authenticator AE C3 69 F7 B7 B0 73 7E - 4E 9C 79 BE C8 19 B5 71

Nov 10 15:31:34.763: RADIUS: Vendor, Cisco [26] 22

Nov 10 15:31:34.763: RADIUS: ssg-account-info [250] 16 "S192.168.10.94"

Nov 10 15:31:34.763: RADIUS: User-Name [1] 6 "niki"

Nov 10 15:31:34.763: RADIUS: Vendor, Cisco [26] 13

Nov 10 15:31:34.763: RADIUS: ssg-command-code [252] 7

Nov 10 15:31:34.763: RADIUS: 01 6E 69 6B 69 [Account-Log-On niki]

Nov 10 15:31:34.763: ++++++ CoA Attribute List ++++++

Nov 10 15:31:34.763: 20A00F90 0 00000009 ssg-account-info(430) 14 S192.168.10.94

Nov 10 15:31:34.763: 20A022A8 0 00000009 username(396) 4 niki

Nov 10 15:31:34.763: 20A022B8 0 00000009 ssg-command-code(432) 5 01 6E 69 6B 69

Nov 10 15:31:34.763:

Nov 10 15:31:34.763: AAA SRV(0000007D): process response req

Nov 10 15:31:34.763: RADIUS/ENCODE(0000007D):Orig. component type = IEDGE_IP_SIP

Nov 10 15:31:34.763: RADIUS/ENCODE(0000007D): Unsupported AAA attribute clid-mac-addr

Nov 10 15:31:34.763: RADIUS(0000007D): sending

Nov 10 15:31:34.763: RADIUS(0000007D): Send CoA Nack Response to 172.30.1.130:45924 id 3, len 82

Nov 10 15:31:34.763: RADIUS: authenticator BE 0A F1 6B 91 A0 8E 33 - 9A 04 7D D4 D3 14 AD C6

Nov 10 15:31:34.763: RADIUS: Vendor, Cisco [26] 15

Nov 10 15:31:34.763: RADIUS: ssg-command-code [252] 9

Nov 10 15:31:34.763: RADIUS: 10 32 3B 6E 69 6B 69 [Error-Code 2;niki]

Nov 10 15:31:34.763: RADIUS: Vendor, Cisco [26] 25

Nov 10 15:31:34.763: RADIUS: ssg-account-info [250] 19 "$MA001f.5bd1.b96c"

Nov 10 15:31:34.763: RADIUS: Vendor, Cisco [26] 22

Nov 10 15:31:34.763: RADIUS: ssg-account-info [250] 16 "S192.168.10.94"

 

 

Error-Code 2 - это, на сколько я понимаю, AUTHENTICATE USER FAIL (судя по http://www.cisco.com/en/US/docs/ios/12_2sb...a/guide/isg...).

 

Вот control policy-map:

policy-map type control option82

class type control BYE event timed-policy-expiry

1 service disconnect

!

class type control always event session-start

21 service-policy type service name LOCALTRAFF_SERVICE

100 authorize aaa list option82 password cisco identifier mac-address

!

class type control always event session-restart

21 service-policy type service name LOCALTRAFF_SERVICE

100 authorize aaa list option82 password cisco identifier mac-address

!

class type control always event account-logon

10 authenticate aaa list weblogin

20 service-policy type service unapply name INETTRAFF3_SERVICE

!

 

(INETTRAFF3_SERVICE - это некий гипотетический сервис, который эпплаится юзеру при логине)

 

вот настройки aaa:

aaa group server radius option82

server-private 172.30.1.1 auth-port 1812 acct-port 1813 key xxx

ip radius source-interface GigabitEthernet0/0

attribute nas-port format d

!

aaa group server radius weblogin

server-private 172.30.1.1 auth-port 1812 acct-port 1813 key xxx

ip radius source-interface GigabitEthernet0/0

!

aaa authentication login default local

aaa authentication login option82 group option82

aaa authentication login weblogin group weblogin

aaa authorization network default group option82

aaa authorization network option82 group option82

aaa authorization network weblogin group weblogin

aaa authorization subscriber-service default local group option82

aaa authorization subscriber-service option82 group option82

aaa accounting update periodic 1

aaa accounting network option82 start-stop group option82

!

aaa nas port extended

!

!

!

aaa server radius dynamic-author

client 172.30.1.2 server-key xxx

client 172.30.1.130 server-key xxx

auth-type any

 

IOS c7301-advipservicesk9_li-mz.122-33.SRD.bin

Bambuk

Bambuk

Posted
Posted

В aaa server radius dynamic-author нужно указывать

ignore {session-key | server-key}

если соответствующих атрибутов нет в запросах. А в приведенном дебаге например 151 атрибута не видно.

 

Bambuk

Bambuk

Posted
Posted (edited)

А Вы вообще что хотите получить? Сценарий какой? А то может там нельзя account-logon делать или можно по другому.

 

 

Edited by Bambuk
ugenk

ugenk

Posted
  • Author
Posted
А Вы вообще что хотите получить? Сценарий какой? А то может там нельзя account-logon делать или можно по другому.
Я хочу, что бы выполнилось

class type control always event account-logon

10 authenticate aaa list weblogin

20 service-policy type service unapply name INETTRAFF3_SERVICE

и всё :)

ugenk

ugenk

Posted
  • Author
Posted

Когда приходит пакет account-logon (с портала, например)

Т.е. например, такая логика

[session start]

мы проверяем по option82, что абонент пришел с правильной части сети

(authorize ...)

применяем ему сервисы L4REDIRECT и PBHK

====

 

кастомер ввел на портале верные креденшиалы, и портал посылает на cisco account logon пакет

[account-logon]

авторизуемся у радиуса

работаем

 

вообщем-то как-то так :)

 

Да, я понимаю что можно реализовать нечто подобное 0xB Service Activate/ 0xC Deactivate пакетами - но это как-то некрасиво

 

Bambuk

Bambuk

Posted
Posted

C PBHK пробовал? ssg-account-info [250] 16 "S192.168.10.94" не может уникально идентифицировать сессию, т.к. может быть много сессий с этим IP в разных vrf. Нужно PBHK.

ugenk

ugenk

Posted
  • Author
Posted

Попробую завтра, но опять же - session query нормально выдается по такому идентификатору..

Смущает Nov 10 15:31:34.763: RADIUS: 10 32 3B 6E 69 6B 69 [Error-Code 2;niki]

Судя по сайту cisco (хотя там не всё понятно в этом плане), error code 2 - это ошибка авторизации.

 

А какой бы еще дебаг посмотреть на эту тему?

~AsmodeuS~

~AsmodeuS~

Posted
Posted

#!!! Account status query

/bin/echo "User-Name=\"test\",cisco-avpair=\"subscriber:command=account-profile-status-query\",Cisco-Account-Info=\"S10.10.0.1\"" | /usr/local/bin/radclient -x 10.10.10.10:1700 coa cisco555

 

#!!! Service status query

/bin/echo "User-Name=\"test\",cisco-avpair=\"subscriber:command=service-status-query\",cisco-avpair+=\"subscriber:service-name=Basic_Internet_Service\",Cisco-Account-Info=\"S10.10.0.1\"" | /usr/local/bin/radclient -x 10.10.10.10:1700 coa cisco555

 

#!!! LOg off

/bin/echo "User-Name=\"f_annychka\",cisco-avpair=\"subscriber:command=account-logoff\",Cisco-Account-Info=\"S10.10.0.1\"" | /usr/local/bin/radclient -x 10.10.10.10:1700 coa cisco555

 

 

 

а дальше по аналогии

~AsmodeuS~

~AsmodeuS~

Posted
Posted

/bin/echo "User-Name=\"f_annychka\",cisco-avpair=\"subscriber:command=account-logon\",Cisco-Account-Info=\"S10.10.0.1\",Idle-Timeout=200" | /usr/local/bin/radclient -x 10.10.10.10:1700 coa cisco555

 

 

может у тебя нет сервисов и по этому не активизирует

 

 

Bambuk

Bambuk

Posted
Posted

включи еще debug radius

Пользователи должны авторизоваться в твоем случае на aaa group server radius weblogin

Туда запросы шлются? Если нет, то наверно нужно еще и пароль в CoA account-login запрос включать.

 

Bambuk

Bambuk

Posted
Posted

Это не тебе было адресовано, а топикстартеру.

Чтоб не плохело можно сделать debug condition username ... и только от нужного логина будет дебаг.

ugenk

ugenk

Posted
  • Author
Posted
включи еще debug radius

Пользователи должны авторизоваться в твоем случае на aaa group server radius weblogin

Туда запросы шлются? Если нет, то наверно нужно еще и пароль в CoA account-login запрос включать.

Так дело в том, что не шлются. Даже не пытаются, судя по debug radius. С user-password пробовал - та же самая картина.

Видать нужно другой иос попробовать, SB какой-нибудь, и если не поможет - smartnet покупать, и запрос в TAC писать.

 

/bin/echo "User-Name=\"f_annychka\",cisco-avpair=\"subscriber:command=account-logon\",Cisco-Account-Info=\"S10.10.0.1\",Idle-Timeout=200" | /usr/local/bin/radclient -x 10.10.10.10:1700 coa cisco555

 

 

может у тебя нет сервисов и по этому не активизирует

в смысле "нет сервисов"? там есть policy-map, в котором написано, что должно произойти при получении account-logon'а.. там делается authorize, и уже при authorize собственно из радиуса в профиле пользователя получается в частности спискок сервисов, которе нужно активировать (ну и потом сами сервисы тоже из радиуса по необходимости).

 

ugenk

ugenk

Posted
  • Author
Posted

Поставил 12(2)31 SB13 IOS, дебаг стал интерестнее:

Nov 14 10:27:19.538: RADIUS: COA received from id 3 172.30.1.130:36233, CoA Request, len 61

Nov 14 10:27:19.538: COA: 172.30.1.130 request queued

Nov 14 10:27:19.538: RADIUS: authenticator 6C 27 9A D4 4A FC 71 A8 - D0 72 1D 0F C0 70 85 DD

Nov 14 10:27:19.538: RADIUS: Vendor, Cisco [26] 22

Nov 14 10:27:19.538: RADIUS: ssg-account-info [250] 16 "S192.168.10.88"

Nov 14 10:27:19.538: RADIUS: User-Name [1] 6 "niki"

Nov 14 10:27:19.538: RADIUS: Vendor, Cisco [26] 13

Nov 14 10:27:19.538: RADIUS: ssg-command-code [252] 7

Nov 14 10:27:19.538: RADIUS: 01 6E 69 6B 69 [Account-Log-On niki]

Nov 14 10:27:19.538: ++++++ CoA Attribute List ++++++

Nov 14 10:27:19.538: 6427C44C 0 00000009 ssg-account-info(418) 14 S192.168.10.88

Nov 14 10:27:19.538: 6427C6BC 0 00000009 username(386) 4 niki

Nov 14 10:27:19.538: 6427C6CC 0 00000009 ssg-command-code(420) 5 01 6E 69 6B 69

Nov 14 10:27:19.538:

Nov 14 10:27:19.538: RADIUS/ENCODE(0000000B):Orig. component type = IEDGE_IP_SIP

Nov 14 10:27:19.538: RADIUS(0000000B): sending

Nov 14 10:27:19.538: RADIUS(0000000B): Send CoA Nack Response to 172.30.1.130:36233 id 3, len 114

Nov 14 10:27:19.538: RADIUS: authenticator 25 E1 26 7F 47 11 2F F9 - C7 46 72 12 10 7A 9C 24

Nov 14 10:27:19.538: RADIUS: Vendor, Cisco [26] 15

Nov 14 10:27:19.538: RADIUS: ssg-command-code [252] 9

Nov 14 10:27:19.538: RADIUS: 10 32 3B 6E 69 6B 69 [Error-Code 2;niki]

Nov 14 10:27:19.538: RADIUS: Vendor, Cisco [26] 25

Nov 14 10:27:19.538: RADIUS: ssg-account-info [250] 19 "$MA0016.44c7.8336"

Nov 14 10:27:19.538: RADIUS: Vendor, Cisco [26] 22

Nov 14 10:27:19.538: RADIUS: ssg-account-info [250] 16 "S192.168.10.88"

Nov 14 10:27:19.538: RADIUS: Reply-Message [18] 26

Nov 14 10:27:19.538: RADIUS: 4D 65 6D 6F 72 79 20 6F 72 20 69 6E 74 65 72 6E [Memory or intern]

Nov 14 10:27:19.538: RADIUS: 61 6C 20 65 72 72 6F 72 [ al error]

Nov 14 10:27:19.538: RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405]

 

Ключевые слова - Memory or internal error и Unsupported Service

 

 

На всякий случай, посылаю coa вот такой программкой:

 

#include <stdio.h>

int main(int argc, char *argv[])

{

int c = 0x1;

printf("Cisco-Command-Code = %cniki\n",c);

printf("User-Name = niki\n");

printf("User-Password = xilinx\n");

printf("Cisco-Account-Info = S192.168.10.88\n");

return 0;

}

 

И собственно:

$ ./a.out|radclient 172.30.1.2:1700 coa xilinx

Received response ID 151, code 45, length = 114

Cisco-Command-Code = "\0202;niki"

Cisco-Account-Info = "$MA0016.44c7.8336"

Cisco-Account-Info = "S192.168.10.88"

Reply-Message = "Memory or internal error"

Error-Cause = Unsupported-Service

 

 

Да, и на всякий случай:

c7301.isg#sh ip subscriber ip 192.168.10.88

IP subscriber: 0016.44c7.8336, type connected, status up

display uid: 1, aaa uid: 11

session initiator: dhcp discovery

access address: 192.168.10.88

service address: 192.168.10.88

conditional debug flag: 0x0

control plane state: connected, start time: 00:18:17

data plane state: connected, start time: 00:18:14

arp entry: 192.168.10.88, GigabitEthernet0/1.1

forwarding statistics:

packets total: received 136, sent 141

bytes total: received 14580, sent 31735

packets dropped: 0, bytes dropped: 0

 

c7301.isg#sh sss session uid 1

Unique Session ID: 1

Identifier: 0016.44c7.8336

SIP subscriber access type(s): IP

Current SIP options: Req Fwding/Req Fwded

Session Up-time: 00:20:41, Last Changed: 00:20:39

 

Policy information:

Authentication status: authen

Active services associated with session:

name "INETTRAFF3_SERVICE"

name "LOCALTRAFF_SERVICE", applied before account logon

Rules, actions and conditions executed:

subscriber rule-map option82

condition always event session-start

21 service-policy type service name LOCALTRAFF_SERVICE

100 authorize aaa list option82 identifier mac-address

 

Session inbound features:

Feature: IP Idle Timeout

Timeout value is 600

Idle time is 00:00:27

Feature: Session accounting

Method List: option82

Packets = 137, Bytes = 11819

 

Traffic classes:

Traffic class session ID: 2

ACL Name: LOCALTRAFF_ACL_IN, Packets = 3, Bytes = 175

Traffic class session ID: 3

ACL Name: INETTRAFF_ACL_IN, Packets = 134, Bytes = 11644

Default traffic is dropped

Unmatched Packets = 0, Re-classified packets (redirected) = 0

 

Session outbound features:

Feature: Session accounting

Method List: option82

Packets = 144, Bytes = 29785

 

Traffic classes:

Traffic class session ID: 2

ACL Name: LOCALTRAFF_ACL_OUT, Packets = 3, Bytes = 903

Traffic class session ID: 3

ACL Name: INETTRAFF_ACL_OUT, Packets = 141, Bytes = 28882

Default traffic is dropped

Unmatched Packets = 0, Re-classified packets (redirected) = 0

 

Non-datapath features:

Feature: Session Timeout

Timeout value is 86400 seconds

Time remaining is 23:39:18

Configuration sources associated with this session:

Service: INETTRAFF3_SERVICE, Active Time = 00:20:41

AAA Service ID = 3858759681

Service: LOCALTRAFF_SERVICE, Active Time = 00:20:41

AAA Service ID = 3321888768

Interface: GigabitEthernet0/1.1, Active Time = 00:20:41

 

  • 3 years later...
Dgoni_sp

Dgoni_sp

Posted
Posted (edited)

У меня на оборот посылаю запрос CoA Account-logon

 

08:38:12: RADIUS: COA received from id 66 192.168.186.128:53736, CoA Request, len 106

08:38:12: COA: 192.168.186.128 request queued

08:38:12: RADIUS: authenticator D1 4A B0 48 65 59 89 EA - 8A 4B 8A CF EC 74 C6 C6

08:38:12: RADIUS: User-Name [1] 7 "poe02"

08:38:12: RADIUS: User-Password [2] 18 *

08:38:12: RADIUS: Vendor, Cisco [26] 40

08:38:12: RADIUS: Cisco AVpair [1] 34 "subscriber:command=account-logon"

08:38:12: RADIUS: Vendor, Cisco [26] 21

08:38:12: RADIUS: ssg-account-info [250] 15 "S172.10.10.19"

 

Кошка его проглатывает, но тут же выдаёт ответ CoA-ACK

 

08:38:12: RADIUS(00000024): Send CoA Ack Response to 192.168.186.128:53736 id 66, len 82

08:38:12: RADIUS: authenticator AE 91 93 D5 68 5A 40 24 - 6B 0E 89 10 1B 40 0F 38

08:38:12: RADIUS: Vendor, Cisco [26] 14

08:38:12: RADIUS: ssg-command-code [252] 8

08:38:12: RADIUS: 01 70 6F 65 30 32 [Account-Log-On poe02]

08:38:12: RADIUS: Vendor, Cisco [26] 27

08:38:12: RADIUS: ssg-account-info [250] 21 "$IVirtual-Access1.1"

08:38:12: RADIUS: Vendor, Cisco [26] 21

08:38:12: RADIUS: ssg-account-info [250] 15 "S172.10.10.19"

 

Карта для события account-logon почему-то не срабатывает

Правило

 

policy-map type control MY_PPPoE_RULE

class type control always event session-start

10 authenticate aaa list PPPoE

20 authorize aaa list PPPoE password cisco identifier nas-port

30 service-policy type service name UNAUTHOR

40 service-policy type service aaa list SERVICE-LOCAL name L4REDIRECT

50 set-timer SET-TIMER 5

!

class type control always event timed-policy-expiry

10 service disconnect

!

class type control always event account-logon

10 authenticate aaa list WEB_LOGON

20 service-policy type service unapply name L4REDIRECT

!

 

Странно

Edited by Dgoni_sp
Dgoni_sp

Dgoni_sp

Posted
Posted

Так же думаю, может пользователь должен находится в состоянии noauth ?

Просто у меня он в auth

 

 

Router-GW-7206VXR#sh subsc ses user poe02 det

Unique Session ID: 21

Identifier: poe02

SIP subscriber access type(s): PPPoE/PPP

Current SIP options: Req Fwding/Req Fwded

Session Up-time: 00:00:24, Last Changed: 00:00:24

Interface: Virtual-Access1.1

 

Policy information:

Context 65D05F54: Handle 17000042

AAA_id 00000023: Flow_handle 0

Authentication status: authen

Downloaded User profile, excluding services:

username "0/0/0"

reply-message "Authentication succeeded"

Downloaded User profile, including services:

username "0/0/0"

reply-message "Authentication succeeded"

service-type 2 [Framed]

Framed-Protocol 1 [PPP]

Framed-MTU 1492 (0x5D4)

link-compression 5 [no-vj]

netmask 255.255.255.255

addr-pool "CLIENT-PPPoE"

traffic-class "input access-group 101"

l4redirect "redirect to group PORTAL"

Config history for session (recent to oldest):

Access-type: PPP Client: SM

Policy event: Got More Keys (Service)

Profile name: L4REDIRECT, 3 references

username "L4REDIRECT"

password <hidden>

traffic-class "input access-group 101"

l4redirect "redirect to group PORTAL"

Access-type: PPP Client: SM

Policy event: Got More Keys (Service)

Profile name: UNAUTHOR, 3 references

service-type 2 [Framed]

Framed-Protocol 1 [PPP]

Framed-MTU 1492 (0x5D4)

link-compression 5 [no-vj]

netmask 255.255.255.255

addr-pool "CLIENT-PPPoE"

reply-message "AUTHORIZATION"

Access-type: PPP Client: SM

Policy event: Got More Keys

Profile name: apply-config-only, 2 references

username "0/0/0"

reply-message "Authentication succeeded"

Active services associated with session:

name "L4REDIRECT"

name "UNAUTHOR"

Rules, actions and conditions executed:

subscriber rule-map MY_PPPoE_RULE

condition always event session-start

10 authenticate aaa list PPPoE

20 authorize aaa list PPPoE identifier nas-port

30 service-policy type service name UNAUTHOR

40 service-policy type service aaa list SERVICE-LOCAL name L4REDIRECT

50 set-timer SET-TIMER 5

 

Session inbound features:

Feature: Layer 4 Redirect

Rule table is empty

Traffic classes:

Traffic class session ID: 22

ACL Name: 101, Packets = 30, Bytes = 3624

Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 30

 

Non-datapath features:

Feature: Compression

Header compression: no-vj

Feature: IP Config

Peer IP Address: 0.0.0.0 (F/F)

Address Pool: CLIENT-PPPoE (F)

Unnumbered Intf: [None]

Configuration sources associated with this session:

Service: L4REDIRECT, Active Time = 00:00:24

Service: UNAUTHOR, Active Time = 00:00:24

Interface: Virtual-Template1, Active Time = 00:00:24

 

Router-GW-7206VXR#

Router-GW-7206VXR#

Router-GW-7206VXR#

Router-GW-7206VXR#sh users

Line User Host(s) Idle Location

* 0 con 0 idle 00:00:00

 

Interface User Mode Idle Peer Address

Vi1.1 poe02 PPPoE - 172.10.10.18

 

Router-GW-7206VXR#

 

Если делать CoA запрос на получении информации о сессии, получается следующее

Запрос

08:36:10: RADIUS: COA received from id 32 192.168.186.128:49994, CoA Request, len 103

08:36:10: COA: 192.168.186.128 request queued

08:36:10: RADIUS: authenticator E2 08 8D A6 86 E9 7A 23 - 50 E6 01 FF D5 5A 54 38

08:36:10: RADIUS: User-Name [1] 7 "poe02"

08:36:10: RADIUS: Vendor, Cisco [26] 55

08:36:10: RADIUS: Cisco AVpair [1] 49 "subscriber:command=account-profile-status-query"

08:36:10: RADIUS: Vendor, Cisco [26] 21

08:36:10: RADIUS: ssg-account-info [250] 15 "S172.10.10.19"

 

Ответ

 

08:36:10: RADIUS(00000024): Send CoA Ack Response to 192.168.186.128:49994 id 32, len 298

08:36:10: RADIUS: authenticator F8 D9 B2 EA 5D 74 C0 91 - C2 4C 2D 5E A0 B4 AB 91

08:36:10: RADIUS: Vendor, Cisco [26] 47

08:36:10: RADIUS: ssg-account-info [250] 41 "N1L4REDIRECT;113;poe02;100;54;8708;5138"

08:36:10: RADIUS: Vendor, Cisco [26] 45

08:36:10: RADIUS: ssg-account-info [250] 39 "N1UNAUTHOR;113;poe02;100;54;8708;5138"

08:36:10: RADIUS: User-Name [1] 7 "poe02"

08:36:10: RADIUS: Vendor, Cisco [26] 27

08:36:10: RADIUS: ssg-account-info [250] 21 "$IVirtual-Access1.1"

08:36:10: RADIUS: Vendor, Cisco [26] 10

08:36:10: RADIUS: ssg-command-code [252] 4

08:36:10: RADIUS: 04 31 [Account-Ping 1]

08:36:10: RADIUS: User-Name [1] 7 "0/0/0"

08:36:10: RADIUS: Reply-Message [18] 26

08:36:10: RADIUS: 41 75 74 68 65 6E 74 69 63 61 74 69 6F 6E 20 73 [Authentication s]

08:36:10: RADIUS: 75 63 63 65 65 64 65 64 [ ucceeded]

08:36:10: RADIUS: Vendor, Cisco [26] 21

08:36:10: RADIUS: ssg-account-info [250] 15 "S172.10.10.19"

08:36:10: RADIUS: Vendor, Cisco [26] 22

08:36:10: RADIUS: Cisco AVpair [1] 16 "sg-version=1.0"

08:36:10: RADIUS: Vendor, Cisco [26] 30

08:36:10: RADIUS: cisco-nas-port [2] 24 "nas-port:0.0.0.0:0/0/0"

08:36:10: RADIUS: NAS-Port [5] 6 0

08:36:10: RADIUS: NAS-Port-Id [87] 24 "nas-port:0.0.0.0:0/0/0"

08:36:10: RADIUS: Framed-IP-Address [8] 6 172.10.10.19

 

В ответе есть параметр Account-Ping значение которого равно 1, хотя по докам 0. Наверное из-за того что 0 - это noauth, а 1 - auth.

Но это настолько категорично ?

  • 8 years later...
gadrus42

gadrus42

Posted
Posted

Добрый день! Похожая проблема.

 

 

Sending CoA-Request of id 67 to 10.0.9.99 port 1777
    User-Name = "100.110.0.1"
    Cisco-Account-Info = "S100.110.0.1"
    Cisco-AVPair = "subscriber:command=account-logoff"
rad_recv: CoA-NAK packet from host 10.0.9.99 port 1777, id=67, length=99
    User-Name = "100.110.0.1"
    Cisco-Account-Info = "S100.110.0.1"
    Cisco-Command-Code = "\0202;100.110.0.1"
    Reply-Message = "No valid Session"
    Error-Cause = Unsupported-Service
 

 

Feb 19 12:13:23: RADIUS: COA  received from id 67 10.0.9.1:43076, CoA Request, len 94
Feb 19 12:13:23: RADIUS/ENCODE(00000000):Orig. component type = Invalid
Feb 19 12:13:23: RADIUS(00000000): sending
Feb 19 12:13:23: RADIUS(00000000): Send CoA Nack Response to 10.0.9.1:43076 id 67, len 99
Feb 19 12:13:23: RADIUS:  authenticator 06 73 27 4F 52 2F 95 A7 - 63 B0 92 21 50 54 5A B2
Feb 19 12:13:23: RADIUS:  User-Name           [1]   13  "100.110.0.1"
Feb 19 12:13:23: RADIUS:  Vendor, Cisco       [26]  20  
Feb 19 12:13:23: RADIUS:   ssg-account-info   [250] 14  "S100.110.0.1"
Feb 19 12:13:23: RADIUS:  Vendor, Cisco       [26]  22  
TCS0.IZK.ToB#
Feb 19 12:13:23: RADIUS:   ssg-command-code   [252] 16  
Feb 19 12:13:23: RADIUS:   10 32 3B 31 30 30 2E 31 31 30 2E 30 2E 31     [Error-Code 2;100.110.0.1]
Feb 19 12:13:23: RADIUS:  Reply-Message       [18]  18  
Feb 19 12:13:23: RADIUS:   4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E  [ No valid Session]
Feb 19 12:13:23: RADIUS:  Dynamic-Author-Error[101] 6   Unsupported Service       [405]
 

 

 

#!/bin/bash


nas_id=10.0.9.99
nas_port=1777
nas_secret=ХХХХХХ
sess_id="$1"
/bin/echo "User-Name="$1", Cisco-Account-Info=S"$1", cisco-avpair=\"subscriber:command=account-logoff\"" | /usr/bin/radclient -x "$nas_id":"$nas_port" coa "$nas_secret"

 

 

 

Подскажите куда копать?

 

На ASR1001:

class type control always event account-logoff 1 service disconnect delay 5

VolanD666

VolanD666

Posted
Posted
В 19.02.2020 в 11:15, gadrus42 сказал:

Добрый день! Похожая проблема.

 

 

Sending CoA-Request of id 67 to 10.0.9.99 port 1777
    User-Name = "100.110.0.1"
    Cisco-Account-Info = "S100.110.0.1"
    Cisco-AVPair = "subscriber:command=account-logoff"
rad_recv: CoA-NAK packet from host 10.0.9.99 port 1777, id=67, length=99
    User-Name = "100.110.0.1"
    Cisco-Account-Info = "S100.110.0.1"
    Cisco-Command-Code = "\0202;100.110.0.1"
    Reply-Message = "No valid Session"
    Error-Cause = Unsupported-Service
 

 

Feb 19 12:13:23: RADIUS: COA  received from id 67 10.0.9.1:43076, CoA Request, len 94
Feb 19 12:13:23: RADIUS/ENCODE(00000000):Orig. component type = Invalid
Feb 19 12:13:23: RADIUS(00000000): sending
Feb 19 12:13:23: RADIUS(00000000): Send CoA Nack Response to 10.0.9.1:43076 id 67, len 99
Feb 19 12:13:23: RADIUS:  authenticator 06 73 27 4F 52 2F 95 A7 - 63 B0 92 21 50 54 5A B2
Feb 19 12:13:23: RADIUS:  User-Name           [1]   13  "100.110.0.1"
Feb 19 12:13:23: RADIUS:  Vendor, Cisco       [26]  20  
Feb 19 12:13:23: RADIUS:   ssg-account-info   [250] 14  "S100.110.0.1"
Feb 19 12:13:23: RADIUS:  Vendor, Cisco       [26]  22  
TCS0.IZK.ToB#
Feb 19 12:13:23: RADIUS:   ssg-command-code   [252] 16  
Feb 19 12:13:23: RADIUS:   10 32 3B 31 30 30 2E 31 31 30 2E 30 2E 31     [Error-Code 2;100.110.0.1]
Feb 19 12:13:23: RADIUS:  Reply-Message       [18]  18  
Feb 19 12:13:23: RADIUS:   4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E  [ No valid Session]
Feb 19 12:13:23: RADIUS:  Dynamic-Author-Error[101] 6   Unsupported Service       [405]
 

 

 

#!/bin/bash


nas_id=10.0.9.99
nas_port=1777
nas_secret=ХХХХХХ
sess_id="$1"
/bin/echo "User-Name="$1", Cisco-Account-Info=S"$1", cisco-avpair=\"subscriber:command=account-logoff\"" | /usr/bin/radclient -x "$nas_id":"$nas_port" coa "$nas_secret"

 

 

 

Подскажите куда копать?

 

На ASR1001:

class type control always event account-logoff 1 service disconnect delay 5

Дык а сессия точно такая есть?

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...
На сайте используются файлы cookie и сервисы аналитики для корректной работы форума и улучшения качества обслуживания. Продолжая использовать сайт, вы соглашаетесь с использованием файлов cookie и с Политикой конфиденциальности.