[zhenya`]

logging trap debug

И смотреть на сислог сервере

[Andrey75]

все дошло http://www.lissyara.su/articles/freebsd/hardware/cisco+syslog/

, СПАСИБО буду искать

денек на работе активный

[Andrey75]

поставил атрибуты

Auth-Type = Local, User-Password := "ISG"

 

теперь запрос на радиус идет, но абонет не авторизуется

 

 

радиус -Х

 

rad_recv: Access-Request packet from host 10.1.0.1 port 1645, id=195, length=147

User-Name = "172.1.0.102"

User-Password = "ISG"

Framed-IP-Address = 172.1.0.102

Cisco-Account-Info = "S172.1.0.102"

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Outbound-User

NAS-IP-Address = 10.1.0.1

Acct-Session-Id = "0000000000003BDE"

# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default

+group authorize {

++[preprocess] = ok

++[chap] = noop

++[mschap] = noop

++[digest] = noop

[eap] No EAP-Message, not doing EAP

++[eap] = noop

   expand: %{User-Name} -> 172.1.0.102

[sql] sql_set_user escaped user --> '172.1.0.102'

rlm_sql (sql): Reserving sql socket id: 1

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] expand: SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `priority` -> SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '172.1.0.102' ORDER BY `priority`

rlm_sql (sql): Released sql socket id: 1

[sql] User 172.1.0.102 not found

++[sql] = notfound

++[expiration] = noop

++[logintime] = noop

[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.

++[pap] = noop

+} # group authorize = ok

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user

Failed to authenticate the user.

Login incorrect: [172.1.0.102/ISG] (from client Cisco 7201 Kharino port 0)

Using Post-Auth-Type Reject

# Executing group from file /usr/local/etc/raddb/sites-enabled/default

+group REJECT {

[attr_filter.access_reject] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 11

++[attr_filter.access_reject] = updated

+} # group REJECT = updated

Delaying reject of request 17 for 1 seconds

Going to the next request

Waking up in 0.9 seconds.

Sending delayed reject for request 17

Sending Access-Reject of id 195 to 10.1.0.1 port 1645

Waking up in 4.9 seconds.

ошибка в "ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user"

 

 

 

[b]sh radius server-group all[/b]

Server group radius

Sharecount = 1 sg_unconfigured = FALSE

Type = standard Memlocks = 1

Server group RADIUS_IPOE

Sharecount = 1 sg_unconfigured = FALSE

Type = standard Memlocks = 1

Server(10.1.0.2:1812,1813) Transactions:

Authen: 0 Author: 15067 Acct: 0

Server_auto_test_enabled: FALSE

Keywrap enabled: FALSE

 

[b]sh radius st[/b]

Auth. Acct. Both

Maximum inQ length: NA NA 1

Maximum waitQ length: NA NA 2

Maximum doneQ length: NA NA 1

Total responses seen: 15059 0 15059

Packets with responses: 15059 0 15059

Packets without responses: 2 0 2

Access Rejects : 15059

Average response delay(ms): 1011 0 1011

Maximum response delay(ms): 3104 0 3104

Number of Radius timeouts: 8 0 8

Duplicate ID detects: 0 0 0

Buffer Allocation Failures: 0 0 0

Maximum Buffer Size (bytes): 165 0 165

Malformed Responses : 0 0 0

Bad Authenticators : 0 0 0

Unknown Responses : 0 0 0

Source Port Range: (2 ports only)

1645 - 1646

Last used Source Port/Identifier:

1645/213

1646/0

 

Elapsed time since counters last cleared: 1d1h7m

Radius Latency Distribution:

<= 2ms : 0 0

3-5ms : 0 0

5-10ms : 0 0

10-20ms: 0 0

20-50ms: 0 0

50-100m: 0 0

>100ms : 15059 0

 

Current inQ length : 0

Current doneQ length: 0

 

 

 

[b]это значит не тот атрибут[/b]

WARNING! No "known good" password found for the user. Authentication may fail because of this.

Изменено 29 июня, 2017 пользователем Andrey75

[Andrey75]

не досмотрел настройки в биллинге, абонент авторизован

сейчас разобраться с группами и скорость

 

подскажите атрибуты для ip access-list extended

Изменено 29 июня, 2017 пользователем Andrey75

[zhenya`]

чего? ты хочешь per session firewall ? или сервисы настраиваешь в радиусе ?

[Andrey75]

чего? ты хочешь per session firewall ? или сервисы настраиваешь в радиусе ?

сервисы радиуса

с какими атрибутами работать для сервисов и ограничения скорости

Изменено 29 июня, 2017 пользователем Andrey75

[Andrey75]

нехочет

 

радиус

rad_recv: Accounting-Request packet from host 10.1.0.1 port 1646, id=6, length=315

Acct-Session-Id = "0000000000003F16"

Framed-IP-Address = 172.1.0.102

Framed-Protocol = PPP

Acct-Input-Packets = 1031

Acct-Output-Packets = 964

Acct-Input-Octets = 123712

Acct-Output-Octets = 169831

Cisco-Control-Info = "I0;123712"

Cisco-Control-Info = "O0;169831"

User-Name = "172.1.0.102"

Acct-Authentic = RADIUS

Cisco-AVPair = "connect-progress=Call Up"

Acct-Session-Time = 337

Acct-Terminate-Cause = Admin-Reset

Cisco-AVPair = "disc-cause-ext=Local Admin Disc"

Acct-Status-Type = Stop

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Framed-User

NAS-IP-Address = 10.1.0.1

PMIP6-Home-HN-Prefix = 3933:3545:3943::/66

Event-Timestamp = "Jun 29 2017 20:41:04 YEKT"

NAS-Identifier = "KharinoIPoE.KharinoIPoE"

Acct-Delay-Time = 0

# Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default

+group preacct {

++[preprocess] = ok

[acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "KharinoIPoE.KharinoIPoE",NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "0000000000003F16",User-Name = "172.1.0.102"'

[acct_unique] Acct-Unique-Session-ID = "e04c2da8137796c0".

++[acct_unique] = ok

+} # group preacct = ok

# Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default

+group accounting {

++[exec] = noop

[attr_filter.accounting_response] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 12

++[attr_filter.accounting_response] = updated

+} # group accounting = updated

Sending Accounting-Response of id 6 to 10.1.0.1 port 1646

Finished request 349.

Cleaning up request 349 ID 6 with timestamp +51175

Going to the next request

Ready to process requests.

rad_recv: Access-Request packet from host 10.1.0.1 port 1645, id=10, length=147

User-Name = "172.1.0.102"

User-Password = "ISG"

Framed-IP-Address = 172.1.0.102

Cisco-Account-Info = "S172.1.0.102"

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Outbound-User

NAS-IP-Address = 10.1.0.1

Acct-Session-Id = "0000000000003F38"

# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default

+group authorize {

++[preprocess] = ok

++[chap] = noop

++[mschap] = noop

++[digest] = noop

[eap] No EAP-Message, not doing EAP

++[eap] = noop

   expand: %{User-Name} -> 172.1.0.102

[sql] sql_set_user escaped user --> '172.1.0.102'

rlm_sql (sql): Reserving sql socket id: 4

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] User found in radcheck table

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_reply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_reply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] expand: SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `priority` -> SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '172.1.0.102' ORDER BY `priority`

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupcheck` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '%{Sql-Group}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupcheck` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '1:167837697' ORDER BY `id`

[sql] User found in group 1:167837697

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupreply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '%{Sql-Group}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupreply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '1:167837697' ORDER BY `id`

rlm_sql (sql): Released sql socket id: 4

++[sql] = ok

++[expiration] = noop

++[logintime] = noop

[pap] WARNING: Auth-Type already set. Not setting to PAP

++[pap] = noop

+} # group authorize = ok

Found Auth-Type = Accept

Auth-Type = Accept, accepting the user

Login OK: [172.1.0.102] (from client Cisco 7201 Kharino port 0)

# Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default

+group post-auth {

++[exec] = noop

+} # group post-auth = noop

Sending Access-Accept of id 10 to 10.1.0.1 port 1645

Cisco-AVPair += "ip:traffic-class=in access-group name OFF-LINE_IN"

Cisco-AVPair += "ip:traffic-class=in default drop"

Cisco-AVPair += "ip:traffic-class=out access-group name OFF-LINE_OUT"

Cisco-AVPair += "ip:traffic-class=out default drop"

Cisco-AVPair += "subscriber:accounting-list=ISG_IPOE"

Finished request 350.

Going to the next request

Waking up in 4.9 seconds.

rad_recv: Accounting-Request packet from host 10.1.0.1 port 1646, id=7, length=206

Acct-Session-Id = "0000000000003F38"

Framed-IP-Address = 172.1.0.102

Framed-Protocol = PPP

User-Name = "172.1.0.102"

Cisco-AVPair = "connect-progress=Call Up"

Acct-Authentic = RADIUS

Acct-Status-Type = Start

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Framed-User

NAS-IP-Address = 10.1.0.1

PMIP6-Home-HN-Prefix = 3830:3242:3136::/55

Event-Timestamp = "Jun 29 2017 20:41:04 YEKT"

NAS-Identifier = "KharinoIPoE.KharinoIPoE"

Acct-Delay-Time = 0

# Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default

+group preacct {

++[preprocess] = ok

[acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "KharinoIPoE.KharinoIPoE",NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "0000000000003F38",User-Name = "172.1.0.102"'

[acct_unique] Acct-Unique-Session-ID = "91520635eb952673".

++[acct_unique] = ok

+} # group preacct = ok

# Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default

+group accounting {

++[exec] = noop

[attr_filter.accounting_response] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 12

++[attr_filter.accounting_response] = updated

+} # group accounting = updated

Sending Accounting-Response of id 7 to 10.1.0.1 port 1646

Finished request 351.

Cleaning up request 351 ID 7 with timestamp +51175

Going to the next request

Waking up in 4.9 seconds.

Cleaning up request 350 ID 10 with timestamp +51175

Ready to process requests.

 

 

 

 

[b]циска[/b]

sh subscriber ses ui 137

Type: IP, UID: 137, State: authen, Identity: 172.1.0.102

IPv4 Address: 172.1.0.102

Session Up-time: 00:00:29, Last Changed: 00:00:29

Switch-ID: 20353

 

Policy information:

Authentication status: authen

Rules, actions and conditions executed:

subscriber rule-map CTRL_IPOE

condition always event session-start

10 authorize aaa list ISG_IPOE identifier source-ip-address

 

Classifiers:

Class-id Dir Packets Bytes Pri. Definition

0 In 64 7611 0 Match Any

1 Out 66 11404 0 Match Any

 

Features:

 

Accounting:

Class-id Dir Packets Bytes Source

0 In 64 7611 Peruser

1 Out 66 11404 Peruser

 

Configuration Sources:

Type Active Time AAA Service ID Name

USR 00:00:29 - Peruser

INT 00:00:29 - GigabitEthernet0/3.250

 

 

не присваивает имя access-group name

 

конфиг циски поменял

 

class-map type traffic match-any ACL-ON-LINE

match access-group input name ON-LINE_IN

match access-group output name ON-LINE_OUT

!

class-map type traffic match-any ACL-OFF-LINE

match access-group input name OFF-LINE_IN

match access-group output name OFF-LINE_OUT

!

class-map type traffic match-any ACL-DOWN

match access-group input name DOWN_IN

match access-group output name DOWN_OUT

!

class-map type traffic match-any ACL-PASSIVE

match access-group input name PASSIVE_IN

match access-group output name PASSIVE_OUT

!

class-map type traffic match-any RADUIS_DEFAULT

match access-group input 103

match access-group output 104

!

class-map type traffic match-any REDIRECT-PASSIVE

match access-group input name PASSIVE

!

class-map type traffic match-any REDIRECT-DOWN

match access-group input name DOWN

!

class-map type traffic match-any REDIRECT-OFF-LINE

match access-group input name OFF-LINE

!

class-map type control match-all ACC-ON-LINE

match authen-status authenticated

match timer TIMER_AUTH

!

class-map type control match-all ACC-UNAUTH

match authen-status unauthenticated

match timer UNAUTH-TIMER

 

ip access-list extended DOWN_IN

permit ip host 10.1.0.2 any

permit ip any host 10.1.0.2

permit tcp any any eq www

deny ip any any

ip access-list extended DOWN_OUT

permit ip host 10.1.0.2 any

permit ip any host 10.1.0.2

permit tcp any any eq www

deny ip any any

ip access-list extended OFF-LINE_IN

permit ip any host 10.1.0.2

permit ip host 10.1.0.2 any

permit tcp any any eq www

deny ip any any

ip access-list extended OFF-LINE_OUT

permit ip any host 10.1.0.2

permit ip host 10.1.0.2 any

permit tcp any any eq www

deny ip any any

ip access-list extended ON-LINE_IN

permit ip any any

ip access-list extended ON-LINE_OUT

permit ip any any

ip access-list extended PASSIVE_IN

permit ip host 10.1.0.2 any

permit ip any host 10.1.0.2

permit tcp any any eq www

deny ip any any

ip access-list extended PASSIVE_OUT

permit ip host 10.1.0.2 any

permit ip any host 10.1.0.2

permit tcp any any eq www

deny ip any any

 

 

Изменено 29 июня, 2017 пользователем Andrey75

[Giga-Byte]

Дело в том, что не найден метод для аккаунтинга:

*May 12 11:20:01.928: AAA/ACCT/NET(00000033): Method list not found

 

тоесть если сделать что-то так:

aaa accounting network default start-stop group SERVER_GROUP1

имхо должно заработать.

а вообще я намучался и обновился до последней версии 03.16.05.S.155-3.S5, там как-то предсказуемо начали работать и радиус и сервисы.

 

 

ну ещё попробуйте (просто попробуйте, я не говорю что решит проблему) заменить

 

 

aaa group server radius SERVER_GROUP1

server 10.11.0.2 auth-port 1812 acct-port 1813

 

 

на:

 

 

aaa group server radius RAD_grp1

server name RAD1

 

radius server RAD1

address ipv4 10.60.249.11 auth-port 1645 acct-port 1646

key 7 15000A08142B3837

 

 

ну и удалить

radius-server host 10.11.0.2 auth-port 1812 acct-port 1813 key 7 12485744

если уж ушли на группы.

 

 

у меня работает вот так (правда PPPoE, но думаю сути не меняет):

 

 

aaa group server radius RAD_grp1

server name RAD1

server name RAD2

server name RAD3

ip vrf forwarding To-RADIUS

deadtime 2

load-balance method least-outstanding ignore-preferred-server

!

aaa group server radius OLD

server name RAD1_old

server name RAD2_old

server name RAD3_old

deadtime 2

load-balance method least-outstanding ignore-preferred-server

!

aaa authentication login default local

aaa authentication login console enable

aaa authentication ppp PPPoE_0 group OLD

aaa authentication ppp PPPoE_1 group RAD_grp1

aaa authorization exec default local

aaa authorization network PPPoE_0 group OLD

aaa authorization network PPPoE_1 group RAD_grp1

aaa authorization subscriber-service PPPoE_0 local

aaa authorization subscriber-service PPPoE_1 group RAD_grp1

aaa accounting delay-start

aaa accounting jitter maximum 60

aaa accounting update newinfo periodic 2

aaa accounting network PPPoE_0 start-stop group RAD_grp0

aaa accounting network PPPoE_1 start-stop group RAD_grp1

!

aaa nas port extended

!

!

!

aaa server radius dynamic-author

client 10.0.249.11 vrf To-RADIUS server-key 7 15000A08142B337

client 10.0.249.12 vrf To-RADIUS server-key 7 15000A08142B337

client 10.0.249.13 vrf To-RADIUS server-key 7 15000A08142B337

auth-type any

ignore session-key

ignore server-key

!

 

radius-server attribute 6 on-for-login-auth

radius-server attribute 32 include-in-access-req

radius-server attribute nas-port format e VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV

radius-server retransmit 1

radius-server timeout 2

radius-server deadtime 1

radius-server vsa send cisco-nas-port

radius-server load-balance method least-outstanding ignore-preferred-server

!

radius server RAD1

address ipv4 10.0.249.11 auth-port 1645 acct-port 1646

key 7 15000A08142B387

!

radius server RAD2

address ipv4 10.0.249.12 auth-port 1645 acct-port 1646

key 7 15000A08142B387

!

radius server RAD3

address ipv4 10.0.249.13 auth-port 1645 acct-port 1646

key 7 15000A08142B387

!

radius server RAD1_old

address ipv4 192.168.100.31 auth-port 1645 acct-port 1646

key 7 104A061D0A131D0

!

radius server RAD2_old

address ipv4 192.168.100.32 auth-port 1645 acct-port 1646

key 7 104A061D0A131D0

!

radius server RAD3_old

address ipv4 192.168.100.33 auth-port 1645 acct-port 1646

key 7 104A061D0A131D0

!

 

 

цель такого конфига: плавный переход на новый RADIUS сервер.

раньше сервисы были локальные. с новыми радиус-сервером - сервисы подтягиваются с него.

[Andrey75]

Дело в том, что не найден метод для аккаунтинга:

*May 12 11:20:01.928: AAA/ACCT/NET(00000033): Method list not found

 

тоесть если сделать что-то так:

aaa accounting network default start-stop group SERVER_GROUP1

имхо должно заработать.

а вообще я намучался и обновился до последней версии 03.16.05.S.155-3.S5, там как-то предсказуемо начали работать и радиус и сервисы.

 

 

ну ещё попробуйте (просто попробуйте, я не говорю что решит проблему) заменить

 

 

aaa group server radius SERVER_GROUP1

server 10.11.0.2 auth-port 1812 acct-port 1813

 

 

на:

 

 

aaa group server radius RAD_grp1

server name RAD1

 

radius server RAD1

address ipv4 10.60.249.11 auth-port 1645 acct-port 1646

key 7 15000A08142B3837

 

 

ну и удалить

radius-server host 10.11.0.2 auth-port 1812 acct-port 1813 key 7 12485744

если уж ушли на группы.

 

 

у меня работает вот так (правда PPPoE, но думаю сути не меняет):

 

 

aaa group server radius RAD_grp1

server name RAD1

server name RAD2

server name RAD3

ip vrf forwarding To-RADIUS

deadtime 2

load-balance method least-outstanding ignore-preferred-server

!

aaa group server radius OLD

server name RAD1_old

server name RAD2_old

server name RAD3_old

deadtime 2

load-balance method least-outstanding ignore-preferred-server

!

aaa authentication login default local

aaa authentication login console enable

aaa authentication ppp PPPoE_0 group OLD

aaa authentication ppp PPPoE_1 group RAD_grp1

aaa authorization exec default local

aaa authorization network PPPoE_0 group OLD

aaa authorization network PPPoE_1 group RAD_grp1

aaa authorization subscriber-service PPPoE_0 local

aaa authorization subscriber-service PPPoE_1 group RAD_grp1

aaa accounting delay-start

aaa accounting jitter maximum 60

aaa accounting update newinfo periodic 2

aaa accounting network PPPoE_0 start-stop group RAD_grp0

aaa accounting network PPPoE_1 start-stop group RAD_grp1

!

aaa nas port extended

!

!

!

aaa server radius dynamic-author

client 10.0.249.11 vrf To-RADIUS server-key 7 15000A08142B337

client 10.0.249.12 vrf To-RADIUS server-key 7 15000A08142B337

client 10.0.249.13 vrf To-RADIUS server-key 7 15000A08142B337

auth-type any

ignore session-key

ignore server-key

!

 

radius-server attribute 6 on-for-login-auth

radius-server attribute 32 include-in-access-req

radius-server attribute nas-port format e VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV

radius-server retransmit 1

radius-server timeout 2

radius-server deadtime 1

radius-server vsa send cisco-nas-port

radius-server load-balance method least-outstanding ignore-preferred-server

!

radius server RAD1

address ipv4 10.0.249.11 auth-port 1645 acct-port 1646

key 7 15000A08142B387

!

radius server RAD2

address ipv4 10.0.249.12 auth-port 1645 acct-port 1646

key 7 15000A08142B387

!

radius server RAD3

address ipv4 10.0.249.13 auth-port 1645 acct-port 1646

key 7 15000A08142B387

!

radius server RAD1_old

address ipv4 192.168.100.31 auth-port 1645 acct-port 1646

key 7 104A061D0A131D0

!

radius server RAD2_old

address ipv4 192.168.100.32 auth-port 1645 acct-port 1646

key 7 104A061D0A131D0

!

radius server RAD3_old

address ipv4 192.168.100.33 auth-port 1645 acct-port 1646

key 7 104A061D0A131D0

!

 

 

цель такого конфига: плавный переход на новый RADIUS сервер.

раньше сервисы были локальные. с новыми радиус-сервером - сервисы подтягиваются с него.

у меня старушка 7201, попроще бы что то

[Giga-Byte]

пропу прощения, виноват. на даты не посмотрел.

[Andrey75]

пропу прощения, виноват. на даты не посмотрел.

спасибо за помощь! какое прощение

[Andrey75]

добавил в конфиг

 

aaa authentication login ISG_IPOE group RADIUS_IPOE

aaa authentication ppp ISG_IPOE group RADIUS_IPOE

aaa authorization network ISG_IPOE group RADIUS_IPOE

aaa authorization subscriber-service default local

aaa authorization subscriber-service ISG_IPOE local group RADIUS_IPOE

aaa accounting delay-start all

aaa accounting jitter maximum 10

aaa accounting update periodic 20

aaa accounting network default start-stop group RADIUS_IPOE

aaa accounting network ISG_IPOE

action-type start-stop

group RADIUS_IPOE

 

 

сервис не присваивает

sh subscriber ses ui 297

Type: IP, UID: 297, State: authen, Identity: 172.1.0.102

IPv4 Address: 172.1.0.102

Session Up-time: 00:03:25, Last Changed: 00:03:25

Switch-ID: 37662

 

Policy information:

Authentication status: authen

Rules, actions and conditions executed:

subscriber rule-map CTRL_IPOE

condition always event session-start

10 authorize aaa list ISG_IPOE identifier source-ip-address

 

Classifiers:

Class-id Dir Packets Bytes Pri. Definition

0 In 599 70750 0 Match Any

1 Out 559 107433 0 Match Any

 

Features:

 

Accounting:

Class-id Dir Packets Bytes Source

0 In 599 70750 Peruser

1 Out 559 107433 Peruser

 

Configuration Sources:

Type Active Time AAA Service ID Name

USR 00:03:25 - Peruser

INT 00:03:25 - GigabitEthernet0/3.250

 

 

 

 

 

radiusd -X

 

rad_recv: Accounting-Request packet from host 10.1.0.1 port 1646, id=61, length=317

Acct-Session-Id = "0000000000003FC2"

Framed-IP-Address = 172.1.0.102

Framed-Protocol = PPP

Acct-Input-Packets = 8741

Acct-Output-Packets = 8385

Acct-Input-Octets = 1070719

Acct-Output-Octets = 2903818

Cisco-Control-Info = "I0;1070719"

Cisco-Control-Info = "O0;2903818"

User-Name = "172.1.0.102"

Acct-Authentic = RADIUS

Cisco-AVPair = "connect-progress=Call Up"

Acct-Session-Time = 54585

Acct-Terminate-Cause = Admin-Reset

Cisco-AVPair = "disc-cause-ext=Local Admin Disc"

Acct-Status-Type = Stop

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Framed-User

NAS-IP-Address = 10.1.0.1

PMIP6-Home-HN-Prefix = 3133:3244:3744::/49

Event-Timestamp = "Jun 30 2017 12:21:25 YEKT"

NAS-Identifier = "KharinoIPoE.KharinoIPoE"

Acct-Delay-Time = 0

# Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default

+group preacct {

++[preprocess] = ok

[acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "KharinoIPoE.KharinoIPoE",NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "0000000000003FC2",User-Name = "172.1.0.102"'

[acct_unique] Acct-Unique-Session-ID = "445d6a8322a9a34f".

++[acct_unique] = ok

+} # group preacct = ok

# Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default

+group accounting {

++[exec] = noop

[attr_filter.accounting_response] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 12

++[attr_filter.accounting_response] = updated

+} # group accounting = updated

Sending Accounting-Response of id 61 to 10.1.0.1 port 1646

Finished request 0.

Cleaning up request 0 ID 61 with timestamp +63

Going to the next request

Ready to process requests.

rad_recv: Access-Request packet from host 10.1.0.1 port 1645, id=15, length=147

User-Name = "172.1.0.102"

User-Password = "ISG"

Framed-IP-Address = 172.1.0.102

Cisco-Account-Info = "S172.1.0.102"

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Outbound-User

NAS-IP-Address = 10.1.0.1

Acct-Session-Id = "0000000000003FF8"

# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default

+group authorize {

++[preprocess] = ok

++[chap] = noop

++[mschap] = noop

++[digest] = noop

[eap] No EAP-Message, not doing EAP

++[eap] = noop

   expand: %{User-Name} -> 172.1.0.102

[sql] sql_set_user escaped user --> '172.1.0.102'

rlm_sql (sql): Reserving sql socket id: 3

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] User found in radcheck table

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_reply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_reply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] expand: SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `priority` -> SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '172.1.0.102' ORDER BY `priority`

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupcheck` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '%{Sql-Group}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupcheck` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '1:167837697' ORDER BY `id`

[sql] User found in group 1:167837697

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupreply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '%{Sql-Group}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupreply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '1:167837697' ORDER BY `id`

rlm_sql (sql): Released sql socket id: 3

++[sql] = ok

++[expiration] = noop

++[logintime] = noop

[pap] WARNING: Auth-Type already set. Not setting to PAP

++[pap] = noop

+} # group authorize = ok

Found Auth-Type = Accept

Auth-Type = Accept, accepting the user

Login OK: [172.1.0.102] (from client Cisco 7201 Kharino port 0)

# Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default

+group post-auth {

++[exec] = noop

+} # group post-auth = noop

Sending Access-Accept of id 15 to 10.1.0.1 port 1645

Cisco-AVPair += "ip:traffic-class=in access-group name OFF-LINE_IN"

Cisco-AVPair += "ip:traffic-class=in default drop"

Cisco-AVPair += "ip:traffic-class=out access-group name OFF-LINE_OUT"

Cisco-AVPair += "ip:traffic-class=out default drop"

Cisco-AVPair += "subscriber:accounting-list=ISG_IPOE"

Finished request 1.

Going to the next request

Waking up in 4.9 seconds.

rad_recv: Accounting-Request packet from host 10.1.0.1 port 1646, id=62, length=206

Acct-Session-Id = "0000000000003FF8"

Framed-IP-Address = 172.1.0.102

Framed-Protocol = PPP

User-Name = "172.1.0.102"

Cisco-AVPair = "connect-progress=Call Up"

Acct-Authentic = RADIUS

Acct-Status-Type = Start

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Framed-User

NAS-IP-Address = 10.1.0.1

PMIP6-Home-HN-Prefix = 3146:4443:3938::/50

Event-Timestamp = "Jun 30 2017 12:21:26 YEKT"

NAS-Identifier = "KharinoIPoE.KharinoIPoE"

Acct-Delay-Time = 0

# Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default

+group preacct {

++[preprocess] = ok

[acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "KharinoIPoE.KharinoIPoE",NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "0000000000003FF8",User-Name = "172.1.0.102"'

[acct_unique] Acct-Unique-Session-ID = "10ca90647d969f1a".

++[acct_unique] = ok

+} # group preacct = ok

# Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default

+group accounting {

++[exec] = noop

[attr_filter.accounting_response] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 12

++[attr_filter.accounting_response] = updated

+} # group accounting = updated

Sending Accounting-Response of id 62 to 10.1.0.1 port 1646

Finished request 2.

Cleaning up request 2 ID 62 with timestamp +64

Going to the next request

Waking up in 4.9 seconds.

Cleaning up request 1 ID 15 with timestamp +64

Ready to process requests.

[Andrey75]

это про ошибку?

attr_filter: Matched entry DEFAULT at line 12

[Andrey75]

как я понял файл "attrs.accounting_response"

 

#

# Configuration file for the rlm_attr_filter module.

# Please see rlm_attr_filter(5) manpage for more information.

#

# $Id: 3746ce4da3d58fcdd0b777a93e599045353c27ac $

#

# This configuration file is used to remove almost all of the attributes

# From an Accounting-Response message. The RFC's say that an

# Accounting-Response packet can contain only a few attributes.

# We enforce that here.

#

DEFAULT

Vendor-Specific =* ANY,

Message-Authenticator =* ANY,

Proxy-State =* ANY

 

 

 

вот она 12 строка DEFAULT

 

 

наверно ни причем

Изменено 30 июня, 2017 пользователем Andrey75

[zhenya`]

Вы шлете на сессию ацл. В реале этооработает вот как:

Циска шлёт реквест с ип, вы отвечает акаунтинг листом и именами сервисов. Циска получает и смотрит кэш сервисов и локальные (в зависимости от настройки ааа аут сабскрайбер-сервис), если там нет и можно ходить в радиус, то циска шлёт реквест с именем сервиса в юзернейме и там уже нужно отдать ацл и параметры скорости.

[Andrey75]

Вы шлете на сессию ацл. В реале этооработает вот как:

Циска шлёт реквест с ип, вы отвечает акаунтинг листом и именами сервисов. Циска получает и смотрит кэш сервисов и локальные (в зависимости от настройки ааа аут сабскрайбер-сервис), если там нет и можно ходить в радиус, то циска шлёт реквест с именем сервиса в юзернейме и там уже нужно отдать ацл и параметры скорости.

как я понял циска запрашивает пользователя с именем IP и постоянным паролем ISG (в моем случае)

биллинг отвечает, что пользователь такой есть и его пароль ISG

а так же высылает ip:traffic-class=in access-group name и ip:traffic-class=in access-group name

 

затем происходит авторизация ACC, которая у меня не идет.

 

если там нет и можно ходить в радиус, то циска шлёт реквест с именем сервиса в юзернейме и там уже нужно отдать ацл и параметры скорости.

 

получается циска не ходит в радиус, не совсем понимаю. надо менять Auth-Type?

[zhenya`]

Я сказал как должно быть. Она игнорит вашу хрень ибо такого не должно быть. Шлите на авторизацию абонента cisco-account-info = Aимясервиса. После этого она спросит сервис

[Andrey75]

Я сказал как должно быть. Она игнорит вашу хрень ибо такого не должно быть. Шлите на авторизацию абонента cisco-account-info = Aимясервиса. После этого она спросит сервис

 

спасибо!

это дошло, А впереди обязательно

 

 

абонент должен быть в одной группе?

почему то у меня подругому

sh subscriber ses ui 940

Type: IP, UID: 940, State: unauthen, Identity: 172.1.0.102

IPv4 Address: 172.1.0.102

Session Up-time: 00:00:25, Last Changed: 00:00:25

Switch-ID: 46780

 

Policy information:

Authentication status: unauthen

Active services associated with session:

name "SRV-DOWN-REDIRECT", applied before account logon

name "DOWN-SERVICE", applied before account logon

name "SRV-PASSIVE-REDIRECT", applied before account logon

name "PASSIVE-SERVICE", applied before account logon

Rules, actions and conditions executed:

subscriber rule-map CTRL_IPOE

condition always event session-start

10 authorize aaa list ISG_IPOE identifier source-ip-address

20 set-timer TIMER_UNAUTH 10

30 service-policy type service name PASSIVE-SERVICE

40 service-policy type service name SRV-PASSIVE-REDIRECT

50 service-policy type service name DOWN-SERVICE

60 service-policy type service name SRV-DOWN-REDIRECT

 

Classifiers:

Class-id Dir Packets Bytes Pri. Definition

0 In 32 2250 0 Match Any

1 Out 23 1384 0 Match Any

120876 In 0 0 0 Match ACL PASSIVE_IN

120877 Out 0 0 0 Match ACL PASSIVE_OUT

120880 In 0 0 0 Match ACL DOWN_IN

120881 Out 0 0 0 Match ACL DOWN_OUT

 

Configuration Sources:

Type Active Time AAA Service ID Name

SVC 00:00:26 - PASSIVE-SERVICE

SVC 00:00:26 - SRV-PASSIVE-REDIRECT

SVC 00:00:26 - DOWN-SERVICE

SVC 00:00:26 - SRV-DOWN-REDIRECT

USR 00:00:26 - Peruser

INT 00:00:26 - GigabitEthernet0/3.250

 

 

 

атрибуты:

Auth-Type = Local

Cleartext-Password := ISG

Cisco-Service-Info = PASSIVE-SERVICE

 

Cisco-AVPair += ip:traffic-class=input access-group name PASSIVE_IN

Cisco-AVPair += ip:traffic-class=output access-group name PASSIVE_OUT

Cisco-AVPair += ip:traffic-class=out default drop

Cisco-AVPair += ip:traffic-class=in default drop

Cisco-AVPair += subscriber:accounting-list=ISG_IPOE

 

 

 

конфиг

 

policy-map type service ON-LINE-SERVICE

service local

class type traffic ACL-ON-LINE

!

class type traffic default in-out

!

!

policy-map type service OFF-LINE-SERVICE

service local

class type traffic ACL-OFF-LINE

!

!

policy-map type service SRV-OFF-LINE-REDIRECT

service local

class type traffic REDIRECT-OFF-LINE

redirect to group OFF-LINE-REDIRECT

!

class type traffic default in-out

drop

!

!

policy-map type service DOWN-SERVICE

service local

class type traffic ACL-DOWN

!

!

policy-map type service SRV-DOWN-REDIRECT

service local

class type traffic REDIRECT-DOWN

redirect to group DOWN-REDIRECT

!

class type traffic default in-out

drop

!

!

policy-map type service PASSIVE-SERVICE

service local

class type traffic ACL-PASSIVE

!

!

policy-map type service SRV-PASSIVE-REDIRECT

service local

class type traffic REDIRECT-PASSIVE

redirect to group PASSIVE-REDIRECT

!

class type traffic default in-out

drop

!

!

policy-map type service RADIUS-DEFAULT

service local

class type traffic RADUIS_DEFAULT

police input 2048000

police output 2048000

Изменено 30 июня, 2017 пользователем Andrey75

[Andrey75]

можно какой букварь найти по этому поводу, или азбуку

[zhenya`]

Покажи ответ который отдал абоненту

[Andrey75]

получаю ошибку при авторизации с атрибутом Cisco-Service-Info = PASSIVE-SERVICE

++

 = ok

++[expiration] = noop

++[logintime] = noop

[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.

++[pap] = noop

+} # group authorize = ok

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user

Failed to authenticate the user.

Login incorrect: [172.1.0.102/ISG] (from client Cisco 7201 Kharino port 0)

Using Post-Auth-Type Reject

# Executing group from file /usr/local/etc/raddb/sites-enabled/default

+group REJECT {

[attr_filter.access_reject] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 11

++[attr_filter.access_reject] = updated

+} # group REJECT = updated

Delaying reject of request 0 for 1 seconds

Going to the next request

Waking up in 0.9 seconds.

Sending delayed reject for request 0

Sending Access-Reject of id 63 to 10.1.0.1 port 1645

Waking up in 4.9 seconds.

Cleaning up request 0 ID 63 with timestamp +22

Ready to process requests.

 

[zhenya`]

А надо добавить к названию. Но тут вы сами чет криво собрали, там вроде надо ещё +=

[Andrey75]

А надо добавить к названию. Но тут вы сами чет криво собрали, там вроде надо ещё +=

вы как всегда правы, авторизовался.

но есть ошибка и сервис не присваивается, где то опять я накосячил

радиус

rad_recv: Accounting-Request packet from host 10.1.0.1 port 1646, id=116, length=313

Acct-Session-Id = "00000000000045A3"

Framed-IP-Address = 172.1.0.102

Framed-Protocol = PPP

Acct-Input-Packets = 222

Acct-Output-Packets = 187

Acct-Input-Octets = 24926

Acct-Output-Octets = 25136

Cisco-Control-Info = "I0;24926"

Cisco-Control-Info = "O0;25136"

User-Name = "172.1.0.102"

Acct-Authentic = RADIUS

Cisco-AVPair = "connect-progress=Call Up"

Acct-Session-Time = 146

Acct-Terminate-Cause = Admin-Reset

Cisco-AVPair = "disc-cause-ext=Local Admin Disc"

Acct-Status-Type = Stop

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Framed-User

NAS-IP-Address = 10.1.0.1

PMIP6-Home-HN-Prefix = 3934:4438:3431::/54

Event-Timestamp = "Jul 1 2017 11:31:37 YEKT"

NAS-Identifier = "KharinoIPoE.KharinoIPoE"

Acct-Delay-Time = 0

# Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default

+group preacct {

++[preprocess] = ok

[acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "KharinoIPoE.KharinoIPoE",NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "00000000000045A3",User-Name = "172.1.0.102"'

[acct_unique] Acct-Unique-Session-ID = "de8001643e442cac".

++[acct_unique] = ok

+} # group preacct = ok

# Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default

+group accounting {

++[exec] = noop

[attr_filter.accounting_response] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 12

++[attr_filter.accounting_response] = updated

+} # group accounting = updated

Sending Accounting-Response of id 116 to 10.1.0.1 port 1646

Finished request 15.

Cleaning up request 15 ID 116 with timestamp +13370

Going to the next request

Ready to process requests.

rad_recv: Access-Request packet from host 10.1.0.1 port 1645, id=73, length=147

User-Name = "172.1.0.102"

User-Password = "ISG"

Framed-IP-Address = 172.1.0.102

Cisco-Account-Info = "S172.1.0.102"

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Outbound-User

NAS-IP-Address = 10.1.0.1

Acct-Session-Id = "00000000000045BA"

# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default

+group authorize {

++[preprocess] = ok

++[chap] = noop

++[mschap] = noop

++[digest] = noop

[eap] No EAP-Message, not doing EAP

++[eap] = noop

   expand: %{User-Name} -> 172.1.0.102

[sql] sql_set_user escaped user --> '172.1.0.102'

rlm_sql (sql): Reserving sql socket id: 3

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_check` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] User found in radcheck table

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_reply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radius_reply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `UserName` = '172.1.0.102' ORDER BY `id`

[sql] expand: SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '%{SQL-User-Name}' ORDER BY `priority` -> SELECT `GroupName` FROM `radius_usergroup` WHERE `UserName` = '172.1.0.102' ORDER BY `priority`

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupcheck` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '%{Sql-Group}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupcheck` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '1:167837697' ORDER BY `id`

[sql] User found in group 1:167837697

[sql] expand: SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupreply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '%{Sql-Group}' ORDER BY `id` -> SELECT (@cnt := @cnt + 1) AS `id`, `GroupName`, `Attribute`, `Value`, `op` FROM `radius_groupreply` CROSS JOIN (SELECT @cnt := 0) AS `dummy` WHERE `GroupName` = '1:167837697' ORDER BY `id`

rlm_sql (sql): Released sql socket id: 3

++[sql] = ok

++[expiration] = noop

++[logintime] = noop

[pap] WARNING: Auth-Type already set. Not setting to PAP

++[pap] = noop

+} # group authorize = ok

Found Auth-Type = Accept

Auth-Type = Accept, accepting the user

Login OK: [172.1.0.102] (from client Cisco 7201 Kharino port 0)

# Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default

+group post-auth {

++[exec] = noop

+} # group post-auth = noop

Sending Access-Accept of id 73 to 10.1.0.1 port 1645

Cisco-AVPair += "ip:traffic-class=input access-group name PASSIVE_IN"

Cisco-AVPair += "ip:traffic-class=output access-group name PASSIVE_OUT"

Cisco-AVPair += "ip:traffic-class=out default drop"

Cisco-AVPair += "ip:traffic-class=in default drop"

Cisco-AVPair += "subscriber:accounting-list=ISG_IPOE"

Finished request 16.

Going to the next request

Waking up in 4.9 seconds.

rad_recv: Accounting-Request packet from host 10.1.0.1 port 1646, id=117, length=206

Acct-Session-Id = "00000000000045BA"

Framed-IP-Address = 172.1.0.102

Framed-Protocol = PPP

User-Name = "172.1.0.102"

Cisco-AVPair = "connect-progress=Call Up"

Acct-Authentic = RADIUS

Acct-Status-Type = Start

NAS-Port-Type = Virtual

Cisco-NAS-Port = "0/0/3/250"

NAS-Port = 0

NAS-Port-Id = "0/0/3/250"

Service-Type = Framed-User

NAS-IP-Address = 10.1.0.1

PMIP6-Home-HN-Prefix = 4544:4131:3946::/57

Event-Timestamp = "Jul 1 2017 11:31:37 YEKT"

NAS-Identifier = "KharinoIPoE.KharinoIPoE"

Acct-Delay-Time = 0

# Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default

+group preacct {

++[preprocess] = ok

[acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "KharinoIPoE.KharinoIPoE",NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "00000000000045BA",User-Name = "172.1.0.102"'

[acct_unique] Acct-Unique-Session-ID = "7a174d7c1d12cd49".

++[acct_unique] = ok

+} # group preacct = ok

# Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default

+group accounting {

++[exec] = noop

[attr_filter.accounting_response] expand: %{User-Name} -> 172.1.0.102

attr_filter: Matched entry DEFAULT at line 12

++[attr_filter.accounting_response] = updated

+} # group accounting = updated

Sending Accounting-Response of id 117 to 10.1.0.1 port 1646

Finished request 17.

Cleaning up request 17 ID 117 with timestamp +13370

Going to the next request

Waking up in 4.9 seconds.

Cleaning up request 16 ID 73 with timestamp +13370

Ready to process requests.

 

 

[b]циска[/b]

 

KharinoIPoE#sh sss ses ui 282

Type: IP, UID: 282, State: authen, Identity: 172.1.0.102

IPv4 Address: 172.1.0.102

Session Up-time: 00:03:00, Last Changed: 00:03:00

Switch-ID: 24438

 

Policy information:

Authentication status: authen

Rules, actions and conditions executed:

subscriber rule-map CTRL_IPOE

condition always event session-start

10 authorize aaa list ISG_IPOE identifier source-ip-address

 

Classifiers:

Class-id Dir Packets Bytes Pri. Definition

0 In 305 36370 0 Match Any

1 Out 270 43478 0 Match Any

 

Features:

 

Accounting:

Class-id Dir Packets Bytes Source

0 In 305 36370 Peruser

1 Out 270 43478 Peruser

 

Configuration Sources:

Type Active Time AAA Service ID Name

USR 00:03:00 - Peruser

INT 00:03:00 - GigabitEthernet0/3.250

 

KharinoIPoE#

 

 

атрибуты

 

Auth-Type = Accept

Cleartext-Password := ISG

Cisco-Service-Info += APASSIVE-SERVICE

Изменено 1 июля, 2017 пользователем Andrey75

[zhenya`]

в логе

Cisco-AVPair += "ip:traffic-class=input access-group name PASSIVE_IN"

Cisco-AVPair += "ip:traffic-class=output access-group name PASSIVE_OUT"

Cisco-AVPair += "ip:traffic-class=out default drop"

Cisco-AVPair += "ip:traffic-class=in default drop"

Cisco-AVPair += "subscriber:accounting-list=ISG_IPOE"

и

Auth-Type = Accept

Cleartext-Password := ISG

Cisco-Service-Info += APASSIVE-SERVICE

 

как-то не совпадают. )

 

пэссив у вас кстати в конфиге. в таком случае про ip:traffic-class ваще можно забыть :)

[Andrey75]

в логе

Cisco-AVPair += "ip:traffic-class=input access-group name PASSIVE_IN"

Cisco-AVPair += "ip:traffic-class=output access-group name PASSIVE_OUT"

для

class-map type traffic match-any ACL-PASSIVE

match access-group input name PASSIVE_IN

match access-group output name PASSIVE_OUT

 

а Cisco-Service-Info += APASSIVE-SERVICE

для

policy-map type service PASSIVE-SERVICE

service local

class type traffic ACL-PASSIVE

 

думал так

Изменено 1 июля, 2017 пользователем Andrey75