forum.bitel.ru
http://forum.bitel.ru/

Nas_port
http://forum.bitel.ru/viewtopic.php?f=44&t=10312		 Страница 1 из 1
Автор:  telesystem [ 22 мар 2015, 19:10 ]
Заголовок сообщения:  Nas_port
Добрый день, пытаемся реализовать схему ISG и авторизация по Option82
Все сделали как по статье в вики http://wiki.bitel.ru/index.php/ISG,_%D1 ... 5_option82

Абонент IP адрес получил, сервисы на ISG навесились на абонента, но в мониторе только одна сессия (а по статье должно быть в результате две ) и в логах пишет Nas_port not found

Кусок лога из InetAccounting
Версия 6.1
Код:
radius 03-22/15:03:34  INFO [rdsLstnr-p-6-t-2] InetRadiusProcessor - REQUEST_AFTER_PREPROCESS:
Packet type: Accounting-Request
Identifier: 26
Authenticator: {D5 EF 1B 05 8C BB 89 CA DD 06 8E EC FA E4 73 D5}
Attributes:
  User-Name=10.1.30.6
  NAS-IP-Address=10.1.12.249
  Service-Type=2
  Framed-Protocol=1
  UNKNOWN[-1-197]={60 6C 9A 2C}
  Framed-IP-Address=10.1.30.6
  UNKNOWN[-1-196]={00 00 00 0A}
  UNKNOWN[-1-198]={00 00 00 00}
  UNKNOWN[-1-193]={00 00 00 00}
  UNKNOWN[-1-192]={00 00 00 00}
  UNKNOWN[-1-195]={00 00 00 97}
  NAS-Port-Id=0/0/1/1504
  Acct-Input-Octets=48609
  Acct-Output-Octets=54468
  Acct-Status-Type=2
  Acct-Delay-Time=0
  Acct-Session-Time=508
  Acct-Input-Packets=658
  Acct-Session-Id=00000003
  Acct-Authentic=1
  UNKNOWN[-1-255]={60 6C A6 F0}
  Acct-Terminate-Cause=6
  Acct-Output-Packets=642
  UNKNOWN[-1-190]={00 00 00 00}
  UNKNOWN[-1-191]={00 00 00 00}
  NAS-Port-Type=15
  cisco-avpair=connect-progress=Call Up
  cisco-avpair=nas-tx-speed=1617733360
  cisco-avpair=nas-rx-speed=1617730092
  cisco-avpair=disc-cause-ext=Local Admin Disc
  cisco-NAS-Port=0/0/1/1504
  cisco-SSG-Control-Info=I0;48609
  cisco-SSG-Control-Info=O0;54468

radius 03-22/15:03:34 ERROR [rdsLstnr-p-6-t-2] InetRadiusProcessor - Attribute Nas_Port not found in packet!
radius 03-22/15:03:34  WARN [rdsLstnr-p-6-t-2] InetNas - NasConnection not found
radius 03-22/15:03:34  INFO [rdsLstnr-p-6-t-2] RadiusListenerWorker - RESPONSE:
Packet type: Accounting-Response
Identifier: 26
Authenticator: {57 15 00 D7 06 F7 98 BE 1C 67 9A 7A A3 3B B2 A1}
Attributes:

Process time stop: 1

accounting 03-22/15:03:34  INFO [accwrkr-1-p-12-t-1] InetApplication - TariffOptionMap: {}
accounting 03-22/15:03:34  INFO [accwrkr-1-p-12-t-1] InetApplication - inetServ[id=2] balance ok: 0.00 [0]
accounting 03-22/15:03:34  INFO [accwrkr-1-p-12-t-1] InetApplication - OptionSet: [3, 5]
radius 03-22/15:03:35  INFO [rdsLstnr-p-6-t-5] RadiusListenerWorker - REQUEST:
Packet type: Accounting-Request
Identifier: 27
Authenticator: {6C A3 DB F9 AD 92 F3 CB FA 56 7D A0 5F 91 16 1D}
Attributes:
  User-Name=10.1.30.6
  NAS-Port-Id=0/0/1/1504
  NAS-IP-Address=10.1.12.249
  Service-Type=2
  Framed-Protocol=1
  Framed-IP-Address=10.1.30.6
  UNKNOWN[-1-196]={00 00 00 0A}
  Acct-Status-Type=1
  Acct-Delay-Time=0
  NAS-Port-Type=15
  Acct-Session-Id=00000009
  Acct-Authentic=1
  cisco-avpair=connect-progress=Call Up
  cisco-NAS-Port=0/0/1/1504

radius 03-22/15:03:35  INFO [rdsLstnr-p-6-t-5] InetRadiusProcessor - REQUEST_AFTER_PREPROCESS:
Packet type: Accounting-Request
Identifier: 27
Authenticator: {6C A3 DB F9 AD 92 F3 CB FA 56 7D A0 5F 91 16 1D}
Attributes:
  User-Name=10.1.30.6
  NAS-Port-Id=0/0/1/1504
  NAS-IP-Address=10.1.12.249
  Service-Type=2
  Framed-Protocol=1
  Framed-IP-Address=10.1.30.6
  UNKNOWN[-1-196]={00 00 00 0A}
  Acct-Status-Type=1
  Acct-Delay-Time=0
  NAS-Port-Type=15
  Acct-Session-Id=00000009
  Acct-Authentic=1
  cisco-avpair=connect-progress=Call Up
  cisco-NAS-Port=0/0/1/1504

radius 03-22/15:03:35 ERROR [rdsLstnr-p-6-t-5] InetRadiusProcessor - Attribute Nas_Port not found in packet!
radius 03-22/15:03:35  INFO [rdsLstnr-p-6-t-5] RadiusListenerWorker - RESPONSE:
Packet type: Accounting-Response
Identifier: 27
Authenticator: {6F 09 31 B3 F3 61 BD CF 67 BE 0A CB D0 73 96 CE}
Attributes:

Process time start: 1

radius 03-22/15:03:35  INFO [rdsLstnr-p-6-t-7] RadiusListenerWorker - REQUEST:
Packet type: Accounting-Request
Identifier: 28
Authenticator: {BB D2 D4 77 65 9D FD 80 C7 4F 8C 96 86 8D 3B AA}
Attributes:
  User-Name=10.1.30.6
  NAS-Port-Id=0/0/1/1504
  NAS-IP-Address=10.1.12.249
  Service-Type=2
  Framed-Protocol=1
  Framed-IP-Address=10.1.30.6
  Acct-Status-Type=1
  Acct-Delay-Time=0
  NAS-Port-Type=15
  Acct-Session-Id=0000000A
  cisco-avpair=parent-session-id=00000009
  cisco-NAS-Port=0/0/1/1504
  cisco-SSG-Service-Info=NISG-LOCAL

radius 03-22/15:03:35  INFO [rdsLstnr-p-6-t-7] InetRadiusProcessor - REQUEST_AFTER_PREPROCESS:
Packet type: Accounting-Request
Identifier: 28
Authenticator: {BB D2 D4 77 65 9D FD 80 C7 4F 8C 96 86 8D 3B AA}
Attributes:
  User-Name=10.1.30.6
  NAS-Port-Id=0/0/1/1504
  NAS-IP-Address=10.1.12.249
  Service-Type=2
  Framed-Protocol=1
  Framed-IP-Address=10.1.30.6
  Acct-Status-Type=1
  Acct-Delay-Time=0
  NAS-Port-Type=15
  Acct-Session-Id=0000000A
  cisco-avpair=parent-session-id=00000009
  cisco-NAS-Port=0/0/1/1504
  cisco-SSG-Service-Info=NISG-LOCAL
Common options: {parentAcctSessionId=00000009, serviceName=ISG-LOCAL, deviceState=null}
radius 03-22/15:03:35 ERROR [rdsLstnr-p-6-t-7] InetRadiusProcessor - Attribute Nas_Port not found in packet!
radius 03-22/15:03:35  INFO [rdsLstnr-p-6-t-7] RadiusListenerWorker - RESPONSE:
Packet type: Accounting-Response
Identifier: 28
Authenticator: {AD 28 2B EF 20 6B 10 A3 FE FB D8 02 C4 8A C4 D1}
Attributes:

Process time start: 0
Автор:  Amir [ 24 мар 2015, 17:34 ]
Заголовок сообщения:  Re: Nas_port
В последнем билде добавили, чтобы значение пытался брать из Nas-Port-Id, если нет Nas-Port. Попробуйте.
Автор:  telesystem [ 25 мар 2015, 07:25 ]
Заголовок сообщения:  Re: Nas_port
наверное не совсем удачный вариант
теперь аккаутинг дальше пошел, но в мониторинге появилось 4 сессии на клиента, т.е.1 - dhcp, и 3 для ISG с разными session-id но одинаковыми nas-port-id

Вот что на эту тему творится на самом ISG и в мониторе INET

Current Subscriber Information: Total sessions 1
--------------------------------------------------
Unique Session ID: 651
Identifier:
SIP subscriber access type(s): Traffic-Class
Current SIP options: None
Session Up-time: 00:50:36, Last Changed: 00:50:36

Policy information:
Authentication status: unauthen

Session inbound features:
Feature: Service accounting
Service: ISG-LOCAL
Method List: ipoe-isg-aaa
Packets = 0, Bytes = 0

Feature: Policing
Upstream Params:
Average rate = 10240000, Normal burst = 1920000, Excess burst = 3840000
Config level = Service

Session outbound features:
Feature: Service accounting
Service: ISG-LOCAL
Method List: ipoe-isg-aaa
Packets = 69421, Bytes = 74846814

Feature: Policing
Dnstream Params:
Average rate = 10240000, Normal burst = 1920000, Excess burst = 3840000
Config level = Service

Configuration sources associated with this session:
Service: ISG-LOCAL, Active Time = 00:50:38

--------------------------------------------------
Unique Session ID: 652
Identifier:
SIP subscriber access type(s): Traffic-Class
Current SIP options: None
Session Up-time: 00:50:37, Last Changed: 00:50:37

Policy information:
Authentication status: unauthen

Session inbound features:
Feature: Service accounting
Service: ISG-5MBPS
Method List: ipoe-isg-aaa
Packets = 56852, Bytes = 30317011

Feature: Policing
Upstream Params:
Average rate = 5120000, Normal burst = 384000, Excess burst = 768000
Config level = Service

Session outbound features:
Feature: Service accounting
Service: ISG-5MBPS
Method List: ipoe-isg-aaa
Packets = 0, Bytes = 0

Feature: Policing
Dnstream Params:
Average rate = 5120000, Normal burst = 960000, Excess burst = 1920000
Config level = Service

Configuration sources associated with this session:
Service: ISG-5MBPS, Active Time = 00:50:45

--------------------------------------------------
Unique Session ID: 650
Identifier: 10.1.30.6
SIP subscriber access type(s): IP
Current SIP options: Req Fwding/Req Fwded
Session Up-time: 00:50:46, Last Changed: 00:50:45

Policy information:
Authentication status: authen
Active services associated with session:
name "ISG-5MBPS"
name "ISG-LOCAL"
Rules, actions and conditions executed:
subscriber rule-map IPoE-ISG
condition always event session-start
10 authorize aaa list ipoe-isg-aaa identifier source-ip-address

Session inbound features:
Feature: IP Idle Timeout
Timeout value is 1300
Idle time is 00:09:59
Feature: Session accounting
Method List: ipoe-isg-aaa
Packets = 56852, Bytes = 30317011

Traffic classes:
Traffic class session ID: 652
ACL Name: 101, Packets = 56852, Bytes = 30317011
Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

Session outbound features:
Feature: Session accounting
Method List: ipoe-isg-aaa
Packets = 69421, Bytes = 74846814

Traffic classes:
Traffic class session ID: 651
ACL Name: 2110, Packets = 69421, Bytes = 74846814
Traffic class session ID: 652
ACL Name: 102, Packets = 0, Bytes = 0
Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

Configuration sources associated with this session:
Service: ISG-5MBPS, Active Time = 00:50:47
AAA Service ID = 1678258140
Service: ISG-LOCAL, Active Time = 00:50:47
AAA Service ID = 1678247356
Interface: GigabitEthernet0/1.1504, Active Time = 00:50:47


Вот что творится в этот момент в мониторе INET

---------------------------------------------------------------------------
Time: 25.03.2015 04:16:39
Packet type: Accounting-Request
Identifier: 234
Authenticator: {CF 01 63 AE A1 44 5D 3E 5D 80 C8 86 E2 B1 98 D4}
Attributes:
User-Name=10.1.30.6
NAS-Port-Id=0/0/1/1504
Acct-Output-Packets=0
NAS-IP-Address=10.1.12.249
Service-Type=2
Framed-Protocol=1
Framed-IP-Address=10.1.30.6
Acct-Input-Octets=30312299
Acct-Output-Octets=0
Acct-Status-Type=3
Acct-Delay-Time=0
Acct-Session-Time=2166
Acct-Input-Packets=56808
NAS-Port-Type=5
Acct-Session-Id=000004D2


Time: 25.03.2015 04:21:34
Packet type: CoA-Request
Identifier: 7
Authenticator: {BB 80 C4 10 E1 84 3A AC 2B 07 53 7B 9B ED 61 2D}
Attributes:
User-Name=10.1.30.6
Framed-IP-Address=10.1.30.6
Acct-Session-Id=000004D2
cisco-avpair=subscriber:command=account-logoff

Time: 25.03.2015 04:21:34
Packet type: CoA-NAK
Identifier: 7
Authenticator: {91 12 D3 08 74 1E 53 76 64 8D 27 2E B5 E6 5E C0}
Attributes:
Error-Cause=503
Reply-Message=No valid Session
cisco-SSG-Command-Code=\0x102;10.1.30.6

---------------------------------------------------------------------------
Time: 25.03.2015 04:18:01
Packet type: Accounting-Request
Identifier: 237
Authenticator: {37 F8 C7 0C B3 27 16 15 75 42 3F 33 1A 09 10 43}
Attributes:
User-Name=10.1.30.6
NAS-Port-Id=0/0/1/1504
Acct-Output-Packets=69366
NAS-IP-Address=10.1.12.249
Service-Type=2
Framed-Protocol=1
Framed-IP-Address=10.1.30.6
Acct-Input-Octets=0
Acct-Output-Octets=74833028
Acct-Status-Type=3
Acct-Delay-Time=0
Acct-Session-Time=2248
Acct-Input-Packets=0
NAS-Port-Type=5
Acct-Session-Id=000004D1
---------------------------------------------------------------------------
Time: 25.03.2015 04:17:31
Packet type: Accounting-Request
Identifier: 235
Authenticator: {14 58 BA D7 94 8C 61 87 0C 2B A4 AE 01 41 0D 3D}
Attributes:
User-Name=10.1.30.6
NAS-IP-Address=10.1.12.249
Service-Type=2
Framed-Protocol=1
Framed-IP-Address=10.1.30.6
UNKNOWN[-1-197]={60 6C 9A 2C}
Acct-Input-Octets=30313866
UNKNOWN[-1-196]={00 00 00 0A}
Acct-Output-Octets=74832878
Acct-Status-Type=3
Acct-Delay-Time=0
UNKNOWN[-1-198]={00 00 00 00}
UNKNOWN[-1-193]={00 00 00 00}
Acct-Session-Time=2218
UNKNOWN[-1-192]={00 00 00 00}
Acct-Input-Packets=56821
Acct-Session-Id=000004D0
Acct-Authentic=1
UNKNOWN[-1-255]={60 6C A6 F0}
NAS-Port-Id=0/0/1/1504
Acct-Output-Packets=69363
UNKNOWN[-1-190]={00 00 00 00}
UNKNOWN[-1-191]={00 00 00 00}
NAS-Port-Type=5
---------------------------------------------------------------------------
Автор:  telesystem [ 25 мар 2015, 07:30 ]
Заголовок сообщения:  Re: Nas_port
cisco-7206#show subscriber session detailed
Current Subscriber Information: Total sessions 1
--------------------------------------------------
Unique Session ID: 651
Identifier:
SIP subscriber access type(s): Traffic-Class
Current SIP options: None
Session Up-time: 01:01:00, Last Changed: 01:01:00

Policy information:
Context 205FC688: Handle B10004A8
AAA_id 00000129: Flow_handle 1
Authentication status: unauthen
Downloaded User profile, including services:
username "ISG-LOCAL"
clid-mac-addr D4 CA 6D B8 24 54
traffic-class "output access-group 2110 priority 100"
accounting-list "ipoe-isg-aaa"
ssg-service-info "QU;10240000;D;10240000"
Config history for session (recent to oldest):
Access-type: Web-service-logon Client: Service Command-Handler
Policy event: Service-Start (Service)
Profile name: ISG-LOCAL, 4 references
username "ISG-LOCAL"
clid-mac-addr D4 CA 6D B8 24 54
password <hidden>
traffic-class "output access-group 2110 priority 100"
accounting-list "ipoe-isg-aaa"
ssg-service-info "QU;10240000;D;10240000"

Session inbound features:
Feature: Service accounting
Service: ISG-LOCAL
Method List: ipoe-isg-aaa
Packets = 0, Bytes = 0

Feature: Policing
Upstream Params:
Average rate = 10240000, Normal burst = 1920000, Excess burst = 3840000
Config level = Service

Session outbound features:
Feature: Service accounting
Service: ISG-LOCAL
Method List: ipoe-isg-aaa
Packets = 69424, Bytes = 74846943

Feature: Policing
Dnstream Params:
Average rate = 10240000, Normal burst = 1920000, Excess burst = 3840000
Config level = Service

Configuration sources associated with this session:
Service: ISG-LOCAL, Active Time = 01:01:21

--------------------------------------------------
Unique Session ID: 652
Identifier:
SIP subscriber access type(s): Traffic-Class
Current SIP options: None
Session Up-time: 01:01:21, Last Changed: 01:01:21

Policy information:
Context 205FC510: Handle 980004A9
AAA_id 00000129: Flow_handle 2
Authentication status: unauthen
Downloaded User profile, including services:
accounting-list "ipoe-isg-aaa"
traffic-class "in access-group 101 priority 201"
traffic-class "out access-group 102 priority 201"
ssg-service-info "QU;5120000;384000;768000;D;5120000;960000;1920000"
Config history for session (recent to oldest):
Access-type: Web-service-logon Client: Service Command-Handler
Policy event: Service-Start (Service)
Profile name: ISG-5MBPS, 4 references
accounting-list "ipoe-isg-aaa"
traffic-class "in access-group 101 priority 201"
traffic-class "out access-group 102 priority 201"
ssg-service-info "QU;5120000;384000;768000;D;5120000;960000;1920000"

Session inbound features:
Feature: Service accounting
Service: ISG-5MBPS
Method List: ipoe-isg-aaa
Packets = 56852, Bytes = 30317011

Feature: Policing
Upstream Params:
Average rate = 5120000, Normal burst = 384000, Excess burst = 768000
Config level = Service

Session outbound features:
Feature: Service accounting
Service: ISG-5MBPS
Method List: ipoe-isg-aaa
Packets = 0, Bytes = 0

Feature: Policing
Dnstream Params:
Average rate = 5120000, Normal burst = 960000, Excess burst = 1920000
Config level = Service

Configuration sources associated with this session:
Service: ISG-5MBPS, Active Time = 01:01:22

--------------------------------------------------
Unique Session ID: 650
Identifier: 10.1.30.6
SIP subscriber access type(s): IP
Current SIP options: Req Fwding/Req Fwded
Session Up-time: 01:01:23, Last Changed: 01:01:22

Policy information:
Context 205FC800: Handle E90004A7
AAA_id 00000129: Flow_handle 0
Authentication status: authen
Downloaded User profile, excluding services:
idletime 1300 (0x514)
accounting-list "ipoe-isg-aaa"
ssg-account-info "AISG-5MBPS"
ssg-account-info "AISG-LOCAL"
Downloaded User profile, including services:
idletime 1300 (0x514)
accounting-list "ipoe-isg-aaa"
ssg-account-info "AISG-5MBPS"
ssg-account-info "AISG-LOCAL"
username "ISG-LOCAL"
clid-mac-addr D4 CA 6D B8 24 54
traffic-class "in access-group 101 priority 201"
traffic-class "out access-group 102 priority 201"
ssg-service-info "QU;5120000;384000;768000;D;5120000;960000;1920000"
Config history for session (recent to oldest):
Access-type: Web-service-logon Client: SM
Policy event: Apply Config Success (Service)
Profile name: ISG-5MBPS, 4 references
accounting-list "ipoe-isg-aaa"
traffic-class "in access-group 101 priority 201"
traffic-class "out access-group 102 priority 201"
ssg-service-info "QU;5120000;384000;768000;D;5120000;960000;1920000"
Access-type: Web-service-logon Client: SM
Policy event: Apply Config Success (Service)
Profile name: ISG-LOCAL, 4 references
username "ISG-LOCAL"
clid-mac-addr D4 CA 6D B8 24 54
password <hidden>
traffic-class "output access-group 2110 priority 100"
accounting-list "ipoe-isg-aaa"
ssg-service-info "QU;10240000;D;10240000"
Access-type: IP Client: SM
Policy event: Service Selection Request
Profile name: 10.1.30.6, 2 references
idletime 1300 (0x514)
accounting-list "ipoe-isg-aaa"
ssg-account-info "AISG-5MBPS"
ssg-account-info "AISG-LOCAL"
Active services associated with session:
name "ISG-5MBPS"
name "ISG-LOCAL"
Rules, actions and conditions executed:
subscriber rule-map IPoE-ISG
condition always event session-start
10 authorize aaa list ipoe-isg-aaa identifier source-ip-address

Session inbound features:
Feature: IP Idle Timeout
Timeout value is 1300
Idle time is 00:20:37
Feature: Session accounting
Method List: ipoe-isg-aaa
Packets = 56852, Bytes = 30317011

Traffic classes:
Traffic class session ID: 652
ACL Name: 101, Packets = 56852, Bytes = 30317011
Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

Session outbound features:
Feature: Session accounting
Method List: ipoe-isg-aaa
Packets = 69424, Bytes = 74846943

Traffic classes:
Traffic class session ID: 651
ACL Name: 2110, Packets = 69424, Bytes = 74846943
Traffic class session ID: 652
ACL Name: 102, Packets = 0, Bytes = 0
Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

Configuration sources associated with this session:
Service: ISG-5MBPS, Active Time = 01:01:25
AAA Service ID = 1678258140
Service: ISG-LOCAL, Active Time = 01:01:25
AAA Service ID = 1678247356
Interface: GigabitEthernet0/1.1504, Active Time = 01:01:25
Автор:  Amir [ 25 мар 2015, 11:45 ]
Заголовок сообщения:  Re: Nas_port
Видимо две из них это сервисные. В их RADIUS пакетах должен быть атрибут parent acct session id. По нему биллинг должен понять что они дочерние по отношению к родительской.
Автор:  Amir [ 25 мар 2015, 18:54 ]
Заголовок сообщения:  Re: Nas_port
Обычно так выглядит:
Код:
  cisco-avpair=parent-session-id=7200000000000165
  ...
  cisco-SSG-Service-Info=NINET
Т.е. присутствует Acct-Session-Id родительской сессии и имя сервиса ISG, по которой этот сервисный RADIUS-аккаунтинг.
Автор:  telesystem [ 26 мар 2015, 04:24 ]
Заголовок сообщения:  Re: Nas_port
Да, спасибо, поправили конфиг циски, и все стало хорошо.
Страница 1 из 1 Часовой пояс: UTC + 5 часов [ Летнее время ]
Powered by phpBB® Forum Software © phpBB Group
http://www.phpbb.com/