forum.bitel.ru :: Просмотр темы - [6.0] CoA request не всегда отрабатывает

connection 07-28/10:00:19 INFO [sa-p-13-t-51] ServiceActivatorSet - Invoking connectionModify
connection 07-28/10:00:19 INFO [sa-p-13-t-51] CoAServiceActivator - Connection modify: oldState: 1; newState: 1; oldOptionSet: [5]; newOptionSet: [6]
connection 07-28/10:00:19 INFO [sa-p-13-t-51] CoAServiceActivator - Send CoA:
Packet type: CoA-Request
Identifier: 11
Authenticator: {4E 60 CF 39 ED 66 5D 2C 01 CA B9 B5 CF C2 25 C5}
Attributes:
User-Name=pashkoalex
Framed-IP-Address=10.240.50.94
Acct-Session-Id=9C00000000583BD5
cisco-avpair=ip:inacl=Unlimited
cisco-avpair=ip:outacl=Unlimited
cisco-avpair=ip:sub-qos-policy-in=Unlim-10Mb-in
cisco-avpair=ip:sub-qos-policy-out=Unlim-10Mb-out

connection 07-28/10:00:19 INFO [sa-p-13-t-51] RadiusClient - Sending to /10.26.129.43:1701
Packet type: CoA-Request
Identifier: 11
Authenticator: {4E 60 CF 39 ED 66 5D 2C 01 CA B9 B5 CF C2 25 C5}
Attributes:
User-Name=pashkoalex
Framed-IP-Address=10.240.50.94
Acct-Session-Id=9C00000000583BD5
cisco-avpair=ip:inacl=Unlimited
cisco-avpair=ip:outacl=Unlimited
cisco-avpair=ip:sub-qos-policy-in=Unlim-10Mb-in
cisco-avpair=ip:sub-qos-policy-out=Unlim-10Mb-out

No. Time Source Destination Protocol Length Info
1 0.000000 10.26.129.25 10.26.129.43 UDP 237 Source port: 51041 Destination port: l2f

Frame 1: 237 bytes on wire (1896 bits), 58 bytes captured (464 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jul 28, 2014 11:00:09.622486000 Московское время (зима)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1406530809.622486000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 237 bytes (1896 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: IntelCor_89:b5:ae (00:1b:21:89:b5:ae), Dst: Cisco_99:7d:01 (70:81:05:99:7d:01)
Destination: Cisco_99:7d:01 (70:81:05:99:7d:01)
Address: Cisco_99:7d:01 (70:81:05:99:7d:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.26.129.25 (10.26.129.25), Dst: 10.26.129.43 (10.26.129.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 223
Identification: 0x9014 (36884)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 63
Protocol: UDP (17)
Header checksum: 0x0681 [validation disabled]
[Good: False]
[Bad: False]
Source: 10.26.129.25 (10.26.129.25)
Destination: 10.26.129.43 (10.26.129.43)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 51041 (51041), Dst Port: l2f (1701)
Source port: 51041 (51041)
Destination port: l2f (1701)
Length: 203
Checksum: 0xe0bc [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Data (16 bytes)

0000 2b 0f 00 c3 c3 26 b9 84 da 70 0e b3 e9 3d 67 a9 +....&...p...=g.
Data: 2b0f00c3c326b984da700eb3e93d67a9
[Length: 16]

Jul 28 07:11:11.750: RADIUS: COA received from id 16 10.26.129.25:51041, CoA Request, len 191
Jul 28 07:11:11.750: COA: 10.26.129.25 request queued
Jul 28 07:11:11.750: RADIUS: authenticator 3E 6C 9D 57 68 14 8D 09 - 1E B9 C0 76 44 2C 2D 30
Jul 28 07:11:11.750: RADIUS: User-Name [1] 8 "danone"
Jul 28 07:11:11.750: RADIUS: Framed-IP-Address [8] 6 10.240.50.85
Jul 28 07:11:11.750: RADIUS: Acct-Session-Id [44] 18 "9C00000000583C9E"
Jul 28 07:11:11.750: RADIUS: Vendor, Cisco [26] 26
Jul 28 07:11:11.750: RADIUS: Cisco AVpair [1] 20 "ip:inacl=Unlimited"
Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 27
Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 21 "ip:outacl=Unlimited"
Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 42
Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 36 "ip:sub-qos-policy-in=Unlim-15Mb-in"
Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 44
Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 38 "ip:sub-qos-policy-out=Unlim-15Mb-out"
Jul 28 07:11:11.751: COA: Message Authenticator missing or failed decode

Jul 28 07:11:11.751: ++++++ CoA Attribute List ++++++
Jul 28 07:11:11.751: 53DE5F30 0 00000081 username(450) 6 danone
Jul 28 07:11:11.751: 53DE11A0 0 00000001 addr(8) 4 10.240.50.85
Jul 28 07:11:11.751: 53DE11D4 0 00000001 session-id(408) 4 5782686(583C9E)
Jul 28 07:11:11.751: 53DE1208 0 00000081 inacl(144) 9 Unlimited
Jul 28 07:11:11.751: 53DE123C 0 00000081 outacl(310) 9 Unlimited
Jul 28 07:11:11.751: 53DE1270 0 00000081 sub-qos-policy-in(421) 13 Unlim-15Mb-in
Jul 28 07:11:11.751: 53DE6F20 0 00000081 sub-qos-policy-out(423) 14 Unlim-15Mb-out
Jul 28 07:11:11.751:
Jul 28 07:11:11.777: RADIUS/ENCODE(00000000):Orig. component type = Invalid
Jul 28 07:11:11.778: RADIUS(00000000): sending
Jul 28 07:11:11.778: RADIUS(00000000): Send CoA Ack Response to 10.26.129.25:51041 id 16, len 70
Jul 28 07:11:11.778: RADIUS: authenticator A7 BC C6 54 2B BC 00 D8 - BA EE D9 F3 4A FE B7 A3
Jul 28 07:11:11.778: RADIUS: Vendor, Cisco [26] 21
Jul 28 07:11:11.778: RADIUS: ssg-account-info [250] 15 "S10.240.50.85"
Jul 28 07:11:11.779: RADIUS: Vendor, Cisco [26] 29
Jul 28 07:11:11.779: RADIUS: ssg-account-info [250] 23 "$IVirtual-Access2.306"

No. Time Source Destination Protocol Length Info
21 3249.635972 10.26.129.25 10.26.129.43 UDP 98 Source port: 51041 Destination port: l2f

Frame 21: 98 bytes on wire (784 bits), 58 bytes captured (464 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jul 28, 2014 12:05:21.384532000 Московское время (зима)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1406534721.384532000 seconds
[Time delta from previous captured frame: 924.523076000 seconds]
[Time delta from previous displayed frame: 924.523076000 seconds]
[Time since reference or first frame: 3249.635972000 seconds]
Frame Number: 21
Frame Length: 98 bytes (784 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: IntelCor_89:b5:ae (00:1b:21:89:b5:ae), Dst: Cisco_99:7d:01 (70:81:05:99:7d:01)
Destination: Cisco_99:7d:01 (70:81:05:99:7d:01)
Address: Cisco_99:7d:01 (70:81:05:99:7d:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.26.129.25 (10.26.129.25), Dst:
10.26.129.43 (10.26.129.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 84
Identification: 0x9013 (36883)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 63
Protocol: UDP (17)
Header checksum: 0x070d [validation disabled]
[Good: False]
[Bad: False]
Source: 10.26.129.25 (10.26.129.25)
Destination: 10.26.129.43 (10.26.129.43)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 51041 (51041), Dst Port: l2f (1701)
Source port: 51041 (51041)
Destination port: l2f (1701)
Length: 64
Checksum: 0x613d [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Data (16 bytes)
Data: 2811003863e5cd58851a958c9c1de9ad
[Length: 16]

0000 70 81 05 99 7d 01 00 1b 21 89 b5 ae 08 00 45 00 p...}...!.....E.
0010 00 54 90 13 40 00 3f 11 07 0d 51 1a 81 19 51 1a .T..@.?...Q...Q.
0020 81 2b c7 61 06 a5 00 40 61 3d 28 11 00 38 63 e5 .+.a...@a=(..8c.
0030 cd 58 85 1a 95 8c 9c 1d e9 ad .X........

No. Time Source Destination Protocol Length Info
22 3249.639193 10.26.129.43 10.26.129.25 UDP 62 Source port: l2f Destination port: 51041

Frame 22: 62 bytes on wire (496 bits), 58 bytes captured (464 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jul 28, 2014 12:05:21.387753000 Московское время (зима)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1406534721.387753000 seconds
[Time delta from previous captured frame: 0.003221000 seconds]
[Time delta from previous displayed frame: 0.003221000 seconds]
[Time since reference or first frame: 3249.639193000 seconds]
Frame Number: 22
Frame Length: 62 bytes (496 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: Cisco_99:7d:01 (70:81:05:99:7d:01), Dst: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Destination: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Cisco_99:7d:01 (70:81:05:99:7d:01)
Address: Cisco_99:7d:01 (70:81:05:99:7d:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.26.129.43 (10.26.129.43), Dst:
10.26.129.25 (10.26.129.25)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 48
Identification: 0x6dc0 (28096)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0xa983 [validation disabled]
[Good: False]
[Bad: False]
Source: 10.26.129.43 (10.26.129.43)
Destination: 10.26.129.25 (10.26.129.25)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: l2f (1701), Dst Port: 51041 (51041)
Source port: l2f (1701)
Destination port: 51041 (51041)
Length: 28
Checksum: 0x6385 [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Data (16 bytes)
Data: 29110014b9f1e8b88f24203e9807d81b
[Length: 16]

0000 00 1b 21 89 b5 ae 70 81 05 99 7d 01 08 00 45 00 ..!...p...}...E.
0010 00 30 6d c0 00 00 ff 11 a9 83 51 1a 81 2b 51 1a .0m.......Q..+Q.
0020 81 19 06 a5 c7 61 00 1c 63 85 29 11 00 14 b9 f1 .....a..c.).....
0030 e8 b8 8f 24 20 3e 98 07 d8 1b ...$ >....

Автор:	ЮжныйКраснодар [ 28 июл 2014, 17:32 ]
Заголовок сообщения:	[6.0] CoA request не всегда отрабатывает
Добрый день. Обработчик активации сервисов - ru.bitel.bgbilling.modules.inet.dyn.device.radius.CoAServiceActivator Существует проблема - периодически при посыле CoA request сообщения от RADIUS к NAS, в ответ ничего не приходит - соответственно не работает функция смены тарифного плана без разрыва сессии. Проблема возникает в целом в 40% от общего числа запросов. Результаты поиска проблемы на сети между RADIUS и NAS показали следующее: сбор трафика в момент посылки CoA tcpdump на устройстве посередине между RADIUS и NAS -RADIUS посылает UDP пакет размером 237 Байт с порта 51041 на порт 1701 NAS. В ответ ничего не приходит. Логи debug radius и debug aaa coa на NAS не показывают приходящих CoA request. В принципе на NAS ничего связанного с CoA обнаружить не удалось. При попытке повторить ошибку - всегда приходит пакет со стороны RADIUS размером 237 Байт. лог из Access-сервера Код: connection 07-28/10:00:19 INFO [sa-p-13-t-51] ServiceActivatorSet - Invoking connectionModify connection 07-28/10:00:19 INFO [sa-p-13-t-51] CoAServiceActivator - Connection modify: oldState: 1; newState: 1; oldOptionSet: [5]; newOptionSet: [6] connection 07-28/10:00:19 INFO [sa-p-13-t-51] CoAServiceActivator - Send CoA: Packet type: CoA-Request Identifier: 11 Authenticator: {4E 60 CF 39 ED 66 5D 2C 01 CA B9 B5 CF C2 25 C5} Attributes: User-Name=pashkoalex Framed-IP-Address=10.240.50.94 Acct-Session-Id=9C00000000583BD5 cisco-avpair=ip:inacl=Unlimited cisco-avpair=ip:outacl=Unlimited cisco-avpair=ip:sub-qos-policy-in=Unlim-10Mb-in cisco-avpair=ip:sub-qos-policy-out=Unlim-10Mb-out connection 07-28/10:00:19 INFO [sa-p-13-t-51] RadiusClient - Sending to /10.26.129.43:1701 Packet type: CoA-Request Identifier: 11 Authenticator: {4E 60 CF 39 ED 66 5D 2C 01 CA B9 B5 CF C2 25 C5} Attributes: User-Name=pashkoalex Framed-IP-Address=10.240.50.94 Acct-Session-Id=9C00000000583BD5 cisco-avpair=ip:inacl=Unlimited cisco-avpair=ip:outacl=Unlimited cisco-avpair=ip:sub-qos-policy-in=Unlim-10Mb-in cisco-avpair=ip:sub-qos-policy-out=Unlim-10Mb-out RADIUS -> NAS Код: No. Time Source Destination Protocol Length Info 1 0.000000 10.26.129.25 10.26.129.43 UDP 237 Source port: 51041 Destination port: l2f Frame 1: 237 bytes on wire (1896 bits), 58 bytes captured (464 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 28, 2014 11:00:09.622486000 Московское время (зима) [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1406530809.622486000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 237 bytes (1896 bits) Capture Length: 58 bytes (464 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:data] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: IntelCor_89:b5:ae (00:1b:21:89:b5:ae), Dst: Cisco_99:7d:01 (70:81:05:99:7d:01) Destination: Cisco_99:7d:01 (70:81:05:99:7d:01) Address: Cisco_99:7d:01 (70:81:05:99:7d:01) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.26.129.25 (10.26.129.25), Dst: 10.26.129.43 (10.26.129.43) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 223 Identification: 0x9014 (36884) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: UDP (17) Header checksum: 0x0681 [validation disabled] [Good: False] [Bad: False] Source: 10.26.129.25 (10.26.129.25) Destination: 10.26.129.43 (10.26.129.43) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: 51041 (51041), Dst Port: l2f (1701) Source port: 51041 (51041) Destination port: l2f (1701) Length: 203 Checksum: 0xe0bc [unchecked, not all data available] [Good Checksum: False] [Bad Checksum: False] Data (16 bytes) 0000 2b 0f 00 c3 c3 26 b9 84 da 70 0e b3 e9 3d 67 a9 +....&...p...=g. Data: 2b0f00c3c326b984da700eb3e93d67a9 [Length: 16] Что происходит когда CoA отрабатывает в штатном режиме - RADIUS посылает UDP пакет размером 98 Байт с порта 51041 на порт 1701 NAS. На NAS в дебаге: Код: Jul 28 07:11:11.750: RADIUS: COA received from id 16 10.26.129.25:51041, CoA Request, len 191 Jul 28 07:11:11.750: COA: 10.26.129.25 request queued Jul 28 07:11:11.750: RADIUS: authenticator 3E 6C 9D 57 68 14 8D 09 - 1E B9 C0 76 44 2C 2D 30 Jul 28 07:11:11.750: RADIUS: User-Name [1] 8 "danone" Jul 28 07:11:11.750: RADIUS: Framed-IP-Address [8] 6 10.240.50.85 Jul 28 07:11:11.750: RADIUS: Acct-Session-Id [44] 18 "9C00000000583C9E" Jul 28 07:11:11.750: RADIUS: Vendor, Cisco [26] 26 Jul 28 07:11:11.750: RADIUS: Cisco AVpair [1] 20 "ip:inacl=Unlimited" Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 27 Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 21 "ip:outacl=Unlimited" Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 42 Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 36 "ip:sub-qos-policy-in=Unlim-15Mb-in" Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 44 Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 38 "ip:sub-qos-policy-out=Unlim-15Mb-out" Jul 28 07:11:11.751: COA: Message Authenticator missing or failed decode Jul 28 07:11:11.751: ++++++ CoA Attribute List ++++++ Jul 28 07:11:11.751: 53DE5F30 0 00000081 username(450) 6 danone Jul 28 07:11:11.751: 53DE11A0 0 00000001 addr(8) 4 10.240.50.85 Jul 28 07:11:11.751: 53DE11D4 0 00000001 session-id(408) 4 5782686(583C9E) Jul 28 07:11:11.751: 53DE1208 0 00000081 inacl(144) 9 Unlimited Jul 28 07:11:11.751: 53DE123C 0 00000081 outacl(310) 9 Unlimited Jul 28 07:11:11.751: 53DE1270 0 00000081 sub-qos-policy-in(421) 13 Unlim-15Mb-in Jul 28 07:11:11.751: 53DE6F20 0 00000081 sub-qos-policy-out(423) 14 Unlim-15Mb-out Jul 28 07:11:11.751: Jul 28 07:11:11.777: RADIUS/ENCODE(00000000):Orig. component type = Invalid Jul 28 07:11:11.778: RADIUS(00000000): sending Jul 28 07:11:11.778: RADIUS(00000000): Send CoA Ack Response to 10.26.129.25:51041 id 16, len 70 Jul 28 07:11:11.778: RADIUS: authenticator A7 BC C6 54 2B BC 00 D8 - BA EE D9 F3 4A FE B7 A3 Jul 28 07:11:11.778: RADIUS: Vendor, Cisco [26] 21 Jul 28 07:11:11.778: RADIUS: ssg-account-info [250] 15 "S10.240.50.85" Jul 28 07:11:11.779: RADIUS: Vendor, Cisco [26] 29 Jul 28 07:11:11.779: RADIUS: ssg-account-info [250] 23 "$IVirtual-Access2.306" Как видно из написанного выше в ответ NAS посылает CoA Ack Response на порт 51041. Функция отработала, смена тарифа произошла. RADIUS -> NAS Код: No. Time Source Destination Protocol Length Info 21 3249.635972 10.26.129.25 10.26.129.43 UDP 98 Source port: 51041 Destination port: l2f Frame 21: 98 bytes on wire (784 bits), 58 bytes captured (464 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 28, 2014 12:05:21.384532000 Московское время (зима) [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1406534721.384532000 seconds [Time delta from previous captured frame: 924.523076000 seconds] [Time delta from previous displayed frame: 924.523076000 seconds] [Time since reference or first frame: 3249.635972000 seconds] Frame Number: 21 Frame Length: 98 bytes (784 bits) Capture Length: 58 bytes (464 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:data] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: IntelCor_89:b5:ae (00:1b:21:89:b5:ae), Dst: Cisco_99:7d:01 (70:81:05:99:7d:01) Destination: Cisco_99:7d:01 (70:81:05:99:7d:01) Address: Cisco_99:7d:01 (70:81:05:99:7d:01) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.26.129.25 (10.26.129.25), Dst: 10.26.129.43 (10.26.129.43) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 84 Identification: 0x9013 (36883) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: UDP (17) Header checksum: 0x070d [validation disabled] [Good: False] [Bad: False] Source: 10.26.129.25 (10.26.129.25) Destination: 10.26.129.43 (10.26.129.43) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: 51041 (51041), Dst Port: l2f (1701) Source port: 51041 (51041) Destination port: l2f (1701) Length: 64 Checksum: 0x613d [unchecked, not all data available] [Good Checksum: False] [Bad Checksum: False] Data (16 bytes) Data: 2811003863e5cd58851a958c9c1de9ad [Length: 16] 0000 70 81 05 99 7d 01 00 1b 21 89 b5 ae 08 00 45 00 p...}...!.....E. 0010 00 54 90 13 40 00 3f 11 07 0d 51 1a 81 19 51 1a .T..@.?...Q...Q. 0020 81 2b c7 61 06 a5 00 40 61 3d 28 11 00 38 63 e5 .+.a...@a=(..8c. 0030 cd 58 85 1a 95 8c 9c 1d e9 ad .X........ NAS -> RADIUS Код: No. Time Source Destination Protocol Length Info 22 3249.639193 10.26.129.43 10.26.129.25 UDP 62 Source port: l2f Destination port: 51041 Frame 22: 62 bytes on wire (496 bits), 58 bytes captured (464 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 28, 2014 12:05:21.387753000 Московское время (зима) [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1406534721.387753000 seconds [Time delta from previous captured frame: 0.003221000 seconds] [Time delta from previous displayed frame: 0.003221000 seconds] [Time since reference or first frame: 3249.639193000 seconds] Frame Number: 22 Frame Length: 62 bytes (496 bits) Capture Length: 58 bytes (464 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:data] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_99:7d:01 (70:81:05:99:7d:01), Dst: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) Destination: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Cisco_99:7d:01 (70:81:05:99:7d:01) Address: Cisco_99:7d:01 (70:81:05:99:7d:01) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.26.129.43 (10.26.129.43), Dst: 10.26.129.25 (10.26.129.25) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 48 Identification: 0x6dc0 (28096) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (17) Header checksum: 0xa983 [validation disabled] [Good: False] [Bad: False] Source: 10.26.129.43 (10.26.129.43) Destination: 10.26.129.25 (10.26.129.25) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: l2f (1701), Dst Port: 51041 (51041) Source port: l2f (1701) Destination port: 51041 (51041) Length: 28 Checksum: 0x6385 [unchecked, not all data available] [Good Checksum: False] [Bad Checksum: False] Data (16 bytes) Data: 29110014b9f1e8b88f24203e9807d81b [Length: 16] 0000 00 1b 21 89 b5 ae 70 81 05 99 7d 01 08 00 45 00 ..!...p...}...E. 0010 00 30 6d c0 00 00 ff 11 a9 83 51 1a 81 2b 51 1a .0m.......Q..+Q. 0020 81 19 06 a5 c7 61 00 1c 63 85 29 11 00 14 b9 f1 .....a..c.)..... 0030 e8 b8 8f 24 20 3e 98 07 d8 1b ...$ >.... Как видно на первый взгляд - проблема повторяется когда пакет CoA Requset приходит не стандартного размера, а именно 237 Байт вместо 98. На машине, отлавливающей пакеты в tcpdump при принятии пакета CoA Requset размером 237 Байт также выдается сообщение: IP 10.26.129.25.51041 > 10.26.129.43.1701: Unknown Version, neither L2F(1) nor L2TP(2) Просьба помочь разобраться с проблемой.

Автор:	Amir [ 29 июл 2014, 18:56 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
А если просмотреть пакет 237 байт через wireshark - он нормально отображается без ошибок, также как 98? А почему так сильно отличается размер? Разный набор RADIUS-атрибутов?

Автор:	ЮжныйКраснодар [ 30 июл 2014, 11:44 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
Ловил пакеты на сервере, где работает BGBilling, разница в размере пакетов не существенная: 231 Байт - у пакета с CoA запросом, который отработал, 233 байта - у пакета с CoA запросом, который не отработал. Существенных отличий в paylod нет. Прикладываю paylod "работающего" пакета: Код: No. Time Source Destination Protocol Length Info 1 0.000000 172.16.0.11 10.26.129.43 RADIUS 231 CoA-Request(43) (id=25, l=189) Radius Protocol Code: CoA-Request (43) Packet identifier: 0x19 (25) Length: 189 Authenticator: 31a7f29c178633ee0d8c826b4e88be05 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=8 t=User-Name(1): danone User-Name: danone AVP: l=6 t=Framed-IP-Address(8): 10.240.62.230 Framed-IP-Address: 10.240.62.230 (10.240.62.230) AVP: l=18 t=Acct-Session-Id(44): 9C000000005841A2 Acct-Session-Id: 9C000000005841A2 AVP: l=26 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=20 t=Cisco-AVPair(1): ip:inacl=Unlimited Cisco-AVPair: ip:inacl=Unlimited AVP: l=27 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=21 t=Cisco-AVPair(1): ip:outacl=Unlimited Cisco-AVPair: ip:outacl=Unlimited AVP: l=41 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=35 t=Cisco-AVPair(1): ip:sub-qos-policy-in=Unlim-8Mb-in Cisco-AVPair: ip:sub-qos-policy-in=Unlim-8Mb-in AVP: l=43 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=37 t=Cisco-AVPair(1): ip:sub-qos-policy-out=Unlim-8Mb-out Cisco-AVPair: ip:sub-qos-policy-out=Unlim-8Mb-out paylod "неработающего": Код: No. Time Source Destination Protocol Length Info 3 80.259456 172.16.0.11 10.26.129.43 RADIUS 233 CoA-Request(43) (id=26, l=191) Radius Protocol Code: CoA-Request (43) Packet identifier: 0x1a (26) Length: 191 Authenticator: 39ea2b8e4c7004ea39c72c4c616a9ad9 Attribute Value Pairs AVP: l=8 t=User-Name(1): danone User-Name: danone AVP: l=6 t=Framed-IP-Address(8): 10.240.62.230 Framed-IP-Address: 10.240.62.230 (10.240.62.230) AVP: l=18 t=Acct-Session-Id(44): 9C000000005841A2 Acct-Session-Id: 9C000000005841A2 AVP: l=26 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=20 t=Cisco-AVPair(1): ip:inacl=Unlimited Cisco-AVPair: ip:inacl=Unlimited AVP: l=27 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=21 t=Cisco-AVPair(1): ip:outacl=Unlimited Cisco-AVPair: ip:outacl=Unlimited AVP: l=42 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=36 t=Cisco-AVPair(1): ip:sub-qos-policy-in=Unlim-30Mb-in Cisco-AVPair: ip:sub-qos-policy-in=Unlim-30Mb-in AVP: l=44 t=Vendor-Specific(26) v=ciscoSystems(9) VSA: l=38 t=Cisco-AVPair(1): ip:sub-qos-policy-out=Unlim-30Mb-out Cisco-AVPair: ip:sub-qos-policy-out=Unlim-30Mb-out

Автор:	ЮжныйКраснодар [ 31 июл 2014, 12:03 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
В дополнение к вышеописанной проблеме. BGBilling применяет политики к пользователю в "одностороннем порядке", т.е. считает, что политика применилась и работает на NAS без подтверждающего сообщения от NAS. Как пример, в случае отправки сообщения CoA Request, скажем для смены скоростных ограничений с 8Мбит/с на 30Мбит/с для определенного абонента, не дожидаясь CoA ACK, новые ограничения уже отображаются в клиенте BGBilling (Договор -> Модули -> Модуль Интернет -> Состояние: "Включен, активные опции: 30МБит/с (in/out)(10)"). По факту же получается - CoA ACK вообще может не прийти по какой-либо причине, а будет считаться, что абоненту применена опция. Возможно есть какая-то возможность данную функцию настроить по другому. Просьба оставить комментарий по поводу данной проблемы.

Автор:	Amir [ 31 июл 2014, 15:15 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
Состояние сервиса, активные опции сервиса и состояние сессии, активные опции сессии - это две разные вещи. То что привязано к сервису применяется в основном в схемах с управлением коммутаторами, т.е. в случае с RADIUS он будет просто меняться на тот что в тарифе. В соединении же нужно смотреть на данный момент только в БД inet_connection.deviceOptionIds. Не должно быть такого, что NAK меняет активные опции на сессии, как и ACK, хотя не исключаем ошибки.

forum.bitel.ru http://forum.bitel.ru/

[6.0] CoA request не всегда отрабатывает http://forum.bitel.ru/viewtopic.php?f=44&t=9501	Страница 1 из 1

Автор:	Amir [ 31 июл 2014, 15:22 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
Возможно что активный набор опций (deviceOptionIds) на сессии остается старым, но повторные CoA не отправляются после получения NAK (пока набор опций из тарифа снова не изменится).

Автор:	ЮжныйКраснодар [ 01 авг 2014, 11:34 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
По второму вопросу - понятно! А что с CoA?

Автор:	Amir [ 02 авг 2014, 21:06 ]
Заголовок сообщения:	Re: [6.0] CoA request не всегда отрабатывает
С размерами не совсем понял. На машине с Access они иногда больше, чем когда приходят в NAS? Похоже не в биллинге дело, если бы некоторые пакеты были кривыми, payload бы скорее всего не отобразился или был бы с ошибками. В wireshark такие пакеты тоже бы отображались как не правильные.

Страница 1 из 1	Часовой пояс: UTC + 5 часов [ Летнее время ]
Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/