Добрый день.
Обработчик активации сервисов - ru.bitel.bgbilling.modules.inet.dyn.device.radius.CoAServiceActivator
Существует проблема - периодически при посыле CoA request сообщения от RADIUS к NAS, в ответ ничего не приходит - соответственно не работает функция смены тарифного плана без разрыва сессии. Проблема
возникает в целом в 40% от общего числа запросов.
Результаты поиска проблемы на сети между RADIUS и NAS показали следующее: сбор трафика в момент посылки CoA tcpdump на устройстве посередине между RADIUS и NAS -RADIUS посылает UDP пакет размером 237 Байт с порта 51041 на порт 1701 NAS.
В ответ ничего не приходит. Логи debug radius и debug aaa coa на NAS не показывают приходящих CoA request. В принципе на NAS ничего связанного с CoA обнаружить не удалось. При попытке повторить ошибку - всегда приходит пакет со стороны RADIUS размером 237 Байт.
лог из Access-сервера
Код:
connection 07-28/10:00:19 INFO [sa-p-13-t-51] ServiceActivatorSet - Invoking connectionModify
connection 07-28/10:00:19 INFO [sa-p-13-t-51] CoAServiceActivator - Connection modify: oldState: 1; newState: 1; oldOptionSet: [5]; newOptionSet: [6]
connection 07-28/10:00:19 INFO [sa-p-13-t-51] CoAServiceActivator - Send CoA:
Packet type: CoA-Request
Identifier: 11
Authenticator: {4E 60 CF 39 ED 66 5D 2C 01 CA B9 B5 CF C2 25 C5}
Attributes:
User-Name=pashkoalex
Framed-IP-Address=10.240.50.94
Acct-Session-Id=9C00000000583BD5
cisco-avpair=ip:inacl=Unlimited
cisco-avpair=ip:outacl=Unlimited
cisco-avpair=ip:sub-qos-policy-in=Unlim-10Mb-in
cisco-avpair=ip:sub-qos-policy-out=Unlim-10Mb-out
connection 07-28/10:00:19 INFO [sa-p-13-t-51] RadiusClient - Sending to /10.26.129.43:1701
Packet type: CoA-Request
Identifier: 11
Authenticator: {4E 60 CF 39 ED 66 5D 2C 01 CA B9 B5 CF C2 25 C5}
Attributes:
User-Name=pashkoalex
Framed-IP-Address=10.240.50.94
Acct-Session-Id=9C00000000583BD5
cisco-avpair=ip:inacl=Unlimited
cisco-avpair=ip:outacl=Unlimited
cisco-avpair=ip:sub-qos-policy-in=Unlim-10Mb-in
cisco-avpair=ip:sub-qos-policy-out=Unlim-10Mb-out
RADIUS -> NAS
Код:
No. Time Source Destination Protocol Length Info
1 0.000000 10.26.129.25 10.26.129.43 UDP 237 Source port: 51041 Destination port: l2f
Frame 1: 237 bytes on wire (1896 bits), 58 bytes captured (464 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jul 28, 2014 11:00:09.622486000 Московское время (зима)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1406530809.622486000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 237 bytes (1896 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: IntelCor_89:b5:ae (00:1b:21:89:b5:ae), Dst: Cisco_99:7d:01 (70:81:05:99:7d:01)
Destination: Cisco_99:7d:01 (70:81:05:99:7d:01)
Address: Cisco_99:7d:01 (70:81:05:99:7d:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.26.129.25 (10.26.129.25), Dst: 10.26.129.43 (10.26.129.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 223
Identification: 0x9014 (36884)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 63
Protocol: UDP (17)
Header checksum: 0x0681 [validation disabled]
[Good: False]
[Bad: False]
Source: 10.26.129.25 (10.26.129.25)
Destination: 10.26.129.43 (10.26.129.43)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 51041 (51041), Dst Port: l2f (1701)
Source port: 51041 (51041)
Destination port: l2f (1701)
Length: 203
Checksum: 0xe0bc [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Data (16 bytes)
0000 2b 0f 00 c3 c3 26 b9 84 da 70 0e b3 e9 3d 67 a9 +....&...p...=g.
Data: 2b0f00c3c326b984da700eb3e93d67a9
[Length: 16]
Что происходит когда CoA отрабатывает в штатном режиме - RADIUS посылает UDP пакет размером 98 Байт с порта 51041 на порт 1701 NAS.
На NAS в дебаге:
Код:
Jul 28 07:11:11.750: RADIUS: COA received from id 16 10.26.129.25:51041, CoA Request, len 191
Jul 28 07:11:11.750: COA: 10.26.129.25 request queued
Jul 28 07:11:11.750: RADIUS: authenticator 3E 6C 9D 57 68 14 8D 09 - 1E B9 C0 76 44 2C 2D 30
Jul 28 07:11:11.750: RADIUS: User-Name [1] 8 "danone"
Jul 28 07:11:11.750: RADIUS: Framed-IP-Address [8] 6 10.240.50.85
Jul 28 07:11:11.750: RADIUS: Acct-Session-Id [44] 18 "9C00000000583C9E"
Jul 28 07:11:11.750: RADIUS: Vendor, Cisco [26] 26
Jul 28 07:11:11.750: RADIUS: Cisco AVpair [1] 20 "ip:inacl=Unlimited"
Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 27
Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 21 "ip:outacl=Unlimited"
Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 42
Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 36 "ip:sub-qos-policy-in=Unlim-15Mb-in"
Jul 28 07:11:11.751: RADIUS: Vendor, Cisco [26] 44
Jul 28 07:11:11.751: RADIUS: Cisco AVpair [1] 38 "ip:sub-qos-policy-out=Unlim-15Mb-out"
Jul 28 07:11:11.751: COA: Message Authenticator missing or failed decode
Jul 28 07:11:11.751: ++++++ CoA Attribute List ++++++
Jul 28 07:11:11.751: 53DE5F30 0 00000081 username(450) 6 danone
Jul 28 07:11:11.751: 53DE11A0 0 00000001 addr(8) 4 10.240.50.85
Jul 28 07:11:11.751: 53DE11D4 0 00000001 session-id(408) 4 5782686(583C9E)
Jul 28 07:11:11.751: 53DE1208 0 00000081 inacl(144) 9 Unlimited
Jul 28 07:11:11.751: 53DE123C 0 00000081 outacl(310) 9 Unlimited
Jul 28 07:11:11.751: 53DE1270 0 00000081 sub-qos-policy-in(421) 13 Unlim-15Mb-in
Jul 28 07:11:11.751: 53DE6F20 0 00000081 sub-qos-policy-out(423) 14 Unlim-15Mb-out
Jul 28 07:11:11.751:
Jul 28 07:11:11.777: RADIUS/ENCODE(00000000):Orig. component type = Invalid
Jul 28 07:11:11.778: RADIUS(00000000): sending
Jul 28 07:11:11.778: RADIUS(00000000): Send CoA Ack Response to 10.26.129.25:51041 id 16, len 70
Jul 28 07:11:11.778: RADIUS: authenticator A7 BC C6 54 2B BC 00 D8 - BA EE D9 F3 4A FE B7 A3
Jul 28 07:11:11.778: RADIUS: Vendor, Cisco [26] 21
Jul 28 07:11:11.778: RADIUS: ssg-account-info [250] 15 "S10.240.50.85"
Jul 28 07:11:11.779: RADIUS: Vendor, Cisco [26] 29
Jul 28 07:11:11.779: RADIUS: ssg-account-info [250] 23 "$IVirtual-Access2.306"
Как видно из написанного выше в ответ NAS посылает CoA Ack Response на порт 51041. Функция отработала, смена тарифа произошла.
RADIUS -> NAS
Код:
No. Time Source Destination Protocol Length Info
21 3249.635972 10.26.129.25 10.26.129.43 UDP 98 Source port: 51041 Destination port: l2f
Frame 21: 98 bytes on wire (784 bits), 58 bytes captured (464 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jul 28, 2014 12:05:21.384532000 Московское время (зима)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1406534721.384532000 seconds
[Time delta from previous captured frame: 924.523076000 seconds]
[Time delta from previous displayed frame: 924.523076000 seconds]
[Time since reference or first frame: 3249.635972000 seconds]
Frame Number: 21
Frame Length: 98 bytes (784 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: IntelCor_89:b5:ae (00:1b:21:89:b5:ae), Dst: Cisco_99:7d:01 (70:81:05:99:7d:01)
Destination: Cisco_99:7d:01 (70:81:05:99:7d:01)
Address: Cisco_99:7d:01 (70:81:05:99:7d:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.26.129.25 (10.26.129.25), Dst:
10.26.129.43 (10.26.129.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 84
Identification: 0x9013 (36883)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 63
Protocol: UDP (17)
Header checksum: 0x070d [validation disabled]
[Good: False]
[Bad: False]
Source: 10.26.129.25 (10.26.129.25)
Destination: 10.26.129.43 (10.26.129.43)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 51041 (51041), Dst Port: l2f (1701)
Source port: 51041 (51041)
Destination port: l2f (1701)
Length: 64
Checksum: 0x613d [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Data (16 bytes)
Data: 2811003863e5cd58851a958c9c1de9ad
[Length: 16]
0000 70 81 05 99 7d 01 00 1b 21 89 b5 ae 08 00 45 00 p...}...!.....E.
0010 00 54 90 13 40 00 3f 11 07 0d 51 1a 81 19 51 1a .T..@.?...Q...Q.
0020 81 2b c7 61 06 a5 00 40 61 3d 28 11 00 38 63 e5 .+.a...@a=(..8c.
0030 cd 58 85 1a 95 8c 9c 1d e9 ad .X........
NAS -> RADIUS
Код:
No. Time Source Destination Protocol Length Info
22 3249.639193 10.26.129.43 10.26.129.25 UDP 62 Source port: l2f Destination port: 51041
Frame 22: 62 bytes on wire (496 bits), 58 bytes captured (464 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jul 28, 2014 12:05:21.387753000 Московское время (зима)
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1406534721.387753000 seconds
[Time delta from previous captured frame: 0.003221000 seconds]
[Time delta from previous displayed frame: 0.003221000 seconds]
[Time since reference or first frame: 3249.639193000 seconds]
Frame Number: 22
Frame Length: 62 bytes (496 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: Cisco_99:7d:01 (70:81:05:99:7d:01), Dst: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Destination: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
Address: IntelCor_89:b5:ae (00:1b:21:89:b5:ae)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Cisco_99:7d:01 (70:81:05:99:7d:01)
Address: Cisco_99:7d:01 (70:81:05:99:7d:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.26.129.43 (10.26.129.43), Dst:
10.26.129.25 (10.26.129.25)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 48
Identification: 0x6dc0 (28096)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0xa983 [validation disabled]
[Good: False]
[Bad: False]
Source: 10.26.129.43 (10.26.129.43)
Destination: 10.26.129.25 (10.26.129.25)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: l2f (1701), Dst Port: 51041 (51041)
Source port: l2f (1701)
Destination port: 51041 (51041)
Length: 28
Checksum: 0x6385 [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Data (16 bytes)
Data: 29110014b9f1e8b88f24203e9807d81b
[Length: 16]
0000 00 1b 21 89 b5 ae 70 81 05 99 7d 01 08 00 45 00 ..!...p...}...E.
0010 00 30 6d c0 00 00 ff 11 a9 83 51 1a 81 2b 51 1a .0m.......Q..+Q.
0020 81 19 06 a5 c7 61 00 1c 63 85 29 11 00 14 b9 f1 .....a..c.).....
0030 e8 b8 8f 24 20 3e 98 07 d8 1b ...$ >....
Как видно на первый взгляд - проблема повторяется когда пакет CoA Requset приходит не стандартного размера, а именно 237 Байт вместо 98.
На машине, отлавливающей пакеты в tcpdump при принятии пакета CoA Requset размером 237 Байт также выдается сообщение:
IP 10.26.129.25.51041 > 10.26.129.43.1701: Unknown Version, neither L2F(1) nor L2TP(2)
Просьба помочь разобраться с проблемой.
Вход
Регистрация
FAQ
Поиск
