Meraki’s Accounting-Requests to RADIUS server

access-pointfreeradiusradiusubuntu-10.04

I'm running a RADIUS server with some Meraki APs, the process of Authentications is fine… But it seems that the Meraki Cloud Controller is just sending the authentication packets and not the accounting requests. I've tested the RADIUS sending accounting requests with the radclient tool (locally) and it worked.

I think that maybe my RADIUS server is ignoring the accounting requests from the MCC because there are some Vendor Specific Attributes that my RADIUS doesn't know. should I add a Meraki's dictionary to my RADIUS configurations?

I'm kind of desperate, any idea?

Best Answer

run the radsniff utility that is included in the standard set of utilities, to verify that the server is actually receiving the accounting packets (or start the daemon debug mode -X). FreeRADIUS will not ignore well formed VSAs even if it does not have the dictionaries to decode them.

Related Solutions

Users loggin to 3Com switches authenticated by radius not getting admin priv and no access available with radius service down

We can login to the 3coms 45 and 55's using SSH and RADIUS authentication it is a bit of a pain to setup with IAS though.

RADIUS authentication with local failover

Here is the configuration that work on SW5500.

 sysname 5500-SI
#
 password-control length 4
 password-control history 2
 password-control login-attempt 3 exceed lock-time 120
#
 super password level 3 simple password
#
 local-server nas-ip 127.0.0.1 key 3com
#
 domain default enable 3comdevicelogin
#
 dot1x
 dot1x timer tx-period 10
 dot1x timer handshake-period 1024
 dot1x authentication-method eap
#
radius scheme system
#
radius scheme 3comapsc
 server-type standard
 primary authentication 152.67.101.23
 accounting optional
 key authentication radius
 user-name-format without-domain
 nas-ip 152.67.101.54
#
radius scheme 3ComDeviceLogin
 server-type extended
 primary authentication 152.67.101.39
 accounting optional
 key authentication radius
 user-name-format without-domain
 nas-ip 152.67.101.54
#
domain 3comdevicelogin
 scheme radius-scheme 3ComDeviceLogin local
domain apsc
 scheme radius-scheme 3comapsc
domain system
#
local-user admin
 service-type ssh telnet terminal
 level 3
 password-control aging 90
local-user manager
 service-type ssh telnet terminal
 level 2
local-user monitor
 service-type ssh telnet terminal
 level 1
#

Accounting setup in freeradius with mikrotik and the “always” module

I looked at the URL you provided and I found that an interesting way of doing it. I would seriously consider the fact that the example is possibly outdated before relying on it.

On our FreeRadius implementation we get around the accounting updates problem by setting a timeout in our Radius database. We do this by having a Attribute "Session-Timeout" op "=" and Value "86400" in the radgroupreply table.

This has the effect of "timing out" the user every 24 hours. Most PPPoE clients (including ADSL and MikroTik routers) are programmed to reconnect strait away. This is normally a split second operation on a MikroTik client router and in theory not that disruptive. My tests have however shown that it can in fact break certain TCP/IP operations, e.g. downloads.

However, the method we use seems very reliable and a good failover method if your interim updates fail or your disconnect method breaks.

Best Answer

Related Solutions

Users loggin to 3Com switches authenticated by radius not getting admin priv and no access available with radius service down

Accounting setup in freeradius with mikrotik and the “always” module

Related Topic