Subnets.ru

**TrEK** » 10 апр 2013, 16:33

Это при том что freeradius -X молчит....

**TrEK** » 10 апр 2013, 17:28

пробую ан другом сервере, там ответ:

Код: Выделить всё: Ignoring request to accounting address * port 1813 from unknown client 192.168.180.9 port 1646 Ready to process requests. Ignoring request to accounting address * port 1813 from unknown client 192.168.180.9 port 1646 Ready to process requests. Ignoring request to accounting address * port 1813 from unknown client 192.168.180.9 port 1646 Ready to process requests. Ignoring request to accounting address * port 1813 from unknown client 192.168.180.9 port 1646 Ready to process requests. Ignoring request to accounting address * port 1813 from unknown client 192.168.180.9 port 1646 Ready to process requests. Ignoring request to accounting address * port 1813 from unknown client 192.168.180.9 port 1646 Ready to process requests.

где-192.168.180.9 - это циска. Почему запросы приходят по 1646 ?

**lehisnoe** » 10 апр 2013, 18:01

TrEK писал(а):Это при том что freeradius -X молчит....

Дебаг радиуса описан в вики разработчика

TrEK писал(а):Почему запросы приходят по 1646 ?

Запросы приходят НА порт 1813 С порта 1646 - именно об этом и написано в логах.

Другой сервер "отшивает" циску потому, что она не описана как допустимый клиент.

**TrEK** » 10 апр 2013, 18:06

Другой сервер "отшивает" циску потому, что она не описана как допустимый клиент.

Это в /etc/freeradius/clients.conf ?
добавить поле

client 192.168.180.9 {
secret = [здесь_ключ_который_задан на циске radius-server key 7 10491D54261E210823493A2A373B] **??
shortname = test
}

так ?

**lehisnoe** » 12 апр 2013, 10:31

TrEK писал(а):Это в /etc/freeradius/clients.conf ?

Да, в этом файле описываются клиенты, которым радиус позволяет передавать инфу.
У тебя, видимо, линукс - т.к. у меня на FreeBSD путь к этому файлу другой.

**TrEK** » 12 апр 2013, 11:35

lehisnoe писал(а):
TrEK писал(а):Это в /etc/freeradius/clients.conf ?

Да, в этом файле описываются клиенты, которым радиус позволяет передавать инфу.
У тебя, видимо, линукс - т.к. у меня на FreeBSD путь к этому файлу другой.

ПОнял , спасибо. А мой клиент описан правильно? или должны быть еще дополнительные параметры в строках?
щас проверю с этими и отпишусь...

**lehisnoe** » 12 апр 2013, 20:12

TrEK писал(а):А мой клиент описан правильно?

Второй раз рекомендую пользоваться документацией из первоисточника

**TrEK** » 12 апр 2013, 20:30

Ну я по этому и пробовал.. http://blog.wains.be/2010/01/25/local-u ... reeradius/

но суть в том , что на циске то СЕКРЕТ нигде не вводиться, только КЛЮЧ.

TTAS5350#sh run | inc radius
aaa authorization exec h323 group radius local
aaa authorization exec sip group radius local
aaa authorization network default group radius local
aaa authorization network h323 group radius local
aaa accounting exec default start-stop group radius
aaa accounting exec h323 start-stop group radius
aaa accounting exec sip start-stop group radius
aaa accounting network default start-stop group radius
aaa accounting network h323 start-stop group radius
aaa accounting network sip start-stop group radius
aaa accounting connection h323 start-stop group radius
aaa accounting connection sip start-stop group radius
ip radius source-interface FastEthernet0/0
radius-server host хх.уу.207.117 auth-port 1812 acct-port 1813
radius-server host zz.ww.190.165 auth-port 1812 acct-port 1813
radius-server timeout 20
radius-server key 7 10491D54261E210823493A2A373B
radius-server vsa send accounting

Я в /etc/freeradius/clients.conf
вписал следующее:

Код: Выделить всё: client as5350 { ipaddr = 192.168.180.9 secret = radiuspassword }

а в /etc/freeradius/users:

Код: Выделить всё: login Cleartext-Password := "password" login2 Cleartext-Password := "password2"

ЛОги показывают что принимают инфу от циски:

Код: Выделить всё: Listening on accounting address * port 1813 Listening on proxy address zzz.yyy.190.165 port 1814 Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=216, length=704 Received Accounting-Request packet from 192.168.180.9 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=218, length=998 Received Accounting-Request packet from 192.168.180.9 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.7 seconds. Cleaning up request 0 ID 216 with timestamp +1 Waking up in 0.2 seconds. Cleaning up request 1 ID 218 with timestamp +1 Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=220, length=1142 Received Accounting-Request packet from 192.168.180.9 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request

но понятно что не может по авторизайции пройти...

**lehisnoe** » 12 апр 2013, 20:49

TrEK писал(а):на циске то СЕКРЕТ нигде не вводиться, только КЛЮЧ.

Еще как вводится (о чем можно, опять-таки, прочесть в документации производителя - см. Step 1), а также сама железка тебе это подсказывает:

Код: Выделить всё: AS5350(config)#radius-server key ? 0 Specifies an UNENCRYPTED key will follow

Вот эта строка поможет тебе авторизовать твою 5350 на радиусе:

Код: Выделить всё: radius-server key 0 radiuspassword

**TrEK** » 12 апр 2013, 21:11

Стыдно , признаюсь . :oops:

У меня просто не совпадал ключ...

Код: Выделить всё: rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=171, length=650 Acct-Session-Id = "0007A8C1" Calling-Station-Id = "520523" Called-Station-Id = "428030" h323-setup-time = "h323-setup-time=20:06:06.408 UA Fri Apr 12 2013" h323-gw-id = "h323-gw-id=TTAS5350.ternopiltele.com" h323-conf-id = "h323-conf-id=7AED5874 A2D211E2 BF20EE85 4F603D40" h323-call-origin = "h323-call-origin=originate" h323-call-type = "h323-call-type=Telephony" Cisco-AVPair = "h323-incoming-conf-id=7AED5874 A2D211E2 BF20EE85 4F603D40" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:428030" Cisco-AVPair = "dsp-id=1/9:1" Cisco-AVPair = "feature-vsa=fn:TWC,ft:04/12/2013 20:06:06.394,cgn:520523,cdn:428030,frs:0,fid:196918,fcid:7AED5874A2D211E2BF20EE854F603D40,legID:316BC" User-Name = "520523" Cisco-AVPair = "connect-progress=Call Up" Acct-Status-Type = Start NAS-Port-Type = Async NAS-Port = 0 NAS-Port-Id = "ISDN 3/1:D:21" Service-Type = Login-User NAS-IP-Address = 192.168.180.9 Acct-Delay-Time = 80 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.180.9,NAS-IP-Address = 192.168.180.9,Acct-Session-Id = "0007A8C1",User-Name = "520523"' [acct_unique] Acct-Unique-Session-ID = "9d7619891184f739". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] expand: %t -> Fri Apr 12 21:07:26 2013 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> 520523 ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> 520523 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 171 to 192.168.180.9 port 1646 Finished request 65. Cleaning up request 65 ID 171 with timestamp +846 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=172, length=741 Acct-Session-Id = "0007A8C2" Calling-Station-Id = "521312" Called-Station-Id = "499162" Cisco-AVPair = "call-id=0078-0768-BD6A2457-00000063@C4C8005285635E22D" Cisco-AVPair = "iphop=count:1" Cisco-AVPair = "iphop=hop1:192.168.170.205" h323-setup-time = "h323-setup-time=20:06:06.722 UA Fri Apr 12 2013" h323-gw-id = "h323-gw-id=TTAS5350.ternopiltele.com" h323-conf-id = "h323-conf-id=7B2138E0 A2D211E2 BF24EE85 4F603D40" h323-call-origin = "h323-call-origin=answer" h323-call-type = "h323-call-type=VoIP" Cisco-AVPair = "h323-incoming-conf-id=7B2138E0 A2D211E2 BF24EE85 4F603D40" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:499162" Cisco-AVPair = "feature-vsa=fn:TWC,ft:04/12/2013 20:06:06.722,cgn:521312,cdn:499162,frs:0,fid:196919,fcid:7B2138E0A2D211E2BF24EE854F603D40,legID:316BD" User-Name = "521312" Cisco-AVPair = "connect-progress=Call Up" Acct-Status-Type = Start Service-Type = Login-User NAS-IP-Address = 192.168.180.9 Acct-Delay-Time = 82 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',Client-IP-Address = 192.168.180.9,NAS-IP-Address = 192.168.180.9,Acct-Session-Id = "0007A8C2",User-Name = "521312"' [acct_unique] Acct-Unique-Session-ID = "309043e20d9b43ca". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] expand: %t -> Fri Apr 12 21:07:29 2013 ++[detail] returns ok ++[unix] returns noop [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> 521312 rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[radutmp] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 521312 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 172 to 192.168.180.9 port 1646 Finished request 66. Cleaning up request 66 ID 172 with timestamp +849 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=178, length=183 Acct-Session-Id = "0007A802" User-Name = "trek" Acct-Authentic = Local Acct-Terminate-Cause = Idle-Timeout Cisco-AVPair = "disc-cause-ext=Session Timeout" Cisco-AVPair = "connect-progress=Call Up" Acct-Session-Time = 2683 Acct-Status-Type = Stop NAS-Port = 2 NAS-Port-Id = "tty2" NAS-Port-Type = Virtual Calling-Station-Id = "xxx.yyy.190.165" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.180.9 Acct-Delay-Time = 79 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address = 192.168.180.9,NAS-IP-Address = 192.168.180.9,Acct-Session-Id = "0007A802",User-Name = "trek"' [acct_unique] Acct-Unique-Session-ID = "d71d03e3acb4e828". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] expand: %t -> Fri Apr 12 21:07:48 2013 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> trek rlm_radutmp: Logout for NAS as5350 port 2, but no Login record ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> trek attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 178 to 192.168.180.9 port 1646 Finished request 67. Cleaning up request 67 ID 178 with timestamp +868 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=181, length=1076 Acct-Session-Id = "0007A8BF" Calling-Station-Id = "520523" Called-Station-Id = "428030" Cisco-AVPair = "call-id=0078-0065-26916107-00000063@3A3ECFB357E52C929" Cisco-AVPair = "iphop=count:1" Cisco-AVPair = "iphop=hop1:192.168.170.213" h323-setup-time = "h323-setup-time=20:06:06.382 UA Fri Apr 12 2013" h323-gw-id = "h323-gw-id=TTAS5350.ternopiltele.com" h323-conf-id = "h323-conf-id=7AED5874 A2D211E2 BF20EE85 4F603D40" h323-call-origin = "h323-call-origin=answer" h323-call-type = "h323-call-type=VoIP" Cisco-AVPair = "h323-incoming-conf-id=7AED5874 A2D211E2 BF20EE85 4F603D40" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:428030" Cisco-AVPair = "feature-vsa=fn:TWC,ft:04/12/2013 20:06:06.382,cgn:520523,cdn:428030,frs:0,fid:196917,fcid:7AED5874A2D211E2BF20EE854F603D40,legID:316BB" h323-connect-time = "h323-connect-time=20:06:23.914 UA Fri Apr 12 2013" Acct-Input-Octets = 224640 Acct-Output-Octets = 1609 Acct-Input-Packets = 702 Acct-Output-Packets = 19 Acct-Session-Time = 11 h323-disconnect-time = "h323-disconnect-time=20:06:34.950 UA Fri Apr 12 2013" h323-disconnect-cause = "h323-disconnect-cause=10" h323-remote-address = "h323-remote-address=192.168.170.213" Cisco-AVPair = "release-source=2" h323-voice-quality = "h323-voice-quality=0" Cisco-AVPair = "remote-media-address=192.168.170.213" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:0,pi:0,si:0,#:520523" User-Name = "520523" Acct-Status-Type = Stop Service-Type = Login-User NAS-IP-Address = 192.168.180.9 Acct-Delay-Time = 78 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',Client-IP-Address = 192.168.180.9,NAS-IP-Address = 192.168.180.9,Acct-Session-Id = "0007A8BF",User-Name = "520523"' [acct_unique] Acct-Unique-Session-ID = "0d736615fd21a91d". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] expand: %t -> Fri Apr 12 21:07:53 2013 ++[detail] returns ok ++[unix] returns noop [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> 520523 rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[radutmp] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 520523 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 181 to 192.168.180.9 port 1646 Finished request 68. Cleaning up request 68 ID 181 with timestamp +873 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.180.9 port 1646, id=182, length=1114 Acct-Session-Id = "0007A8C1" Calling-Station-Id = "520523" Called-Station-Id = "428030" h323-setup-time = "h323-setup-time=20:06:06.408 UA Fri Apr 12 2013" h323-gw-id = "h323-gw-id=TTAS5350.ternopiltele.com" h323-conf-id = "h323-conf-id=7AED5874 A2D211E2 BF20EE85 4F603D40" h323-call-origin = "h323-call-origin=originate" h323-call-type = "h323-call-type=Telephony" Cisco-AVPair = "h323-incoming-conf-id=7AED5874 A2D211E2 BF20EE85 4F603D40" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:428030" Cisco-AVPair = "dsp-id=1/9:1" Cisco-AVPair = "feature-vsa=fn:TWC,ft:04/12/2013 20:06:06.394,cgn:520523,cdn:428030,frs:0,fid:196918,fcid:7AED5874A2D211E2BF20EE854F603D40,legID:316BC" h323-connect-time = "h323-connect-time=20:06:23.914 UA Fri Apr 12 2013" Acct-Input-Octets = 95210 Acct-Output-Octets = 224000 Acct-Input-Packets = 605 Acct-Output-Packets = 700 Acct-Session-Time = 11 h323-disconnect-time = "h323-disconnect-time=20:06:34.970 UA Fri Apr 12 2013" h323-disconnect-cause = "h323-disconnect-cause=10" Cisco-AVPair = "h323-ivr-out=Tariff:Unknown" Cisco-AVPair = "release-source=2" h323-voice-quality = "h323-voice-quality=0" Cisco-AVPair = "alert-timepoint=20:06:06.810 UA Fri Apr 12 2013" Cisco-AVPair = "dsp-id=1/9:1" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:0,pi:0,si:0,#:520523" Cisco-AVPair = "gw-final-xlated-cdn=ton:0,npi:0,#:428030" Cisco-AVPair = "gw-final-xlated-cgn=ton:0,npi:0,pi:0,si:0,#:520523" User-Name = "520523" Acct-Status-Type = Stop NAS-Port-Type = Async NAS-Port = 0 NAS-Port-Id = "ISDN 3/1:D:21" Service-Type = Login-User NAS-IP-Address = 192.168.180.9 Acct-Delay-Time = 80 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.180.9,NAS-IP-Address = 192.168.180.9,Acct-Session-Id = "0007A8C1",User-Name = "520523"' [acct_unique] Acct-Unique-Session-ID = "9d7619891184f739". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.180.9/detail-20130412 [detail] expand: %t -> Fri Apr 12 21:07:52 2013 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> 520523 ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> 520523 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 182 to 192.168.180.9 port 1646 Finished request 69. Cleaning up request 69 ID 182 with timestamp +875 Going to the next request Ready to process requests.

Теперь разбираюсь , почему в БД не пишет логи звонков....

Subnets.ru

as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Re: as5350 + radius c БД

Кто сейчас на конференции