LINUX.ORG.RU

Сообщения Knyage

 

Freeradius+unifi точки проблема с авторизацией

Форум — Admin

Всем день добрый!

Вы моя последняя надежда:) Бьюсь уже недели две с проблемой. Инфраструктура : Имеется unifi WiFi точки, настроена сеть, с авторизацией на сервере radius. DHCP получает от palo alto. Сервер radius настроен на centos, для логинов использую файлик users, никаких особо настроек не проводилось. Настраивал по схеме https://computingforgeeks.com/installing-freeradius-and-daloradius-centos-7/ (кроме вебморды, ее не подключал).

Проблема в следующем : абсолютно рендомно, пользователи перестают получать IP при подключении к WiFi сети. В течение дня возникает от 1-2 до 10-ти случаев, и помогает иногда рестарт радиус сервера. В логах выдается подобное : 

rad_recv: Accounting-Request packet from host 192.168.115.24 port 32942, id=184, length=171
        Acct-Session-Id = "5B026EAE-0000000D"
        Acct-Status-Type = Start
        Acct-Authentic = RADIUS
        User-Name = "testuser"
        NAS-IP-Address = 192.168.115.24
        Framed-IP-Address = 0.0.0.0
        NAS-Identifier = "f09fc2d648e3"
        NAS-Port = 0
        Called-Station-Id = "02-9F-C2-D8-48-E3:WiFiRadius"
        Calling-Station-Id = "50-8F-4C-4A-55-5E"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11b"
# Executing section preacct from file /etc/radius/sites-enabled/default
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.115.24,NAS-IP-Address = 192.168.115.24,Acct-Session-Id = "5B026EAE-0000000D",User-Name = "testuser"'
[acct_unique] Acct-Unique-Session-ID = "f4f21dc2670e15c2".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "testuser", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
# Executing section accounting from file /etc/radius/sites-enabled/default
+- entering group accounting {...}
[detail]        expand: %{Packet-Src-IP-Address} -> 192.168.115.24
[detail]        expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.115.24/detail-20180522
[detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.115.24/detail-20180522
[detail]        expand: %t -> Tue May 22 09:41:17 2018
++[detail] returns ok
[log_accounting]        expand: %{Acct-Status-Type} -> Start
[log_accounting]        expand: Accounting-Request.%{%{Acct-Status-Type}:-unknown} -> Accounting-Request.Start
[log_accounting]        expand: /var/log/radius/linelog-accounting.log -> /var/log/radius/linelog-accounting.log
[log_accounting]        expand: Successfull Connect: User=%{User-Name} IP=%{Framed-IP-Address} did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} -> Successfull Connect: User=testuser IP=0.0.0.
0 did 02-9F-C2-D8-48-E3:WiFiRadius cli 50-8F-4C-4A-55-5E port 0
++[log_accounting] returns ok
++[unix] returns ok
[radutmp]       expand: /var/log/radius/radutmp -> /var/log/radius/radutmp
[radutmp]       expand: %{User-Name} -> testuser
++[radutmp] returns ok
++[exec] returns noop
[attr_filter.accounting_response]       expand: %{User-Name} -> testuser
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated


rad_recv: Accounting-Request packet from host 192.168.115.24 port 32942, id=186, length=171
        Acct-Session-Id = "5B026EAE-0000000E"
        Acct-Status-Type = Start
        Acct-Authentic = RADIUS
        User-Name = "testuser"
        NAS-IP-Address = 192.168.115.24
        Framed-IP-Address = 0.0.0.0
        NAS-Identifier = "f09fc2d648e3"
        NAS-Port = 0
        Called-Station-Id = "02-9F-C2-D8-48-E3:WiFiRadius"
        Calling-Station-Id = "50-8F-4C-4A-55-5E"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11b"
# Executing section preacct from file /etc/radius/sites-enabled/default
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.115.24,NAS-IP-Address = 192.168.115.24,Acct-Session-Id = "5B026EAE-0000000E",User-Name = "testuser"'
[acct_unique] Acct-Unique-Session-ID = "a9508f88e7ff6f95".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "testuser", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
# Executing section accounting from file /etc/radius/sites-enabled/default
+- entering group accounting {...}
[detail]        expand: %{Packet-Src-IP-Address} -> 192.168.115.24
[detail]        expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.115.24/detail-20180522
[detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.115.24/detail-20180522
[detail]        expand: %t -> Tue May 22 09:41:55 2018
++[detail] returns ok
[log_accounting]        expand: %{Acct-Status-Type} -> Start
[log_accounting]        expand: Accounting-Request.%{%{Acct-Status-Type}:-unknown} -> Accounting-Request.Start
[log_accounting]        expand: /var/log/radius/linelog-accounting.log -> /var/log/radius/linelog-accounting.log
[log_accounting]        expand: Successfull Connect: User=%{User-Name} IP=%{Framed-IP-Address} did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} -> Successfull Connect: User=testuser IP=0.0.0.0 did 02-9F-C2-D8-48-E3:WiFiRadius cli 50-8F-4C-4A-55-5E port 0
++[log_accounting] returns ok
++[unix] returns ok
[radutmp]       expand: /var/log/radius/radutmp -> /var/log/radius/radutmp
[radutmp]       expand: %{User-Name} -> testuser
++[radutmp] returns ok
++[exec] returns noop
[attr_filter.accounting_response]       expand: %{User-Name} -> testuser
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated
Sending Accounting-Response of id 186 to 192.168.115.24 port 32942
Finished request 12351.
Cleaning up request 12351 ID 186 with timestamp +74528
Going to the next request
Ready to process requests.
rad_recv: Accounting-Request packet from host 192.168.115.24 port 32942, id=187, length=213
        Acct-Session-Id = "5B026EAE-0000000E"
        Acct-Status-Type = Stop
        Acct-Authentic = RADIUS
        User-Name = "testuser"
        NAS-IP-Address = 192.168.115.24
        Framed-IP-Address = 0.0.0.0
        NAS-Identifier = "f09fc2d648e3"
        NAS-Port = 0
        Called-Station-Id = "02-9F-C2-D8-48-E3:WiFiRadius"
        Calling-Station-Id = "50-8F-4C-4A-55-5E"
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11b"
        Acct-Session-Time = 1
        Acct-Input-Packets = 13
        Acct-Output-Packets = 1
        Acct-Input-Octets = 1958
        Acct-Output-Octets = 135
        Event-Timestamp = "May 22 2018 09:41:55 MSK"
        Acct-Terminate-Cause = User-Request
# Executing section preacct from file /etc/radius/sites-enabled/default
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.115.24,NAS-IP-Address = 192.168.115.24,Acct-Session-Id = "5B026EAE-0000000E",User-Name = "testuser"'
[acct_unique] Acct-Unique-Session-ID = "a9508f88e7ff6f95".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "testuser", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
# Executing section accounting from file /etc/radius/sites-enabled/default
+- entering group accounting {...}
[detail]        expand: %{Packet-Src-IP-Address} -> 192.168.115.24
[detail]        expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.115.24/detail-20180522
[detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.115.24/detail-20180522
[detail]        expand: %t -> Tue May 22 09:41:56 2018
++[detail] returns ok
[log_accounting]        expand: %{Acct-Status-Type} -> Stop
[log_accounting]        expand: Accounting-Request.%{%{Acct-Status-Type}:-unknown} -> Accounting-Request.Stop
[log_accounting]        expand: /var/log/radius/linelog-accounting.log -> /var/log/radius/linelog-accounting.log
[log_accounting]        expand: Sucessfull Disconnect: User=%{User-Name} IP=%{Framed-IP-Address} did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} %{Acct-Session-Time} seconds -> Sucessfull Disconnect: User=testuser IP=0.0.0.0 did 02-9F-C2-D8-48-E3:WiFiRadius cli 50-8F-4C-4A-55-5E port 0 1 seconds
++[log_accounting] returns ok
++[unix] returns ok
[radutmp]       expand: /var/log/radius/radutmp -> /var/log/radius/radutmp
[radutmp]       expand: %{User-Name} -> testuser
++[radutmp] returns ok
++[exec] returns noop
[attr_filter.accounting_response]       expand: %{User-Name} -> testuser
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated
Sending Accounting-Response of id 187 to 192.168.115.24 port 32942
Finished request 12352.
Cleaning up request 12352 ID 187 with timestamp +74529
Going to the next request
Ready to process requests

Из логов мелькает IP=0.0.0.0 , но совсем не могу понять, откуда он и почему так происходит. dhcp выключено на сервере радиуса.

Подсобите, пожалуйста, куда смотреть, где копать? За 2 недели туда-сюда копания в голове уже полнейшая каша :(

 ,

Knyage
()
8 комментариев

RSS подписка на новые темы