DHCP accounting and RADIUS packets

[skylaer]

Hi all!
We try to use Mikrotik as router and DHCP server.
Switches send DHCP packets to Mtik, Mtik make req to Radius server and receive
dhcp pool name, speed limits…
All work good, but small problem.. No accounting
And i don’t know IP address of user (from pool), traffic.
And don’t know when user stops use address

Maybe it’s possible:

1. Send Accounting-Start packet with IP address, when lease and queue created and up?
2. Send Accounting-Stop packet with traffic from queue (if created), when lease dropped?

Many people try to use Opt82 instead PPPxx, it’s may be a good solution.

[pospanko]

@skylaer

Hi all!
We try to use Mikrotik as router and DHCP server.
Switches send DHCP packets to Mtik, Mtik make req to Radius server and receive
dhcp pool name, speed limits…
All work good, but small problem.. No accounting
And i don’t know IP address of user (from pool), traffic.
And don’t know when user stops use address

Maybe it’s possible:

1. Send Accounting-Start packet with IP address, when lease and queue created and up?
2. Send Accounting-Stop packet with traffic from queue (if created), when lease dropped?

Many people try to use Opt82 instead PPPxx, it’s may be a good solution.

+1

[wildbill442]

+1 and Option 82 support.

[skylaer]

It’s really simple to develop - 1 packets send when created and 1 then dropped.
But better way - start, stop and keepalive together

[Chupaka]

@wildbill442

and Option 82 support.

it’s supported for many years already

[skylaer]

He talks about native support for DHCP OPT82 without radius.

[Chupaka]

@skylaer

He talks about native support for DHCP OPT82 without radius.

but this topic IS about RADIUS I think he should open a new topic (or better a support ticket?) about option82-based (not MAC-based, like now) leases

[skylaer]

Yes, you right.

After investigation we found a packet from Mikrotik “Accounting = On”.
Router send this packet sometimes, but packet not contains any interesting

[pospanko]

Normis, is there a chance to add radius accounting message in DHCP? thx

[lambert]

I just setup DHCP with RADIUS auth yesterday and thought I had done something wrong when I didn’t see accounting start packets. I was expecting a start packet on initial assignment and a stop packet when the lease expires. Perhaps an accounting update packet when the lease is renewed.

Also, I thought I would see an auth request every time the lease was renewed, but I haven’t seen any auth requests after the initial request unless I delete the dynamic lease on the mikrotik before the lease is renewed.

We need the accounting packets in an ISP setting to tell us who was using a particular IP 3 months ago without trawling through syslog server archives.

[Chupaka]

@lambert

Also, I thought I would see an auth request every time the lease was renewed, but I haven’t seen any auth requests after the initial request unless I delete the dynamic lease on the mikrotik before the lease is renewed.

it’s how it works: if you don’t set lease timeout in RADIUS Access-Accept, then the value from DHCP server settings is used, and no RADIUS Request is made for lease renewals; if you return timeout from RADIUS, then any renews of that lease will require RADIUS authorization - that’s what you’re looking for

[lambert]

@Chupaka

@lambert

Also, I thought I would see an auth request every time the lease was renewed, but I haven’t seen any auth requests after the initial request unless I delete the dynamic lease on the mikrotik before the lease is renewed.

it’s how it works: if you don’t set lease timeout in RADIUS Access-Accept, then the value from DHCP server settings is used, and no RADIUS Request is made for lease renewals; if you return timeout from RADIUS, then any renews of that lease will require RADIUS authorization - that’s what you’re looking for

Thank you, that is very helpful to know.

[dilnix]

@Chupaka

it’s how it works: if you don’t set lease timeout in RADIUS Access-Accept, then the value from DHCP server settings is used, and no RADIUS Request is made for lease renewals; if you return timeout from RADIUS, then any renews of that lease will require RADIUS authorization - that’s what you’re looking for

dear Chupaka, can you give me some example of how to configure RB DHCP Server to resend option82 data of DHCP request (received from some port L2 commutator) to freeRadius server connected directly to RB???
I’m trying to implement MAC-independent PORT-binded connection to every customer.
I mean, for example, any device with any MAC connected to port 1 of commutator will take from DHCP Server (RB) only one IP-address (192.168.0.1 for example), and no another. If the same device (or any) will connect to another port (for ex. 2) so it will take another IP (192.168.0.2 for ex.).
PLZ

[Chupaka]

@dilnix

can you give me some example of how to configure RB DHCP Server to resend option82 data of DHCP request (received from some port L2 commutator) to freeRadius server connected directly to RB???

as far as I can see, you just cannot disable it. if Option82 info exists in DHCP request, it will be sent to RADIUS

so just set ‘use-radius=yes’ on your dhcp server and then create radius for service=dhcp

[Begetan]

Turn on system->logging->topic dhcp and you will see in og file all information from DHCP request sending to radius. Mikrotik sends probably all information from dhcp request packets, but the correct way to dump and check.

[skylaer]

We know (c)

But the best way is DHCP-Radius packets for start, renew and expire lease.
It;s easy for development and i don’t know, why Mikrotik can’t do it.

[dilnix]

@Chupaka

as far as I can see, you just cannot disable it. if Option82 info exists in DHCP request, it will be sent to RADIUS
so just set ‘use-radius=yes’ on your dhcp server and then create radius for service=dhcp

Thanks, but what about freeRadius configuration? Do you have/know any examples?? or may be you know who can help me?

@skylaer

But the best way is DHCP-Radius packets for start, renew and expire lease.
It;s easy for development and i don’t know, why Mikrotik can’t do it.

Yes, why Mikrotik can’t do it still???

[lambert]

Has anyone come up with a way to get the radius accounting information without making users change how their equipment is setup by using mac-auth in the hotspot functionality?

It looks to me like it should be possible to enable hotspot on the customer facing interface and deal with their already DHCP assigned IP address without any login popups. I just don’t have any experience with hotspot at all and haven’t had time to experiment yet.

[alexcherry]

Any news about support of accounting for Radius DHCP ? We are using API for gathering information about DHCP radius sessions, but with Radius accounting it should be simpler and standartized.

[santa]

Yes, I believe there are many people interested in this topic. Any response would be pleased. “We plan to implement” or “We don’t plan to implement” would be sufficient .