Sending Disconnect-Request of id 37 to 192.168.2.1 port 1700
User-Name = "test"
rad_recv: Disconnect-NAK packet from host 192.168.2.1:1700, id=37, length=42
Error-Cause = Unsupported-Extension
NAS-Identifier = "MikroTik"
NAS-IP-Address = 192.168.2.1
Why I can’t disconnect user??
I read some forum that it MT OS 2.9.. support with the radius diconnect message. Why there is ‘Unsupported-Extension’, while I use /Radius → Incomming → Accept??
How can i do it?
Yes, i’m using HotSpot. I’ve tried to use port 1700 or 3799, but there is the same problem.
When i request to disconnect user ‘test’ once, the Status of Radius Incomming is:
can you “dump” (print the details of) request, which is sent from Free Radius to User Manager? Because NAK is sent also, when there is at least one attribute in the request, which is not supported by HotSpot. Such a behavior is defined in RFC5176 (http://www.ietf.org/rfc/rfc5176.txt).
Disconnect request works for a specific session, not for all the sessions of specified user.
You send only User-Name as session identification attribute. But it is not enough. To identify session correctly, these attributes must be included in Disconnect-Request:
*) IP address
*) NAS Port Type
*) NAS Port
*) Calling Station ID
*) Called Station ID
*) ACCT Session ID
*) NAS Port ID, if it is not empty
Required values for these attributes should be stored in the Radius Server data base. For example, User Manager stores these values for every session to be able to send Disconnect Request for it. In your case these values should be stored in FreeRadius data base.
Where:
192.168.2.1 is NAS Address
1700 is your CAO port or disconnect port that you have to enable in Mikrotik
Or you guys can use php code and you have to grant root permission to www user to run this script.
Note: This is very risk usage.
Example:
//function to force disconnect a user
function disconnect_user($username, $framed_ip, $nasaddr, $coaport, $sharedsecret) {
$command = "sudo echo User-Name=$username,Framed-IP=$framed_ip|/usr/local/bin/radclient -x $nasaddr:$coaport disconnect $sharedsecret";
exec($command);
}
//function to force disconnect all users
function disconnect_all_users(){
$sharedsecret = "yourradiussecret";
$coaport = 1700;
$nasaddr = "192.168.20.1";
$r_who_online = "SELECT * FROM radacct WHERE (AcctStopTime is NULL) ORDER BY RadAcctId ASC";
$who_online = $db->Execute($r_who_online);
foreach($who_online as $u) {
$command = "sudo echo User-Name=$u["UserName"],Framed-IP=$u["Framed-IP"]|/usr/local/bin/radclient -x $nasaddr:$coaport disconnect $sharedsecret";
exec($command);
}
}
I follow step in this thread, I can’t connect to NAS 192.168.10.2 with radclient, but I IP 192.168.10.1 can received remote request, with NAK result in radius debug mikrotik.
when radius server (192.168.10.14) request disconnect, I get radius debug unknown address and IP address request change to
radius debug received remote request from 192.168.10.1:xxxxxx with unknown address, dropping
it radius debug shouldn’t 192.168.10.1 but 192.168.10.14 to be accepted by NAS 192.168.10.2
is anybody can help me with this case? or any something miss in mikrotik configuration. Thanks
i’m using same code for disconnecting user but getting below error
array(16) {
[0]=>
string(60) “radclient: Failed to send packet for ID 168: (unknown error)”
[1]=>
string(60) “radclient: Failed to send packet for ID 168: (unknown error)”
[2]=>
string(60) “radclient: Failed to send packet for ID 168: (unknown error)”
[3]=>
string(54) “radclient: no response from server for ID 168 socket 3”
[4]=>
string(63) “Sending Disconnect-Request of id 168 to 192.168.1.240 port 1700”
[5]=>
string(32) " User-Name = “54:14:73:57:DC:C2"”
[6]=>
string(34) " Framed-IP-Address = 192.168.0.244"
[7]=>
string(42) “rad_send() failed: Operation not permitted”
[8]=>
string(63) “Sending Disconnect-Request of id 168 to 192.168.1.240 port 1700”
[9]=>
string(32) " User-Name = “54:14:73:57:DC:C2"”
[10]=>
string(34) " Framed-IP-Address = 192.168.0.244"
[11]=>
string(42) “rad_send() failed: Operation not permitted”
[12]=>
string(63) “Sending Disconnect-Request of id 168 to 192.168.1.240 port 1700”
[13]=>
string(32) " User-Name = “54:14:73:57:DC:C2"”
[14]=>
string(34) " Framed-IP-Address = 192.168.0.244"
[15]=>
string(42) “rad_send() failed: Operation not permitted”
}
