Radius Extra Sessions when OSPF Kicks In

RouterOS General
1

Hi, we have this problem when OSPF kicks in:

Subscription Analysis for user@isp
2010-01-17 up to 2010-01-25
#	logged in	session time	upload	download	server	terminate cause	callerid
1	2010-01-23 22:07:31	15 hours	 6.9 MB	 83.6 MB	192.168.199.254:513	-	00:0B:6B:DB:A9:96
2	2010-01-22 22:07:30	18 hours	 16.2 MB	451.1 MB	192.168.208.1:434	-	00:0B:6B:DB:A9:96
3	2010-01-22 22:07:29	1 days	 27.0 MB	 0.6 GB	192.168.199.254:434	Session-Timeout	00:0B:6B:DB:A9:96
4	2010-01-21 22:07:27	1 days	 4.7 MB	 65.0 MB	192.168.199.254:386	Session-Timeout	00:0B:6B:DB:A9:96
5	2010-01-20 22:07:25	1 days	 2.9 MB	 45.7 MB	192.168.199.254:331	Session-Timeout	00:0B:6B:DB:A9:96
6	2010-01-19 22:07:23	2 hours	171.3 KB	 1.4 MB	192.168.208.1:290	-	00:0B:6B:DB:A9:96
7	2010-01-19 22:07:23	1 days	 2.9 MB	 24.5 MB	192.168.199.254:290	Session-Timeout	00:0B:6B:DB:A9:96
8	2010-01-18 22:07:20	1 days, 1 seconds	 3.8 MB	 66.2 MB	192.168.199.254:207	Session-Timeout	00:0B:6B:DB:A9:96
9	2010-01-17 22:07:15	1 days	 1.5 MB	 10.0 MB	192.168.199.254:166	Session-Timeout	00:0B:6B:DB:A9:96
10	2010-01-17 22:07:15	0 seconds	 0.0 KB	 0.0 KB	192.168.208.1:166	-	00:0B:6B:DB:A9:96

As you will see from the above output when our OSPF kicks in we get duplicate sessions in our Radius.

192.168.199.254 is one high site and 192.168.208.1 is the other high site.

Can anyone help?

2

You mean the session-timeout is working incorrectly? What I see there is 192.168.199.254 connected for 1 day, then session-timeout. Then another day, then session-timeout. Then another day, then session-timeout…
I see multiple sessions, but I see no duplicate sessions. Is there something I am missing?

ADD: The “caller id” is the same on both ips. So this is the same customer then, correct? It appears is starts another session through the other route when the session-timeout occurs on the first (shortest?) route.

3

Thank you for your reply.

Yes indeed there is a ‘Session-Timeout’ in the radgroupreply table of 86400 (24 hours).
This is exactly the same client as you can see from the MAC address.

You are correct my description was not apt I should have said “extra session data”. The bottom line is one client cannot be connected on 2010-01-22 for 18 hours AND on on the same day for ‘1 days’. The reason why this happened is on that day we had a link failure and the OSPF connected another route screwing with the Radius usage data.

It appears is starts another session through the other route when the session-timeout occurs on the first (shortest?) route.

Your observation is correct. That is what I need to fix.

Someone suggested I get another Radius server instead of FreeRADIUS that can ‘merge’ these kinds of sessions but I would prefer to have this sorted out.

Edit: I changed the topic from “Duplicate Sessions” to “Extra Sessions” to better describe the problem.

4

I kinda see what you are talking about, but I am not certain how the router on the short route is supposed to close the radius session with the route down. That is why the ospf kicked in and selected the other route, correct?

5

Yes I guess when the route goes down the Radius session is not closed. But I would like to have it closed because it’s leading to lots of accounting issues.

6

One way to resovle things like this on the FreeRadius side, is to use customized queries for the Accounting Update SQL… The standard queries is very limited in terms of what can / cannot be achieved. Using scripts (rlm_python, rlm_perl) can also easily be used to manipulate accounting data prior to it being sent off to a proxy server, and/or mysql database.

Things coming to mind at the database side is to use UNIQUE contraints on the accounting table, and using for example, ‘INSERT INTO ${acct_table1} … ON DUPLICATE KEY UPDATE ${acct_table1} SET …’, instead of the default UPDATE query supplied by FreeRadius…

FYI: http://dev.mysql.com/doc/refman/5.0/en/insert-on-duplicate.html

Customizing check_rad and using user_collision + session limits is also another fine way to circumvent things like this, as FR will validate whether the user is connected as per the ‘previous’ accounting entry, and if it finds the user is not connected, it will close the previous accounting session prior to opening a new one… With a bit of modification to checkrad, this should also be very, very simple to implement by connecting to the NAS and parsing the wireless registration tables to validate the connection…

7

What solution did you use. I seem to be sitting with the same problem.