Subject: (radius) Accounting-On and Accounting -Off

From: "Peter Helfer (LMC)" <[email-masked]>
Date: Fri, 28 Jan 2000 09:09:57 -0500

Does anyone know how an NAS is supposed to use Accounting-On 
and Accounting-Off? 

- If these messages are used to inform servers about an NAS booting,
  how does the information get distributed to all RADIUS servers 
  that may need to know, including servers that the NAS only
  communicates with via proxy?

- Should the NAS send these messages to all known servers/proxies?

- What User-Name should be used? Some-random-name@realm for 
  every realm where the NAS believes there may be a server that
  is interested in the NAS going down/coming up? (Even so, in 
  order to reach those servers, wouldn't the NAS need to know 
  about all proxying routes in the network?)

- What are suitable values to use for the Session-Id attribute?

What do actual real-life NASs do?

I am trying to understand whether a RADIUS server could use 
Accounting-On/Off for determining that accounting-sessions have 
been terminated, especially where active sessions are used to 
enforce concurrent session limits. If not, I'd be interested to 
learn about any other techniques that can be used for this purpose.

Peter Helfer

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "David Mitton" <[email-masked]>
Date: Fri, 28 Jan 2000 11:46:17 -0500

>   communicates with via proxy?

That would depend on how the NAS knows about any or all of the RADIUS 
servers it normally communicates with.  Since configuration parameters are 
not specified in the RFC, then it is implementation specific.

>- Should the NAS send these messages to all known servers/proxies?

I would think that it would send it only to the servers it is actively 
going to send accounting messages to.  What would a backup system think if 
it received an Accounting-On but not the active stream of event 
messages?  Wouldn't that be incorrect?

Of course, a NAS does not know anything about proxy forwarding.
That would have to be a policy of the proxy forwarder.  And clearly, just 
because a proxy forwarder knows of many servers, it probably doesn't want 
to send a copy to all of them.  In an outsourcing situation, I would not 
want my company to keep track of each ISP's NASes booting up.  I would 
expect most proxies would log the message locally, but that would be up to 
the proxy administrator.

>   about all proxying routes in the network?)

Most implementations don't use any name.  The attribute would not be 
present.  This is a box event, not a user or port issue.

Again, most NASes don't know what realms may come through.  This is what 
the server's realm db is for.

>- What are suitable values to use for the Session-Id attribute?

Some send the next Session-Id in their current sequence or nothing.

>What do actual real-life NASs do?

Our implementation originally sent an Acct-On message upon starting a 
conversation with a server, and a Acct-Off message when failing over or 
soft shutdown.  That became a problem with customers that used backup proxy 
servers that forwarded to coordinated set of stateful RADIUS 
servers.   Because a new Acct-On to the secondary RADIUS proxy would hit 
the central server and make it think that all current active sessions on 
that NAS had been dropped.   We removed that "feature" and now only send 
Acct-On messages at boot time to the primary server.  We created our own 
Acct-Restart, Acct-Shutdown event messages for server stream changes.

We do not fabricate a user name.  I think our latest version sends a 
session number of 0 or 1 for the Acct-On.

>learn about any other techniques that can be used for this purpose.

You will need to work out other ways to use more than this information, as 
the typical reason for server state change is that it failed or the network 
became disconnected, in which case the Acct-Off will not be generated or 
received.

>'unsubscribe ietf-radius' in the body of the message.

---------------------------------------------------------------
David Mitton                                  ESN: 248-4570
Consulting Engineer, Nortel Networks           978-288-4570 Direct
Carrier Packet Solutions, Preside              978-288-3030 FAX
Billerica, MA 01821                     [email-masked]

-