Setting Up RADIUS Accounting

This chapter discusses how to set up RADIUS accounting. It consists of the following sections:

Before you begin

Overview of accounting configuration tasks

Setting up system-wide RADIUS accounting values

Setting up accounting on a per-user basis

Setting up accounting with dynamic IP addressing

Classifying user sessions in RADIUS

Using SNMP to specify the primary accounting server

Starting the RADIUS daemon with accounting enabled

Understanding accounting records

Before you begin

Overview of accounting configuration tasks

• Configure accounting in each RADIUS user profile. (For instructions, see Setting up accounting on a per-user basis.)

• Configure accounting with dynamic IP addressing. (For instructions, see Setting up accounting with dynamic IP addressing.)

• Gather information about user sessions. (For instructions, see Classifying user sessions in RADIUS.)

• Use the SNMP Set command to specify the primary accounting server. (For instructions, see Using SNMP to specify the primary accounting server.)

Setting up system-wide RADIUS accounting values

Performing required accounting configuration tasks

• System-wide accounting parameters

• Accounting port in /etc/services

• Accounting directory

1. In the External-Auth profile, set Acct-Type =RADIUS.

2. Open the Rad-Acct-Client subprofile.

3. For each Acct-Server parameter, specify the IP address of a RADIUS host.

4. For the Acct-Port parameter, enter the UDP port number you specified in
   /etc/services for the authentication process of the daemon. Or, if you used the incr keyword with the -A option when starting the daemon, add 1 to the number of the UDP port for authentication services, and enter the sum.

5. For the Acct-Key parameter, enter the RADIUS client password, exactly as it appears in the RADIUS clients file.

radacct      1646/udp      #radius-accounting

Specifying the accounting directory

Performing optional accounting configuration tasks

• Source for RADIUS accounting requests

• Timeout value

• Retry limit

• Session-report interval

• Numeric base for the session ID

• Reset time

• Whether the MAX TNT sends Accounting Stop packets when a connection fails authentication

• Whether the MAX TNT send Accounting Stop packets that do not contain a user name

When the MAX TNT runs at high capacity, RADIUS can run out of unique IDs. By default, when the server reaches its limit of 256 outstanding requests, no unique values are available for the next accounting request. To overcome this limitation, you can specify that each request be identified by the UDP source port as well as by the RADIUS ID value. To configure the MAX TNT to send the source UDP port number in RADIUS Request-Response matching, set Rad-ID-Source-Unique=Port-Unique in the External-Auth profile.

Specifying the source for RADIUS accounting requests

Specifying a timeout value

Specifying a retry limit

The MAX TNT always attempts at least one retry. For example, if you set the number of retries to 10, the MAX TNT makes 11 attempts: the original attempt plus 10 retries.

Specifying the interval for sending session reports

(For complete information about setting up the MAX TNT for session reports, see Classifying user sessions in RADIUS.)

Specifying the numeric base for the session ID

• Acct-Base-10 (decimal) specifies that the numeric base is 10. The default value is 10.

• Acct-Base-16 (hexadecimal) specifies that the numeric base is 16.

"1234567890"

"499602D2"

Specifying the reset time

Specifying whether to send Stop packets when authentication fails

Specifying whether to send Stop packets with no user name

Example of setting up system-wide RADIUS accounting

Figure 12-1. Sample network topology for setting up system-wide RADIUS accounting

In addition to the required parameters, the configuration also specifies that the MAX TNT must:

• Generate RADIUS accounting IDs based on source port number.

• Use UDP source port 500 for sending accounting requests.

• Increase the timeout value to 10 seconds.

• Increase the retry limit to 6.

admin> read external-auth

EXTERNAL-AUTH read

admin> list

auth-type=none

acct-type=none

rad-id-space=unified

rad-id-source-unique=system-unique

rad-serv-enable=no

rad-auth-client={ 0.0.0.0 0.0.0.0 0.0.0.0 0 0 "" no 0 no no no 0 yes +

rad-acct-client={ 0.0.0.0 0.0.0.0 0.0.0.0 0 0 "" 0 0 acct-base-10 0 +

rad-auth-server={ 0 no rad-serv-attr-any [ 0.0.0.0 0.0.0.0 0.0.0.0 +

tac-auth-client={ 0.0.0.0 0.0.0.0 0.0.0.0 0 0 "" 0 }

tacplus-auth-client={ 0.0.0.0 0.0.0.0 0.0.0.0 0 0 "" 0 0 }

tacplus-acct-client={ 0.0.0.0 0.0.0.0 0.0.0.0 0 0 "" }

local-profiles-first=lpf-yes

admin> set acct-type=radius

admin> set rad-id-source-unique=port-unique

admin> list rad-acct-client

acct-server-1=0.0.0.0

acct-server-2=0.0.0.0

acct-server-3=0.0.0.0

acct-port=0

acct-src-port=0

acct-key=""

acct-timeout=0

acct-sess-interval=0

acct-id-base=acct-base-10

acct-reset-time=0

acct-stop-only=yes

acct-limit-retry=0

acct-drop-stop-on-auth-fail=no

admin> set acct-server-1=10.1.2.1

admin> set acct-server-2=10.1.2.2

admin> set acct-server-3=10.1.2.3

admin> set acct-port=512

admin> set acct-src-port=500

admin> set acct-key=tntpass

admin> set acct-timeout=10

admin> set acct-limit-retry=6

admin> write external-auth

EXTERNAL-AUTH written

Setting up accounting on a per-user basis

• The server specified by the Acct-Server parameter in the External-Auth profile's Rad-Acct-Client subprofile. This server is known as the default server.

• The RADIUS accounting server specified by the Ascend-User-Acct-Host attribute in the RADIUS user profile.

Overview of per-user accounting attributes

Table 12-1. Per-user accounting attributes

Attribute	Description	Possible values
Ascend-User-Acct-Base (142)	Specifies whether the numeric base of the RADIUS Acct-Session-ID attribute is 10 or 16.	Ascend-User-Acct-Base-10 (0) Ascend-User-Acct-Base-16 (1) Ascend-User-Acct-Base-10 is the default.
Ascend-User-Acct-Host (139)	Specifies the IP address of the RADIUS server to use for the connection.	IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0.0.0.
Ascend-User-Acct-Key (141)	Specifies the RADIUS client password as it appears in the clients file.	Text string. The default value is null.
Ascend-User-Acct-Port (140)	Specifies a destination UDP port number for the connection.	The UDP port number you indicated for the authentication process of the daemon in /etc/services. Or, if you used the incr keyword with the -A argument when starting the daemon, the number of the UDP port for authentication services plus 1.
Ascend-User-Acct-Time (143)	Specifies the number of seconds the MAX TNT waits for a response to a RADIUS accounting request. If the MAX TNT does not receive a response within the time specified by Ascend-User-Acct-Time, it sends the accounting request to the next accounting server specified by the Acct-Server parameter on the MAX TNT, to the server specified by the Ascend-User-Acct-Host attribute in RADIUS, or both.	Integer from 1 to 10. The default value is 1.
Ascend-User-Acct-Type (138)	Specifies the RADIUS accounting server to use for the connection.	Ascend-User-Acct-None (0) specifies that the MAX TNT sends accounting information to the default server specified in the External-Auth profile's Rad-Acct-Client subprofile. Ascend-User-Acct-User (1) specifies that the MAX TNT sends accounting information to the RADIUS server specified by the Ascend-User-Acct-Host attribute in the RADIUS user profile. Ascend-User-Acct-User-Default (2) specifies that the MAX TNT sends accounting information both to the RADIUS server specified by the Ascend-User-Acct-Host attribute, and to the default server. Ascend-User-Acct-None is the default.

Specifying per-user accounting attributes

1. Set up the RADIUS user profile, as discussed in the preceding chapters.

2. Set the Ascend-User-Acct-Type attribute to specify the RADIUS accounting server for the connection.

3. Set the Ascend-User-Acct-Host attribute to the IP address of the RADIUS accounting server for the connection.

4. Set the Ascend-User-Acct-Port attribute to the UDP port number you specified for the authentication process in /etc/services. Or, if you used the incr keyword with the -A argument when starting the daemon, specify the sum of 1 plus the number of the UDP port for authentication services.

5. Set the Ascend-User-Acct-Key attribute to the value of the RADIUS client password, exactly as it appears in the RADIUS clients file.

6. Set the Ascend-User-Acct-Base attribute to specify whether the numeric base of the RADIUS Acct-Session-ID attribute is 10 or 16 (optional).

7. Set the Ascend-User-Acct-Time attribute to the number of seconds the MAX TNT waits for a response to a RADIUS accounting request (optional).

   If Ascend-User-Acct-Type is set to Ascend-User-Acct-User-Default, the MAX TNT sends two different packets: one to the server specified in the user profile, and one to the default server.

Figure 12-2. Sample network topology for setting up accounting on a per-user basis

To set up per-user accounting for the user Emma, you would configure her user profile as follows:

Emma Password="m2dan", User-Service=Framed-User

     Framed-Protocol=PPP,

     Framed-Address=200.250.55.9,

     Ascend-Link-Compression=Link-Comp-Stac,

     Framed-Compression=Van-Jacobson-TCP-IP,

     Ascend-Route-IP=Route-IP-Yes,

     Ascend-Metric=2,

     Ascend-User-Acct-Type=Ascend-User-Acct-User,

     Ascend-User-Acct-Host=200.250.56.10,

     Ascend-User-Acct-Port=1645,

     Ascend-User-Acct-Key="mypassword"

Setting up accounting with dynamic IP addressing

When Auth-Pool=Yes, the MAX TNT includes the caller's assigned IP address as the value of the Framed-Address attribute. The MAX TNT allocates this address from pool #1. (If you do not define pool #1, the call does not have an IP address during authentication.) Because an IP assignment is not usually part of an Access-Request, you must modify the RADIUS daemon. The assigned IP address might not last the duration of the connection, or it might not be meaningful. Here are five possibilities:

• If Assign-Address=No in the IP-Answer subprofile of the Answer-Defaults profile, and the caller's RADIUS user profile does not supply an IP address for the caller, the MAX TNT returns the IP address to pool #1. However, the address continues to appear in RADIUS accounting entries.

• If Assign-Address=No and the caller's RADIUS user profile supplies an IP address for the caller, the MAX TNT returns the IP address to pool #1. The IP address from the user profile appears in RADIUS accounting entries.

• If Assign-Address=Yes, and Ascend-Assign-IP-Pool in the RADIUS user profile points to a pool that has no valid IP address, the IP address from pool #1 appears in accounting entries. The MAX TNT returns the address to the pool when the call disconnects.

• If Assign-Address=Yes and Must-Accept-Address-Assign=Yes on the MAX TNT, and Ascend-Assign-IP-Pool points to a pool that has a valid IP address, the IP address from that pool appears in RADIUS accounting entries for the duration of the call. The MAX TNT returns the address to the pool when the call disconnects.

• If Assign-Address=Yes, Must-Accept-Address-Assign=No, Ascend-Assign-IP-Pool points to a pool that has a valid IP address, and the caller does not specify an address, the IP address from the pool appears in RADIUS accounting entries. If the caller does specify an IP address, that address appears in RADIUS accounting entries.

Classifying user sessions in RADIUS

Using the Class attribute

Using the Ascend-Number-Sessions attribute

Generating periodic accounting requests

Only RADIUS daemons you customize to recognize packet code 33 respond to Ascend-Access-Event-Request packets from the MAX TNT. Other accounting daemons ignore it. When modifying the daemon, make sure that it recognizes an Ascend-Access-Event-Request packet in the following format:

Code (8-bit)=33
Identifier (8-bit)
Length (16-bit)
Authenticator (48-bit for an accounting server, 64-bit for an authentication server)
List of attributes

Example of classifying user sessions

Using SNMP to specify the primary accounting server

Every time you reset the server with the Set command, the MAX TNT generates an SNMP trap. The MAX TNT also generates a trap if it changes to the next server because the current server fails to respond. The trap is an Enterprise Specific Trap (18) and specifies the Object ID and IP address for the new server. The Object ID for the accounting server is 1.3.6.1.4.1.529.13.4.1.6.x, where x is the index of the current server (1-3).

The following MIB objects support changing the current RADIUS accounting server:

radAcctHostIPAddress OBJECT-TYPE

	SYNTAX		 IpAddress

	ACCESS		 read-only

	STATUS		 mandatory

	DESCRIPTION	 "The IP address of the Accounting server. The 

			 value 0.0.0.0 is returned if entry is invalid."

	::= { radiusAcctStatsEntry 6 }

radAcctCurrentServerFlag OBJECT-TYPE

	SYNTAX		      INTEGER {

			         invalid(1),

			         current(2)

			     }

	ACCESS		      read-write

	STATUS		      mandatory

	DESCRIPTION	 "Value indicates whether this entry is the

					current accounting server or not. Writing any

					value will cause the current server to be reset

					to the primary server (Host #1)."

	::= { radiusAcctStatsEntry 7 }

Starting the RADIUS daemon with accounting enabled

When using a flat ASCII file

radiusd -A services | incr

If you specify the incr argument, the daemon creates the accounting process with the UDP port specified as the accounting port in the /etc/services file. If you have not defined the port, the daemon increments the UDP port specified for radiusd and uses that port number. This action is the default if you do not specify the -A argument.

When using a UNIX DBM database

radiusd.dbm -A services

Understanding accounting records

• What kind of information appears in accounting records

• Where accounting records are stored

• What kinds of packets RADIUS accounting uses

• Which attributes appear in each type of packet

• Start session. Denotes the beginning of a session with the MAX TNT. Information about this event appears in an accounting Start record.

• Stop session. Denotes the end of a session with the MAX TNT. Information about this event appears in an accounting Stop record.

• Failure-to-start session. Denotes that a login attempt has failed. Information about this event appears in an accounting Failure-to-start record.

You can use RADIUS accounting to:

• Gather billing information, including who called, how long the session lasted, and how much traffic occurred during the session.

• Troubleshoot RADIUS and MAX TNT operations. Accounting records can contain information about how many login failures occurred, and can describe the characteristics of the failed attempts.

usr/adm/radacct/host/detail

What kinds of packets does RADIUS accounting use?

Accounting Start packets

The MAX TNT does not send an Accounting Start packet if a call fails authentication or otherwise fails to log in. In some cases, a session begins with a user login and then authentication follows, such as when a terminal-server user chooses PPP or SLIP after login. If User-Service=Login-User, or if User-Service is unspecified, the MAX TNT sends an Accounting Start packet after login. Information from an Accounting Start packet appears in a Start record in the log file.

Accounting Stop packets

Non-accounting attributes in Start and Stop records

Table 12-2. Non-accounting attributes in Start and Stop records

Attribute	Description
Ascend-Dial-Number (227)	Indicates the phone number of the device that originated the connection.
Ascend-Home-Agent-UDP-Port (186)-Stop records only	Indicates the UDP port number to use when the foreign agent sends ATMP packets to the home agent.
Ascend-Home-Network-Name (185)-Stop records, Gateway mode only	Indicates the name of the Connection profile through which the home agent sends all packets it receives from the mobile client during ATMP operation.
Caller-Id (31)	Indicates the calling-party number, which is the phone number of the user that has connected to the unit.
Class (25)	Enables access providers to classify their user sessions. The default value for the Class attribute is null.
Client-Port-DNIS (30)	Indicates the called-party number, which is the phone number the user dials to connect to the MAX TNT.
Framed-Address (8)	Indicates the IP address of the user starting the session. The default value is 0.0.0.0.
Framed-Protocol (7)	Indicates the kind of protocol the connection uses. By default, the MAX TNT does not restrict the type of protocol a user can access.
NAS-Identifier (4)	Indicates the IP address of the MAX TNT. This attribute does not appear in an Accounting-Stop packet for a Failure-start-session event.
NAS-Port (5)	Indicates the port on which the MAX TNT received the call. NAS-Port does not appear in an Accounting-Stop packet for a Failure-start-session event.
NAS-Port-Type (61)	Specifies the type of service in use for the established session: NAS_Port_Type_Async (0) indicates a call the MAX TNT routes to a digital modem. NAS_Port_Type_Sync (1) indicates a synchronous ISDN connection.
User-Name (1)	Indicates the name of the user starting the session.

Accounting attributes in Start records

Table 12-3. Accounting-specific attributes in Start records

Attribute	Description
Acct-Authentic (45)	Indicates the method the MAX TNT used to authenticate an incoming call: RADIUS (1) indicates that RADIUS authenticated the incoming call. Local (2) indicates that the MAX TNT used a local Connection profile, TACACS profile, or TACACS+ profile, or that the MAX TNT accepted the call without authentication.
Acct-Delay-Time (41)	Indicates the number of seconds the MAX TNT has been trying to send the Accounting packet. In an Accounting Start packet, this value is 0 (zero).
Acct-Session-Id (44)	Consists of a unique numeric string identified with the routing or terminal-server session reported in the Accounting packet. The string is a random number. RADIUS correlates the Accounting Start packet and Accounting Stop packet with Acct-Session-Id. Its value can range from 1 to 2,137,383,647.
Acct-Status-Type (40)	Requests that have Acct-Status-Type=Start are Accounting Start packets. The information in these packets appears in Start records. Requests that have Acct-Status-Type=Stop are Accounting Stop packets. The information in these packets appears in Stop or Failure-to-start records.
Ascend-Session-Svr-Key (151)	Identifies the user session in which a client sends a disconnect or filter-change request to the RADIUS server.
Ascend-User-Acct-Base (142)	Indicates whether the numeric base of the RADIUS Acct-Session-ID attribute is 10 or 16.
Ascend-User-Acct-Host (139)	Indicates the IP address of the RADIUS server to use for the link.
Ascend-User-Acct-Key (141)	Indicates the RADIUS client password as it appears in the clients file.
Ascend-User-Acct-Port (140)	Indicates a destination UDP port number for the connection.
Ascend-User-Acct-Time (143)	Indicates the number of seconds the MAX TNT waits for a response to a RADIUS accounting request.
Ascend-User-Acct-Type (138)	Indicates the RADIUS accounting server(s) to use for the connection.

Accounting attributes in Stop records

Table 12-4. Accounting-specific attributes in Stop records

Attribute	Description	Conditions for inclusion
Acct-Authentic (45)	Indicates the method the MAX TNT used to authenticate an incoming call: RADIUS (1) indicates that RADIUS authenticated the incoming call. Local (2) indicates that the MAX TNT used a local Connection profile, TACACS profile, or TACACS+ profile, or that the MAX TNT accepted the call without authentication.	Session must be authenticated.
Acct-Delay-Time (41)	Indicates the number of seconds between the time an event occurred and the time the MAX TNT sent the packet. If RADIUS does not acknowledge the packet, the MAX TNT resends it. The value of Acct-Delay-Time changes to reflect the proper event time.	None.
Acct-Input-Octets (42)	Indicates the number of octets the MAX TNT received during the session. The value reflects only the data delivered by PPP or other encapsulation. It does not include the header or other protocol-dependent components of the packet.	Session must be authenticated. An asynchronous connection must be in use. That is, the data must be unframed.
Acct-Input-Packets (47)	Indicates the number of packets the MAX TNT received during the session. The packets are counted before the encapsulation is removed. The attribute's value does not include maintenance packets, such as keepalive or management packets.	Session must be authenticated. A framed protocol must be in use.
Acct-Output-Octets (43)	Indicates the number of octets the MAX TNT sent during the session. The value reflects only the data delivered by PPP or other encapsulation. It does not include the header or other protocol-dependent components of the packet.	Session must be authenticated. An asynchronous connection must be in use. That is, the data must be unframed.
Acct-Output-Packets (48)	Indicates the number of packets the MAX TNT sent during the session. The packets are counted before the encapsulation is removed. The attribute's value does not include maintenance packets, such as keepalive or management packets.	Session must be authenticated. A framed protocol must be in use.
Acct-Session-Id (44)	Consists of a unique numeric string identified with the routing or terminal-server session reported in the Accounting packet. The string is a random number of up to seven digits. RADIUS correlates the Accounting Start packet and Accounting Stop packet with Acct-Session-Id. Its value can range from 1 to 2,137,383,647.	None.
Acct-Session-Time (46)	Indicates the number of seconds the session has been logged in.	Session must be authenticated.
Acct-Status-Type (40)	Requests that have Acct-Status-Type set to Start are Accounting Start packets. The information in these packets appears in Start records. Requests that have Acct-Status-Type set to Stop are Accounting Stop packets. The information in these packets appears in Stop or Failure-to-start records.	None.
Ascend-Connect-Progress (196)	Indicates the state of the connection before it disconnects.	None.
Ascend-Data-Rate (197)	Indicates the rate of data received on the connection in bits per second.	None.
Ascend-Disconnect-Cause (195)	Indicates the reason a connection was taken offline.	None.
Ascend-Event-Type (150)	Indicates a cold-start notification, informing the accounting server that the MAX TNT has started up.	For a cold-start notification, the MAX TNT sends values for NAS-Identifier and Ascend-Event-Type in an Ascend-Access-Event-Request packet (code 33). The RADIUS accounting server must send back an Ascend-Access-Event-Response packet (code 34), with the correct identifier, to the MAX TNT.
Ascend-First-Dest (189)	Records the destination IP address of the first packet the MAX TNT received on a connection after authentication.	Session must be authenticated.
Ascend-Home-Agent-IP-Addr (183)	Indicates the IP address of the home agent associated with the mobile client.	Session has ended. Accounting-Request packet includes Acct-Status-Type=Stop. Session was authenticated and encapsulated by means of Ascend Tunnel Management Protocol (ATMP).
Ascend-Multilink-ID (187)	Reports the ID number of the Multilink bundle when the session closes.	Session must be authenticated.
Ascend-Num-In-Multilink (188)	Records the number of sessions remaining in a Multilink bundle when the session closes.	Session must be authenticated.
Ascend-Number-Sessions (202)	Indicates the number of active user sessions of a given class (as specified by the Class attribute). In the case of multichannel calls, such as MP+ calls, each separate connection counts as a session.	The MAX TNT sends the Ascend-Number-Sessions attribute in Ascend-Access-Event-Request packets. Only RADIUS daemons you customize to recognize packet code 33 respond to these request packets.
Ascend-Pre-Input-Octets (190)	Reports the number of octets the MAX TNT received before authentication. The value reflects only the data delivered by PPP or other encapsulation. It does not include the header or other protocol-dependent components of the packet.	Session must be authenticated. An asynchronous connection must be in use. That is, the data must be unframed.
Ascend-Pre-Input-Packets (192)	Reports the number of packets the MAX TNT received before authentication. The packets are counted before the encapsulation is removed. The attribute's value does not include maintenance packets, such as keepalive or management packets.	Session must be authenticated.
Ascend-Pre-Output-Octets (191)	Reports the number of octets the MAX TNT sent before authentication. The value reflects only the data delivered by PPP or other encapsulation. It does not include the header or other protocol-dependent components of the packet.	Session must be authenticated. An asynchronous connection must be in use. That is, the data must be unframed.
Ascend-Pre-Output-Packets (193)	Reports the number of packets the MAX TNT sent before authentication. The packets are counted before the encapsulation is removed. The attribute's value does not include maintenance packets, such as keepalive or management packets.	Session must be authenticated.
Ascend-PreSession-Time (198)	Indicates the length of time, in seconds, from when a call connected to when it completed authentication.	None.
Ascend-User-Acct-Base (142)	Indicates whether the numeric base of the RADIUS Acct-Session-ID attribute is 10 or 16.	None.
Ascend-User-Acct-Host (139)	Indicates the IP address of the RADIUS server to use for the connection.	None.
Ascend-User-Acct-Key (141)	Indicates the RADIUS client password as it appears in the clients file.	None.
Ascend-User-Acct-Port (140)	Indicates a destination UDP port number for the connection.	None.
Ascend-User-Acct-Time (143)	Indicates the number of seconds the MAX TNT waits for a response to a RADIUS accounting request.	None.
Ascend-User-Acct-Type (138)	Indicates the RADIUS accounting server(s) to use for the connection.	None.
Ascend-Xmit-Rate (255)	Indicates the rate of data transmitted on the connection in bits per second. For ISDN calls, Ascend-Xmit-Rate indicates the transmit data rate. For analog calls, it indicates the modem baud rate at the time of the initial connection.	None.

Accounting attributes in Failure-to-start records

Acct-Delay-Time (41)

Acct-Session-Id (44)

Acct-Status-Type (40)

Ascend-Connect-Progress (196)

Ascend-Data-Rate (197)

Ascend-Disconnect-Cause (195)

Ascend-PreSession-Time (198)

For a brief description of each of these attributes, see Table 12-4.

Proxy RADIUS accounting

How proxy RADIUS accounting works

Figure 12-3. Normal RADIUS accounting (no proxy necessary)

When a call comes in, the host card first sends a Start record to the shelf controller, which stores it as an Accounting Fail-Safe (AFS) record. The host card then sends one or more Start records to the RADIUS accounting server, repeating until it receives an ACK from the server. Similarly, when the call clears, the host card sends a Stop record to the shelf controller, which causes it to delete the AFS record for that session. The host card then sends the accounting server Stop records until it receives an ACK from the server.

When RADIUS accounting is in use and the host card goes down for any reason, proxy accounting occurs as shown in Figure 12-4.

Figure 12-4. Proxy accounting (host card goes down)

In this case, when the shelf controller notes that the host card is down, it uses its own information about the host card and the stored AFS record to send a Stop record directly to the RADIUS accounting server, repeating until it receives a Stop ACK from the server. The shelf controller then deletes the AFS record for that session.

Note that if the accounting server is accessible only by means of the host card that goes down, Stop records cannot be delivered successfully.

Contents of the Stop record sent by proxy

Table 12-5. Accounting attributes included in proxy Stop records

Sample accounting records

• A Pipeline 25 dialing into a MAX TNT

• A modem calling into a MAX TNT

A Pipeline 25 dialing into a MAX TNT

Tue Feb 18 12:00:41 1997 /* Session startup time */

   User-Name="ht-net" /* The name of the Pipeline 25 */

   NAS-Identifier=206.65.212.46 /* The IP address of the MAX TNT */

   NAS-Port=1057 /* Call on channel 2, line 2, slot 2, shelf 1 */

   Acct-Status-Type=Start /* Start record. */

   Acct-Delay-Time=0 /* Always zero for a Start record */

   Acct-Session-Id="1234567" /* Session identification number */

   Acct-Authentic=RADIUS /* RADIUS authentication in use */

   Client-Port-DNIS="3142" /* Called-party number */

   Framed-Protocol=PPP /* PPP call */

   Framed-Address=11.0.0.1 /* IP address of the Pipeline 25 */

Tue Feb 18 12:02:48 1997 /* Session hangup time */

   User-Name="ht-net" /* The name of the Pipeline 25 */

   NAS-Identifier=206.65.212.46 /* The IP address of the MAX TNT */

   NAS-Port=1057 /* Call on channel 2, line 2, slot 2, shelf 1 */

   Acct-Status-Type=Stop /* Stop record */

   Acct-Delay-Time=18 /* MAX TNT tried to send packet for 18 seconds 
*/

   Acct-Session-Id="1234567" /* Session identification number */

   Acct-Authentic=RADIUS /* RADIUS authentication used */

   Acct-Session-Time=128 /* Number of seconds in session */

   Acct-Input-Octets=2421 /* Bytes received from the Pipeline */

   Acct-Output-Octets=1517 /* Bytes sent to the Pipeline */

   Acct-Input-Packets=79 /* Packets received from the Pipeline */

   Acct-Output-Packets=47 /* Packets sent to the Pipeline */

   Ascend-Disconnect-Cause=100 /* Session timeout */

   Ascend-Connect-Progress=60 /* LAN session up */

   Ascend-Data-Rate=31200 /* Receive data rate in bits per second */

   Ascend-Xmit-Rate=48000 /* Transmit data rate in bits per seconds */

   Ascend-PreSession-Time=0 /*Secs from connection to authentication*/

   Ascend-Pre-Input-Octets=174 /* Input octets pre-authentication */

   Ascend-Pre-Output-Octets=204 /* Output octets pre-authentication */

   Ascend-Pre-Input-Packets=7 /* Input packets pre-authentication */

   Ascend-Pre-Output-Packets=8 /* Output packets pre-authentication */

   Ascend-First-Dest=10.81.44.111 /* Dest IP address of 1st packet */

   Ascend-Multilink-ID=64 /* ID number of Multilink bundle */.

   Ascend-Num-In-Multilink=0 /* # of sessions in Multilink bundle */

   Client-Port-DNIS="3142" /* Called-party number */

   Framed-Protocol=PPP /* PPP call */

   Framed-Address=11.0.0.1 /* IP address of the Pipeline 25 */

A Start record might look like the following:

Tue Feb 18 12:00:00 1997 /* Session startup time */

   User-Name="Berkeley" /* The name of the modem caller */

   NAS-Identifier=200.65.212.46 /* The IP address of the MAX TNT */

   NAS-Port=1057 /* Call on channel 2, line 2, slot 2, shelf 1 */

   Acct-Status-Type=Start /* Start record. */

   Acct-Delay-Time=0 /* Always zero for a Start record */

   Acct-Session-Id="3456789" /* Session identification number */

   Acct-Authentic=RADIUS /* RADIUS authentication in use */

   Client-Port-DNIS="3143" /* Called-party number */

   Login-Service=Unframed-User /* Modem call */

Tue Feb 18 12:03:00 1997 /* Session hangup time */

   User-Name="Berkeley" /* The name of the modem caller */

   NAS-Identifier=200.65.212.46 /* The IP address of the MAX TNT */

   NAS-Port=1057 /* Call on channel 2, line 2, slot 2, shelf 1 */

   Acct-Status-Type=Stop /* Stop record */

   Acct-Delay-Time=18 /* MAX TNT tried to send packet for 18 seconds 
*/

   Acct-Session-Id="3456789" /* Session identification number */

   Acct-Authentic=RADIUS /* RADIUS authentication used */

   Acct-Session-Time=128 /* Number of seconds in session */

   Acct-Input-Octets=2421 /* Bytes received from the Pipeline */

   Acct-Output-Octets=1517 /* Bytes sent to the Pipeline */

   Acct-Input-Packets=79 /* Packets received from the Pipeline */

   Acct-Output-Packets=47 /* Packets sent to the Pipeline */

   Ascend-Disconnect-Cause=100 /* Session timeout */

   Ascend-Connect-Progress=60 /* LAN session up */

   Ascend-Data-Rate=31200 /* Receive data rate in bits per second */

   Ascend-Xmit-Rate=48000 /* Transmit data rate in bits per seconds */

   Ascend-PreSession-Time=0 /*Secs from connection to authentication*/

   Ascend-Pre-Input-Octets=174 /* Input octets pre-authentication */

   Ascend-Pre-Output-Octets=204 /* Output octets pre-authentication */

   Ascend-Pre-Input-Packets=7 /* Input packets pre-authentication */

   Ascend-Pre-Output-Packets=8 /* Output packets pre-authentication */

   Ascend-First-Dest=10.81.44.111 /* Dest IP address of 1st packet */

   Ascend-Multilink-ID=64 /* ID number of Multilink bundle *.

   Ascend-Num-In-Multilink=0 /* # of sessions in Multilink bundle */

   Client-Port-DNIS="3143" /* Called-party number */

   Login-Service=Unframed-User /* Modem call */

Wed Nov 5 14:50:21 1997

    User-Name="joel-mhp"

    NAS-Identifier=200.65.212.199

    NAS-Port=2272

    NAS-Port-Type=Sync

    Acct-Status-Type=Stop

    Acct-Delay-Time=0

    Acct-Session-Id="246212864"

    Acct-Authentic=RADIUS

    Acct-Session-Time=4

    Acct-Input-Octets=0

    Acct-Output-Octets=0

    Acct-Input-Packets=0

    Acct-Output-Packets=0

    Ascend-Disconnect-Cause=210

    Ascend-Connect-Progress=67

    Ascend-Data-Rate=0

    Ascend-PreSession-Time=0

    Ascend-Pre-Input-Octets=174

    Ascend-Pre-Output-Octets=204 

    Ascend-Pre-Input-Packets=7 /

    Ascend-Pre-Output-Packets=8 

    Framed-Protocol=PPP

    Framed-Address=200.168.6.66

Copyright © 1998, Ascend Communications, Inc. All rights reserved.