Skip to ContentSkip to Footer
Start of content
- Community Home
- >
- Networking
- >
- Legacy
- >
- Switches, Hubs, Modems
- >
- Radius Accounting problems on 5400's
Switches, Hubs, and Modems
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
-
- Forums
-
- Advancing Life & Work
- Advantage EX
- Alliances
- Around the Storage Block
- HPE Ezmeral: Uncut
- OEM Solutions
- Servers & Systems: The Right Compute
- Tech Insights
- The Cloud Experience Everywhere
- HPE Blog, Austria, Germany & Switzerland
- Blog HPE, France
- HPE Blog, Italy
- HPE Blog, Japan
- HPE Blog, Middle East
- HPE Blog, Russia
- HPE Blog, Saudi Arabia
- HPE Blog, South Africa
- HPE Blog, UK & Ireland
-
Blogs
- Advancing Life & Work
- Advantage EX
- Alliances
- Around the Storage Block
- HPE Blog, Latin America
- HPE Blog, Middle East
- HPE Blog, Saudi Arabia
- HPE Blog, South Africa
- HPE Blog, UK & Ireland
- HPE Ezmeral: Uncut
- OEM Solutions
- Servers & Systems: The Right Compute
- Tech Insights
- The Cloud Experience Everywhere
-
Information
- Community
- Welcome
- Getting Started
- FAQ
- Ranking Overview
- Rules of Participation
- Tips and Tricks
- Resources
- Announcements
- Email us
- Feedback
- Information Libraries
- Integrated Systems
- Networking
- Servers
- Storage
- Other HPE Sites
- Support Center
- Aruba Airheads Community
- Enterprise.nxt
- HPE Dev Community
- Cloud28+ Community
- Marketplace
-
Forums
-
Blogs
-
Information
-
English
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
04-03-2009 08:16 AM
04-03-2009 08:16 AM
Radius Accounting problems on 5400's
Hi Everyone.
I have setup FreeRadius to log all the commands entered from the procurve command line and it rocks except for on some of my 5400's it is sending the Calling-Station-Id wrong.
The Calling-Station-Id is this case should be the IP address of the device which has telneted / ssh'd into the switch. What is slightly more annoying is that the switch is definitely aware of the IP it should be sending as if I turn on
"aaa accounting exec start-stop" to log the sessions of people on the switch it is showing the correct ip in my logs (below). A "show telnet" also shows the correct IP. Basically I want to get to the point where I can pointpoint what command was entered by who, without having to create a separate login for everyone who uses the switches.
Below I have attached a few logs from my freeradius server showing that the exec accounting is logging the ip correctly, but the command logging is not:
Fri Apr 3 16:50:15 2009
Acct-Session-Id = "001600000067"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "configure"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "881be2951fb9f480"
Timestamp = 1238773815
Request-Authenticator = Verified
Fri Apr 3 16:50:33 2009
Acct-Session-Id = "001600000068"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "show running-config"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "48d69eada0b18878"
Timestamp = 1238773833
Request-Authenticator = Verified
Fri Apr 3 16:50:38 2009
Acct-Session-Id = "001600000066"
Acct-Status-Type = Stop
Service-Type = NAS-Prompt-User
Acct-Authentic = Local
Acct-Delay-Time = 0
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
Calling-Station-Id = "128.1.8.248"
Acct-Terminate-Cause = 0
Acct-Session-Time = 24
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "5e94f50f4e1d979d"
Timestamp = 1238773838
Request-Authenticator = Verified
Fri Apr 3 16:50:38 2009
Acct-Session-Id = "001600000069"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "no aaa accounting exec"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "24bf137d62127cbb"
Timestamp = 1238773838
Request-Authenticator = Verified
Fri Apr 3 16:50:52 2009
Acct-Session-Id = "00160000006A"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "logout"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "ed390633efe8ca74"
Timestamp = 1238773852
Request-Authenticator = Verified
I have setup FreeRadius to log all the commands entered from the procurve command line and it rocks except for on some of my 5400's it is sending the Calling-Station-Id wrong.
The Calling-Station-Id is this case should be the IP address of the device which has telneted / ssh'd into the switch. What is slightly more annoying is that the switch is definitely aware of the IP it should be sending as if I turn on
"aaa accounting exec start-stop" to log the sessions of people on the switch it is showing the correct ip in my logs (below). A "show telnet" also shows the correct IP. Basically I want to get to the point where I can pointpoint what command was entered by who, without having to create a separate login for everyone who uses the switches.
Below I have attached a few logs from my freeradius server showing that the exec accounting is logging the ip correctly, but the command logging is not:
Fri Apr 3 16:50:15 2009
Acct-Session-Id = "001600000067"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "configure"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "881be2951fb9f480"
Timestamp = 1238773815
Request-Authenticator = Verified
Fri Apr 3 16:50:33 2009
Acct-Session-Id = "001600000068"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "show running-config"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "48d69eada0b18878"
Timestamp = 1238773833
Request-Authenticator = Verified
Fri Apr 3 16:50:38 2009
Acct-Session-Id = "001600000066"
Acct-Status-Type = Stop
Service-Type = NAS-Prompt-User
Acct-Authentic = Local
Acct-Delay-Time = 0
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
Calling-Station-Id = "128.1.8.248"
Acct-Terminate-Cause = 0
Acct-Session-Time = 24
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "5e94f50f4e1d979d"
Timestamp = 1238773838
Request-Authenticator = Verified
Fri Apr 3 16:50:38 2009
Acct-Session-Id = "001600000069"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "no aaa accounting exec"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "24bf137d62127cbb"
Timestamp = 1238773838
Request-Authenticator = Verified
Fri Apr 3 16:50:52 2009
Acct-Session-Id = "00160000006A"
NAS-IP-Address = 128.1.8.6
NAS-Identifier = "Centuryan_House5412"
NAS-Port-Type = Virtual
Calling-Station-Id = "0.0.0.128"
Acct-Status-Type = Interim-Update
Acct-Authentic = Local
Service-Type = NAS-Prompt-User
HP-Command-String = "logout"
Acct-Delay-Time = 0
MS-RAS-Vendor = 11
Acct-Unique-Session-Id = "ed390633efe8ca74"
Timestamp = 1238773852
Request-Authenticator = Verified
2 REPLIES 2
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
04-03-2009 08:19 AM
04-03-2009 08:19 AM
Re: Radius Accounting problems on 5400's
I should also mention that my switches are all between the K_13_09 and K_13_51 for the firmware.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
07-01-2009 06:08 AM
07-01-2009 06:08 AM
Re: Radius Accounting problems on 5400's
I believe now that this is a bug in the newer versions of ProCurve Firmware, definately from K.13.57 and maybe one or two versions before.
There also seems to be further issues with Radius since version K.13.63
Routing Switches now have trouble locating the radius server (which is on a different subnet) however L2 edge switches, sending their radius requests through the routing switches are still working.
Does anyone know how I can report this to HP?
There also seems to be further issues with Radius since version K.13.63
Routing Switches now have trouble locating the radius server (which is on a different subnet) however L2 edge switches, sending their radius requests through the routing switches are still working.
Does anyone know how I can report this to HP?
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.
End of content
United States
Hewlett Packard Enterprise International
Communities
- Communities
- HPE Blogs and Forum
© Copyright 2021 Hewlett Packard Enterprise Development LP