topic Re: Send radius accounting interim-updates when User-Name Changes in ICX Switches

Send radius accounting interim-updates when User-Name Changes

lyubomir_trayko — Tue, 11 May 2021 11:18:02 GMT

Hello, I am trying to configure ICX7450 with FortiGate Firewall Radius SSO. It is working ok for most of the cases. The only problem I have is on Windows 10 domain computer using User or computer authentication dot1x. The behaviour is as fallows:

1. The computer authenticates with the Computer Domain account. The switch sends radius accounting START packet and INTERIM packet with the computer User-Name and IP. Till this point everything is working as expected.

2. The User logs in and performs Authentication Request. The switch is not sending Accounting START, STOP or INTERIM packet to the firewall and the accounting session continues. Because of this the User-Name in the firewall is not updated.

3. When some time passes INTERIM Update is sent with the new User-Name by the switch to the firewall and the firewall updates the User-Name.

Question: How to configure the switch to send INTERIM Update immediately after the User logs in.

Re: Send radius accounting interim-updates when User-Name Changes

Orlando_Elias — Tue, 11 May 2021 14:43:59 GMT

Hello lyubomir_traykov

The interval in which interim updates for RADIUS accounting are sent can be configured and modified using these commands,

device(config)# radius-server accounting interim-updates
device(config)# radius-server accounting interim-interval 1

Please refer to the below guide for further details,

https://docs.commscope.com/bundle/fastiron-08080-commandref/page/GUID-3C0F31FB-CED5-47BC-8588-A8219B9C5361.html

Please let me know if you had any comments or concerns.

Re: Send radius accounting interim-updates when User-Name Changes

lyubomir_trayko — Wed, 12 May 2021 05:20:03 GMT

Thanks for the suggestion, but the minimum interim-interval is 5 minutes. Also this will put a lot of unnecessary load to our radius server.

Re: Send radius accounting interim-updates when User-Name Changes

Orlando_Elias — Wed, 12 May 2021 13:32:50 GMT

Hello lyubomir_traykov

I am concerned that you mention the ICX switch is not sending any START/STOP messages.

That is something we should definitely double-check.

An Accounting Start packet is sent to the RADIUS server when a user is successfully authenticated.

To enable start/stop packets for accounting, we should run this command:

device(config)# aaa accounting dot1x default start-stop radius

device(config)# aaa accounting mac-auth default start-stop radius

We can debug any AAA action/packet with the following command:

device#ptrace aaa

To stop this debug, run the command again.

I hope this information is useful.

If you noticed any irregularity that you think we should check in detail, please don't hesitate to open a support case.

We'll be happy to look into it.

Re: Send radius accounting interim-updates when User-Name Changes

lyubomir_trayko — Thu, 13 May 2021 05:57:40 GMT

The switch is not sending accounting information only when the User logs in. As you can see from the LOG the computer authentication is sending accounting information.

Re: Send radius accounting interim-updates when User-Name Changes

Orlando_Elias — Thu, 13 May 2021 12:07:06 GMT

Hello lyubomir_traykov

I understand your point.

I haven't tested such a scenario in my lab, so I am not able to tell whether the behavior observed is expected, but it's something that definitely worths the try.

For a better approach, the best action is opening a support case, that way we can replicate in our lab and even request for the fix/enhancement in case we found it's applicable.

As a workaround, I can think of enabling COA to see if that will force the interim update to be immediately sent when the new user logs in:

device(config)# aaa authorization coa enable