topic Re: Is it possible to send Radius accounting packets to two diff in Network Access Control

Is it possible to send Radius accounting packets to two different servers?

Difan Zhao — Mon, 11 Mar 2019 00:24:57 GMT

Hi experts!

I have dilemma that I need to send Radius accounting info to two different servers for dot1x authentication. The following is the relevent config. However the switch is only sending one copy to the first server in the server group...

aaa group server radius Acct
server 172.17.1.1 auth-port 1812 acct-port 1813
server 172.17.1.2 auth-port 1812 acct-port 1813

aaa accounting dot1x default start-stop broadcast group Acct

radius-server host 172.17.1.1 auth-port 1812 acct-port 1813 key xxxxxx
radius-server host 172.17.1.2 auth-port 1812 acct-port 1813 key xxxxxx

Is it possible to send two copies to two different servers? I tried the keyword "broadcast" in the aaa accounting command but it doesn't make a difference. What does it do? I can't find it in the manual...

Thanks!

Difan

Re: Is it possible to send Radius accounting packets to two diff

Jagdeep Gambhir — Fri, 17 Sep 2010 09:23:40 GMT

Difan,

You need to create two aaa server groups to make it work. Enables sending accounting records to multiple AAA servers. Simultaneously sends accounting records to the first server in each group. If the first server is unavailable, failover occurs using the backup servers defined within that group.

Configuring AAA Broadcast Accounting
The following example shows turning on broadcast accounting using the global aaa accounting command:

aaa group server radius isp
server 1.0.0.1
server 1.0.0.2

aaa group server radius isp_customer
server 3.0.0.1

aaa accounting network default start-stop broadcast group isp group isp_customer

radius-server host 1.0.0.1
radius-server host 1.0.0.2
radius-server key key1
radius-server host 3.0.0.1 key key2

The broadcast keyword causes start and stop accounting records for dot1x connections to be sent simultaneously to server 1.0.0.1 in the group isp and to server 3.0.0.1 in the group isp_customer. If server 1.0.0.1 is unavailable, fail over to server 1.0.0.2 occurs. If server 3.0.0.1 is unavailable, no fail over occurs because backup servers are not configured for the group isp_customer.

Regards,

~JG

Do rate helpful posts

Re: Is it possible to send Radius accounting packets to two diff

Difan Zhao — Fri, 17 Sep 2010 21:59:40 GMT

This is the reply I must rate! Thanks a lot JG!