ACS is giving duplicate IP addresses

[ruben.montes]

Hello,

I have an ACS serving as AAA server for a C3620 router serving as RAS. This ACS is giving the same IP address to different clients. Here you have the output of the 'sh users'where you can see this problem.

R3620CTP01#sh users

Line User Host(s) Idle Location

10 tty 10 CC002501 Async interface 00:05:26 PPP: 102.1.1.188

24 tty 24 CC004839 Async interface 00:05:20 PPP: 102.1.1.188

28 tty 28 cc006004 Async interface 00:01:46 PPP: 102.1.1.191

66 vty 0 gsirmf idle 00:02:58 39.193.12.61

67 vty 1 gsicvg idle 00:00:39 39.193.12.90

* 68 vty 2 gsirmf idle 00:00:00 39.193.12.61

Interface User Mode Idle Peer Address

The ACS version is 3.3(1) Build 16. Previously they had ACS version 2.6 with the same problem.

Regards,

Ruben

[gfullage]

Do they have accounting configured on the 3620? Basically without accounting, ACS has no idea when a user has logged out and the allocated IP address has become free, and this problem can happen.

They'd need something like:

aaa accounting network default start-stop group radius

Note they have to have start-stop, not just stop-only.

[c.stamataras]

I have spent days and days with the same problem. I had a local pool for PSTN users and an ACS pool for ISDN users. The router was ignoring the local pool and was ALWAYS using the ACS pool. I changed several IOS versions but I couldn't change the ACS version which is the same like yours. It may be a bug.

The only way it worked is with 2 local pools and version 12.2.15.T14 on the AS5350.

Try doing something similar...

Chris.

[ruben.montes]

Hello,

these are the accounting commands the router has:

aaa accounting exec EXEC_ACC_TACACS start-stop group tacacs+

aaa accounting commands 15 COMMAND_ACC_TACACS start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting network NETWORK_ACC_TACACS start-stop group tacacs+

aaa accounting connection default start-stop group tacacs+

Any other idea?

Thank you,

Ruben