ACS 5.3 Accounting

[Karel Navratil]

Hello all,

I need to help with accounting in ACS 5.3. When I setup accounting on WLC 440x / 5508 ACS takes them as an authentication request and fail.

Here are some logs what I see in acsview:

Dec 9,11 6:05:11.783 PM

Radius authentication failed for USER: navrka2  MAC: a.b.c.d  AUTHTYPE:

Radius authentication failed

ACS Session ID:	dc2aaa1v/112555963/420
Audit Session ID:	0a9a01d7000001fd4ee23a3d
Tunnel Details:	Tunnel-Type=(tag=0) VLAN, Tunnel-Medium-Type=(tag=0) 802, Tunnel-Private-Group-ID=(tag=0) XXX
H323 Attributes:
SSG Attributes:
Cisco-AVPairs:	audit-session-id=0a9a01d7000001fd4ee23a3d nas-update=true
Other Attributes:	ACSVersion=acs-5.3.0.40-B.839 ConfigVersionId=41 Device Port=32769 RadiusPacketType=AccountingRequest Protocol=Radius Class=CACS:dc2aaa1v/112555963/420 Called-Station-ID=a.b.c.d Acct-Status-Type=Interim-Update Acct-Delay-Time=0 Acct-Input-Octets=21346 Acct-Output-Octets=13535 Acct-Session-Id=4ee23a4c/f4:0b:93:b2:d8:08/23477 Acct-Authentic=RADIUS Acct-Session-Time=1394 Acct-Input-Packets=278 Acct-Output-Packets=163 Airespace-Wlan-Id=11 Device IP Address=a.b.c.d

11004  Received RADIUS Accounting-Request

11017  RADIUS created a new session

Evaluating Service Selection Policy

15006  Matched Default Rule

15012  Selected Access Service - DenyAccess

11019  Selected DenyAccess Service

11003  Returned RADIUS Access-Reject

Any ideas how to get this working?

Thanks

Karel

[dominikhug]

Hi

Maybe you see Bug CSCts14694, Accounting requests seen as authentication requests.

But at the moment I don't know how to resolve this problem

Regards

Dominik

[Karel Navratil]

Hi,

I already fixed it, just used another compound condition which also matched radius accounting packets.

Regards

Karel

[dominikhug]

Hi Karel

Could you maybe post a screenshot how you created the compound condition? I've already tried but I wasn't able to manage this

Regards

Dominik

[Karel Navratil]

Hi Dominik,

before in Access Policies --> Service Selection Rules I had a rule for WLAN and in compound condition I had that Service-Type must be Framed. Because Accounting requests do not have this attribute, then the request was not matched by this rule or any other.

When I removed Framed Service Type and put it to Access Service directly it started to work.

Hope this helps.

Regards

Karel