cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1827
Views
0
Helpful
4
Replies
Beginner

ACS 5.3 Accounting

Hello all,

I need to help with accounting in ACS 5.3. When I setup accounting on WLC 440x / 5508 ACS takes them as an authentication request and fail.

Here are some logs what I see in acsview:

Dec 9,11 6:05:11.783 PM

Radius authentication failed for USER: navrka2  MAC: a.b.c.d  AUTHTYPE:

Radius authentication failed

ACS Session ID:

dc2aaa1v/112555963/420

Audit Session ID:

0a9a01d7000001fd4ee23a3d

Tunnel Details:

Tunnel-Type=(tag=0) VLAN, Tunnel-Medium-Type=(tag=0) 802, Tunnel-Private-Group-ID=(tag=0) XXX

H323 Attributes:

SSG Attributes:

Cisco-AVPairs:

audit-session-id=0a9a01d7000001fd4ee23a3d
nas-update=true

Other Attributes:

ACSVersion=acs-5.3.0.40-B.839
ConfigVersionId=41
Device Port=32769
RadiusPacketType=AccountingRequest
Protocol=Radius
Class=CACS:dc2aaa1v/112555963/420
Called-Station-ID=a.b.c.d
Acct-Status-Type=Interim-Update
Acct-Delay-Time=0
Acct-Input-Octets=21346
Acct-Output-Octets=13535
Acct-Session-Id=4ee23a4c/f4:0b:93:b2:d8:08/23477
Acct-Authentic=RADIUS
Acct-Session-Time=1394
Acct-Input-Packets=278
Acct-Output-Packets=163
Airespace-Wlan-Id=11
Device IP Address=a.b.c.d

11004  Received RADIUS Accounting-Request

11017  RADIUS created a new session

Evaluating Service Selection Policy

15006  Matched Default Rule

15012  Selected Access Service - DenyAccess

11019  Selected DenyAccess Service

11003  Returned RADIUS Access-Reject

Any ideas how to get this working?

Thanks

Karel

4 REPLIES 4
Beginner

ACS 5.3 Accounting

Hi

Maybe you see Bug CSCts14694, Accounting requests seen as authentication requests.

But at the moment I don't know how to resolve this problem

Regards

Dominik

Beginner

ACS 5.3 Accounting

Hi,

I already fixed it, just used another compound condition which also matched radius accounting packets.

Regards

Karel

Highlighted
Beginner

ACS 5.3 Accounting

Hi Karel

Could you maybe post a screenshot how you created the compound condition? I've already tried but I wasn't able to manage this

Regards

Dominik

Beginner

ACS 5.3 Accounting

Hi Dominik,

before in Access Policies --> Service Selection Rules I had a rule for WLAN and in compound condition I had that Service-Type must be Framed. Because Accounting requests do not have this attribute, then the request was not matched by this rule or any other.

When I removed Framed Service Type and put it to Access Service directly it started to work.

Hope this helps.

Regards

Karel