As a novice when it comes to using IOS I'm having some difficulty modifying the config on my 1720 router to send start-stop RADIUS accounting packets to my RADIUS server whenever any of our users initiate or end a VPN session to the router. I've managed to get the users to authenticate to the RADIUS server but figuring out the accounting part has eluded me. After performing events which should generate accounting information a 'show radius statistics' shows no accounting packets have been generated. Any help would be appreciated.
Config file follows...
Brian Barrett
Network Administrator
Franklin International Inc.
----------------------------------------
Router#sh run
Building configuration...
Current configuration : 2582 bytes
!
version 12.2
service config
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Router
!
aaa new-model
!
!
aaa authentication login userauthen group radius local
aaa authorization network groupauthor local
aaa accounting send stop-record authentication failure
aaa accounting network default start-stop group radius
aaa session-id common
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxx
enable password 7 xxxxxxxxxxxxxxxxxxxxx
!
username vpnuser password 7 xxxxxxxxxxxxxxxxxxxxxxx
memory-size iomem 20
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!
!
ip name-server 205.171.3.65
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group vpnclient
key xxxxxxxxxx
dns 10.1.1.25
wins 10.1.1.25
domain mydomain.com
pool ippool
acl 101
!
!
crypto ipsec transform-set newset esp-des esp-md5-hmac
!
crypto dynamic-map dynmap 5
set transform-set newset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface FastEthernet0
ip address xxx.xxx.xxx.xxx 255.255.255.224
speed auto
full-duplex
no cdp enable
!
interface Serial0
description Serial Link to Qwest
ip address xxx.xxx.xxx.xxx 255.255.255.252
encapsulation ppp
crypto map clientmap
!
ip local pool ippool 10.100.1.100 10.100.1.200
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip route 10.1.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.2.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.3.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.4.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.5.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.6.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.7.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.8.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip http server
ip pim bidir-enable
!
!
access-list 101 permit ip 10.0.0.0 0.255.255.255 10.100.0.0 0.0.255.255
!
radius-server host 10.1.1.75 auth-port 1645 acct-port 1646 key 7 xxxxxxxxxxxxxxxxxx
radius-server retransmit 3
radius-server timeout 10
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password 7 xxxxxxxxxxxxxxxxxxxxxxx
!
no scheduler allocate
end
Router#
Config file follows...
Brian Barrett
Network Administrator
Franklin International Inc.
----------------------------------------
Router#sh run
Building configuration...
Current configuration : 2582 bytes
!
version 12.2
service config
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Router
!
aaa new-model
!
!
aaa authentication login userauthen group radius local
aaa authorization network groupauthor local
aaa accounting send stop-record authentication failure
aaa accounting network default start-stop group radius
aaa session-id common
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxx
enable password 7 xxxxxxxxxxxxxxxxxxxxx
!
username vpnuser password 7 xxxxxxxxxxxxxxxxxxxxxxx
memory-size iomem 20
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!
!
ip name-server 205.171.3.65
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group vpnclient
key xxxxxxxxxx
dns 10.1.1.25
wins 10.1.1.25
domain mydomain.com
pool ippool
acl 101
!
!
crypto ipsec transform-set newset esp-des esp-md5-hmac
!
crypto dynamic-map dynmap 5
set transform-set newset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface FastEthernet0
ip address xxx.xxx.xxx.xxx 255.255.255.224
speed auto
full-duplex
no cdp enable
!
interface Serial0
description Serial Link to Qwest
ip address xxx.xxx.xxx.xxx 255.255.255.252
encapsulation ppp
crypto map clientmap
!
ip local pool ippool 10.100.1.100 10.100.1.200
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip route 10.1.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.2.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.3.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.4.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.5.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.6.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.7.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip route 10.8.0.0 255.255.0.0 xxx.xxx.xxx.xxx
ip http server
ip pim bidir-enable
!
!
access-list 101 permit ip 10.0.0.0 0.255.255.255 10.100.0.0 0.0.255.255
!
radius-server host 10.1.1.75 auth-port 1645 acct-port 1646 key 7 xxxxxxxxxxxxxxxxxx
radius-server retransmit 3
radius-server timeout 10
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password 7 xxxxxxxxxxxxxxxxxxxxxxx
!
no scheduler allocate
end
Router#