Radius accounting server generating the subscriber accounting records with 6 hours of time difference 

Radius accounting server generating the subscriber accounting records with 6 hours of time difference

A log snippet taken from one of the Radius servers which was experiencing a delayed accounting report:

Tue Jul 09 12:18:50 2024

User-Name = "test_subscriber"

Acct-Status-Type = Stop

Acct-Session-Id = "523971"

Event-Timestamp = "2024/07/09 06:17:15"

Acct-Input-Octets = 645373

Acct-Output-Octets = 1000779

Acct-Session-Time = 85587

Acct-Input-Packets = 5359

Acct-Output-Packets = 14131

Acct-Terminate-Cause = Lost-Carrier

Acct-Delay-Time = 0

Service-Type = Framed-User

Framed-Protocol = PPP

Unisphere-CoS-Shaping-Rate = "Actual Rate: 63897k"

Framed-IPv6-Prefix = fc00:1020:1f::/64

Delegated-IPv6-Prefix = 2806:102e:23::/64

Framed-IPv6-Pool = "TEST_IPV6_POOL"

Acct-Authentic = Radius

----- Snip ------

The time difference could be due to a difference in timezone or intermittent reachability issues. Follow the below steps for issue isolation:

1. To confirm the Timezone difference following outputs and correct it if the difference is found

labroot@bng-jtac-mx960-r2035> show system uptime

Current time: 2024-07-09 20:38:47 -06

Time Source: NTP CLOCK

System booted: 2024-01-25 02:59:26 -06 (23w5d 17:39 ago)

Protocols started: 2024-01-25 03:02:00 -06 (23w5d 17:36 ago)

Last configured: 2024-07-09 15:39:36 -06 (04:59:11 ago) by labroot

 8:38PM up 166 days, 17:39, 3 users, load averages: 0.43, 0.53, 0.54

labroot@bng-jtac-mx960-r2035-re0> show ntp associations

    remote              refid          auth st t when poll reach delay    offset  jitter

===================================================================================================

*10.219.0.35           66.129.233.81       -  4 u   65  128 377   0.836   +0.226   0.171 ---> '*' indicates this node is using this as reference clock

 10.219.0.36           .STEP.              - 16 u    - 1024   0   0.000   +0.000   0.000

labroot@bng-jtac-mx960-r2035-re0> show ntp status

associd=0 status=0618 leap_none, sync_ntp, 1 event, no_sys_peer,

version="ntpd 4.2.0-a Thu Nov 3 04:59:29 2022 (1)", processor="amd64",

processor="amd64", system="FreeBSDJNPR-12.1-20230531.b65fd55_buil",

leap=00, stratum=5, precision=-21, rootdelay=264.996, rootdisp=42.292,

refid=10.219.0.35,

reftime=ea28180e.6b1d6b31 Thu, Jun 27 2024 10:55:42.418, poll=4,

clock=ea3872e7.c744621e Tue, Jul 9 2024 20:39:35.778, state=4,

tc=7, mintc=3, offset=+0.225977, frequency=+12.357, sys_jitter=0.000000,

clk_jitter=0.061, clk_wander=0.005

- If a difference is found, make sure both node and Radius servers are using the same timezone reference clocks

- Restart the NTP protocol for NTP changes to take effect during MW via

deactivate system ntp 

commit

activate system ntp

commit

2. - We can enable authd traceoptions via the below commands to track the communication between BNG and Radius server:
set system processes general-authentication-service traceoptions file authd
set system processes general-authentication-service traceoptions file size 100m
set system processes general-authentication-service traceoptions file files 2
set system processes general-authentication-service traceoptions flag all
 

3. Verify if Radius server reachability as follows:

labroot@bng-jtac-mx960-r2035> ping 192.168.1.1 rapid 

PING 192.168.1.1 (192.168.1.1): 56 data bytes

..76 bytes from 192.168.1.10: Communication prohibited by filter

^C

--- 192.168.1.1 ping statistics ---

5 packets transmitted, 0 packets received, 100% packet loss

- The working node shows Acct-On-Response 'ACK' While the non-working status shows 'PENDING':

labroot@bng-jtac-mx960-r2000> show network-access aaa accounting

 Profile             Logical System      Routing Instance    Acct-On-Response

 RADIUS              default             default             ACK  

Non-working node:

labroot@bng-jtac-mx960-r2035> show network-access aaa accounting   

 Profile             Logical System      Routing Instance    Acct-On-Response

 RADIUS              default             default             PENDING 

- We see active increments for Accounting retransmissions & Timed out requests during server reachability:

labroot@bng-jtac-mx960-r2035> show network-access aaa statistics accounting detail

Accounting module statistics

 Timed out requests: 13103

 Accounting retransmissions: 26209

labroot@bng-jtac-mx960-r2035> show network-access aaa statistics accounting detail  

Accounting module statistics

 Timed out requests: 13112

 Accounting retransmissions: 26235

Accounting retransmissions - Number of accounting requests made by a client to the RADIUS server that were retransmitted

Timed out requests - Number of accounting requests to the accounting server that timed out

Refer to the below link for a detailed explanation of the command "show network-access aaa statistics accounting detail":

https://www.juniper.net/documentation/us/en/software/bng-cups22.1/cups_controller/bng-cups-user/topics/ref/command/cups-show-network-access-aaa-statistics.html

Step 3 confirms radius server reachability issues and addressing that should fix the accounting delay.