Ascend-Maximum-Time limitation with Radius

Josh Hillman ( (no email) )
Thu, 1 May 1997 17:06:10 -0400

Dale,
I've been coresponding with Ascend on this matter for the past couple of
days and they've determined that the problem is apparently with RadiusNT.
In a nutshell, if Ascend-Maximum-Time (via Emerald / Master / Services /
RADIUS) is set to a value of 32768 or higher (any number > 2^15) a dialin
user is automatically disconnected within a second or two of being
authenticated. The Ascend-Disconnect-Cause in this case = 100, which means
the session timed out as if the Ascend-Maximum-Time were set to 1 second.
If Ascend-Maximum-Time is set to any number between 0 and 32767 (9 hours, 6
minutes, 7 seconds), the dialup user isn't disconnected until the time
specified--and at that time, the Ascend-Disconnect-Cause would still be
100, which is completely normal.

Below, are the messages sent/received between me and a tech at Ascend:

----------
> From: Wai Yip <support@ascend.com>
> Date: Thursday, May 01, 1997 3:42 PM
>
> Josh,
>
> We have tested our Unix Radius with the Ascend-Maximum-Time set to some
> values higher than 32767 and everything was working fine. We cannot
> duplicate your problem with OUR Radius.
>
> Since the NT Radius is not written by Ascend, even though we might find
out
> that it does not work with this setup, we have no way to fix the problem
> because we cannot modify Emerald's codes. You would need to contact
Emerald
> on this issue.
>
> If you are running the Ascend Unix Radius and have any other problem,
> please let us know.
>
> Regards,
> Wai

> ======================================================
> From: "Josh Hillman" <hillman@talstar.com>
> To: "Wai Yip" <support@ascend.com>
> Date: Mon, 28 Apr 1997 20:42:15 -0400
> ----------
> > There is a new attribute called Ascend-Maximum-Call-Duration for the
> > dial-in users. However, it may not be working properly and we are in
the
> > process of collecting data to trouble shoot it. Could you tell me what
> > version of Radius you are using so that we can duplicate it in the Lab?
> >
> > 5.0A release should have made the cause code for disconnect requested
by
> > the local administrator clearer. You should be seeing cause code 151
> > instead of 1 if you are running 5.0A software or later. I understand
that
> > you are already running 5.0Ai4. Again, could you tell us what version
of
> > Radius you are running so that we can test it out in the lab?
>
> I m using RadiusNT version 1.16.60 in conjunction with a SQL 6.5
database.
> Everything is handled through Windows NT 4.0 (Server) Service Pack 2 with
> all of the appropriate post-sp2 hot-fixes.
> RadiusNT:
> Info: www.emerald.iea.com
> file(s): ftp.emerald.iea.com/radius (radnt_60.zip)
>
> Here s a sample output from RadiusNT a typical Windows 95 dialup user
with
> a 33.6kbps modem (our Max never connects higher than 31200 bps). This
was
> pulled from a "detail" file that was generated on our backup radiusNT
> server while the primary radiusNT server database was being modified.
When
> the database is running, all data is fed into a "calls" table with the
same
> info as seen below.
>
> Mon Apr 14 08:53:59 1997
> User-Name = "pmfoley"
> NAS-IP-Address = 199.44.194.10
> NAS-Port = 20114
> Acct-Status-Type = Stop
> Acct-Delay-Time = 0
> Acct-Session-Id = "229657848"
> Acct-Authentic = RADIUS
> Acct-Session-Time = 357
> Acct-Input-Octets = 22034
> Acct-Output-Octets = 47951
> Acct-Input-Packets = 168
> Acct-Output-Packets = 243
> Ascend-Disconnect-Cause = 45
> Ascend-Connect-Progress = 60
> Ascend-Data-Rate = 31200
> Ascend-PreSession-Time = 15
> Ascend-Pre-Input-Octets = 395
> Ascend-Pre-Output-Octets = 354
> Ascend-Pre-Input-Packets = 9
> Ascend-Pre-Output-Packets = 11
> Ascend-First-Dest = 199.44.194.255
> Framed-Protocol = PPP
> Framed-Address = 199.44.194.41
>
> The following is from the "Calls" table in our database just after
> disconnecting a user by "hanging up" the call from the "90-100 Sessions"
> window on the Max console while using full-access rights. The two
"(null)"
> responses are there because I have db columns for them, but no data is
> currently put into the columns because the Max software version isn t
high
> enough to support them. After receiving our replacement dm12 cards (56k
> capable), I ll upgrade the software.
>
> CallDate Apr 28 1997 8:17PM
> UserName dburns
> AcctSessionID 229666193
> AcctSessionTime 120828
> AscendDataRate 28800
> AscendDisconnectCause 1
> FramedAddress 199.44.194.38
> NASIdentifier 199.44.194.10
> AscendModemSlotNo (null)
> AscendModemPortNo (null)
> NASPort 20120
> AscendConnectProgress 60
> AcctStatusType 2
> FramedProtocol 1
> AscendFirstDest 198.41.0.5
> AcctDelayTime 0
> AcctInputOctets 7354542
> AcctOutputOctets 388480007
> AcctInputPackets 454694
> AcctOutputPackets 1498342
> AscendPreInputOctets 380
> AscendPreOutputOctets 364
> AscendPreInputPackets 8
> AscendPreOutputPackets 12
> AscendPreSessionTime 16
>
>
> 2 of our 4 dm12 cards came with our Max 4004 back in September, while the
> other 2 came in Feb or early March.
> The last software revision to the Max was 5.0A --> 5.0Ai4, using the i4
> file, "tm.m40". Our connection to the phone company (Sprint) is half a
> mile away via DID (digital inbound dial-in) lines coming across T1s.
> I m guessing that this is a problem with Windows NT 4.0 RAS, but when an
NT
> machine disconnects, the Ascend-Disconnect-Cause is always 11 instead of
> 45. Apparently NT doesn t disconnect gracefully.
>
> Josh

> > =====================================================
(to: Ascend)
> > To whom it may concern,
> >
> > I m using a Max 4004 (5.0Ai4) and have noticed a problem with the
RADIUS
> > attribute, Ascend-Maximum-Time.
> >
> > It s limited to 0 to 32767 seconds (a range of 2^15 values).
> > If a number higher than 32767 (9 hours, 6 minutes, 7 seconds) is used,
> when
> > a caller dials in, the user is authenticated properly, but is
> disconnected
> > immediately after, with an Ascend-Disconnect-Cause = 100.
> >
> > Under normal circumstances, if a user is disconnected because the
> > Ascend-Maximum-Time is reached, should the Ascend-Disconnect-Cause =
100
> or
> > 195? I normally see a 100.
> >
> > 100 sessTimeOut session timed out
> > 195 maxCallDurationReached max connect time reached
> >
> > Another thing to be aware of, the Ascend-Disconnect-Cause of 1 is
listed
> as
> > not being used or N/A, however if a user is disconnected by "hanging
up"
> > the user from the Max "90-100 Sessions" console window, the stop record
> > displays an Ascend-Disconnect-Cause = 1.
> > Should this be 151?
> >
> > 151 localAdmin disconnect requested by the local administrator
> >
> > Because the listing of Ascend-Disconnect-Causes hasn t been updated on
> the
> > website (http://www.ascend.com/service/technotes/discode.html), I
> attached
> > the listing that I have, which I converted into ASCII from a fax that
> > someone in the Radius area of Ascend faxed me a couple of months ago.
> >
> > Thanks,
> >
> > Josh Hillman
> > TalStar Communications
> >
> >
> > Ascend-Disconnect-Causes
> > ------------------------
> >
> > 1 notApplicable
> > 2 unknown reason unknown
> > 3 disconnected call disconnected
> > 4 clidAuthFailed CLID auth failed
> > 5 clidAuthServTimeout RADIUS timeout during CLID
> > authentication
> >
> > Modem connections
> >
> > 10 noModemNoCarrier no carrier detected ever
> > 11 noModemLossCarrier DCD detected but went inactive
> > 12 noModemResultCodes fail to detect modem result codes
> >
> > Terminal server sessions
> >
> > 20 tsUserExit user exited terminal server
> > 21 tsIdleTimeout timeout waiting for user input
> > 22 tsExitTelnet disconnect due to exiting telnet
> > 23 tsNoIPAddr could not switch to SLIP/PPP; remote
> > has no IP address or could not assign
> > one
> > 24 tsExitTcp disconnect due to exiting raw TCP
> > 25 tsPassWordFail bad passwords
> > 26 tsRawTCPDisable raw TCP disabled
> > 27 tsControlC control-C char detected
> > 28 tsDestroyed terminal server destroyed
> > 29 tsClosedVirtualConnect user terminated a virtual cnnection
> > to a modem
> > 30 tsVirtualConnectDestroyed a virtual connection to a modem was
> > terminated but not by user
> > 31 tsExitRlogin rlogin done
> > 32 tsRloginBadOption bad rlogin command line option
> > 33 tsErrorResource not enough resources
> > 35 mpNullMessageTimeout failed to receive a NULL MP message
> >
> > PPP sessions
> >
> > 40 pppLcpTimeout PPP LCP negotiation timed out
> > 41 pppLcpNegotiateFail PPP LCP negotiation failed
> > 42 pppPAPAuthFail PPP PAP authentication failed
> > 43 pppCHAPAuthFail PPP CHAP authentication failed
> > 44 pppRemoteAuthFail PPP remote authentication failed
> > 45 pppRcvTerminate PPP receive Terminate Request from
> > far end
> > 46 pppCloseEvent upper layer requested a Close
> >
> > Normal or graceful disconnects
> >
> > 47 pppCloseNoNcpsOpened LCP closed because no NCPs were
> > opened (e.g. NCP negotiation failed)
> > 48 pppCloseUnknownMpBundle LCP closed because could not
> > determine which MP bundle to add
> > user to
> > 49 pppCloseMpAddChanFail LCP closed because could not add more
> > channels to MP session
> >
> > Immediate TCP/telnet disconnect reasons
> >
> > 50 tsExitErrTooMany session tables full
> > 51 tsExitErrResource resources full
> > 52 tsExitErrInvalidIP IP address is invalid
> > 53 tsExitErrHostName cannot resolve hostname
> > 54 tsExitErrBadPort bad or missing port number
> > 60 tsExitErrHostReset host reset
> > 61 tsExitErrConnRefused connection was refused
> > 62 tsExitErrTimedOut connection timed out
> > 63 tsExitErrClosed connection closed by foreign host
> > 64 tsExitErrNetUnreach network unreachable
> > 65 tsExitErrHostUnreach host unreachable
> > 66 tsExitErrNetAdminUnreach network administratively unreachable
> > 67 tsExitErrHostAdminUnreach host administratively unreachable
> > 68 tsExitErrPortUnreach port unreachable
> >
> > Misc reasons
> >
> > 100 sessTimeOut session timed out
> > 101 sessFailSecurity session failed for security reasons
> > (e.g. incoming call for a call-out
> > only profile)
> > 102 sessCallback session terminated due to callback
> > 120 invalidProtocol call refused, detected protocol is
> > disabled
> > 150 requestByRadiusClient disconnect requested by a RADIUS
> > client
> > 151 localAdmin disconnect requested by the local
> > administrator
> > 160 v110Timeout timeout, resync retries exceeded
> > 170 pppAuthTimeout timeout waiting trying to authenticate
> > 180 userCallClearRequest user performed call clear via
> > Do Hangup
> > 185 remoteEndHungUp signal loss from remote end
> > 190 resourceQuiesced resource has been quiesced
> > 195 maxCallDurationReached max connect time reached