FastPCRF settings
RADIUS Accounting packages are sent by default to 1813 RADIUS server port. You can specify a different port globally for all the RADIUS servers or specifically for a given RADIUS server:
radius_acct_portoption defined in the fastpcrf.conf configuration file specifies the default accounting portacct_portoption is applied for a given RADIUS server:
radius_server=secret@192.168.200.1%eth1:1812;acct_port=34567
You can also specify a secret for RADIUS accounting for each server separately; this can be done using the
acct_secret option of radius_server parameter:
radius_server=qwerty@192.168.200.1%eth1:1812;acct_port=34567;acct_secret=123456
The qwerty secret will be used for authorization requests in the example above, and 123456 will be used for the accounting ones.
The following additional parameters related to the RADIUS Accounting can be specified in the fastpcrf.conf
radius_max_acct_connect_count– the maximum number of connections used to transfer the accounting data, the default value is 2. Each connection can be used to handle no more than 256 requests simultaneously.
This parameter limits the maximum RADIUS server load.
radius_acct_interim_interval– the time interval, in seconds, for sending the interim accounting. The default value is 1800 seconds. The minimum allowed value is 60 seconds.
It should be noted that the time interval for sending interim statistics can be specified for each user separately using the Acct-Interim-Interval attribute containing within the Access-Accept/Access-Reject response to the Access-Request authorization request. Value 0 means that interim statistics will not be sent.
radius_acct_idle_timeout- [is added in the VAS Experts DPI 7.3] the time interval, in seconds, during which the data is unchanged. If within this time interval, there was no change in accounting data being sent by the fastdpi,then the accounting-session is considered to be closed since the idle time-out is exceeded. The default value is 1800 seconds. It should be noted that it is meaningless to set the parameter value less thannetflow_timeoutone.
acct_check_idle_mode- [is added in the VAS Experts DPI 7.4] The stop event control mode, is used to control the event when the data will be changed.
Valid values are the following:- 0 - within the
radius_acct_idle_timeoutthere is no changes in the incoming and outgoing traffic (this is the default value) - 1 - within the
radius_acct_idle_timeoutthere is no changes only in the outgoing traffic (there is no subscriber's activity).
Theacct_check_idle_mode=1mode allows to detect when the accounting session terminates even if the subscriber IP address is flooded with superfluous requests (for example, DDoS-attack).
acct_start_point- [is added in the VAS Experts DPI 7.4] The starting point of the accounting statistics:- 0 - since the last Stop (default value). This is the most accurate statistics;
- 1 - since the Start event.
When theacct_start_point=0is used within theacct_check_idle_mode=1mode all the "parasite" traffic being accumulated since the last Stop event will fall into new accounting session.
When theacct_start_point=1is used instead all the "parasite" traffic being accumulated since the last Stop event will be ignored.
Also, due to the time delays between accounting "activating" and the actual netflow statistics gathering, the outgoing traffic statistics may be slightly distorted (downwards).
acct_auth_sync- [SSG 8.1+] authorization and account synchronization. Disabled by default (no synchronization). Some billing systems (e.g. LanBilling) require the current account session to be closed before sending an Access-Request.
Theacct_auth_sync=1setting synchronizes the accting and authorization: when an auth-request arrives, the SSG closes the current acct session (sends acct Stop), waits for a response from Radius to acct Stop, and only then sends an Access-Request auth-request with the new acct sessionId. In addition, [SSG 9.2+] when closing an account session by idle timeout PCRF sends a notification to SSG about session closure; in this case SSG resets the authorization status, which further leads to subscriber reauthorization - sendingAccess-Request.
acct_disable_interim_update- prohibiting the sending of Interim-Updates.acct_disable_interim_update=0— by default, Interim-Update is sentacct_disable_interim_update=1— do not send an Interim-Update
Was this information helpful?