Настройка авторизации пользователей по MAC ONU на Accel

Версия билинга не ниже 2.8.16

Прошивка на FORA(ONU) должна быть не ниже 1.0.7. На 1.0.6 опция 82 не работает.

Включите отмеченные маркером опции.

В карте абонента необходимо прописать MAC ONU

[modules]
log_file
radius
ipoe
shaper
 
[common]
sid-source=urandom
seq-file=/var/lib/accel-ppp/seq
 
[core]
log-error=/var/log/accel-ppp/core.log
thread-count=4
 
[dns]
dns1=8.8.8.8
 
[radius]
dictionary=/usr/local/share/accel-ppp/radius/dictionary
nas-identifier=accel
nas-ip-address=127.0.0.1
server=127.0.0.1,testing123,auth-port=1812,acct-port=1813,req-limit=0,fail-time=0
dae-server=0.0.0.0:3799,testing123
verbose=100
timeout=3
max-try=3
acct-delay-time=100
 
[ipoe]
username=lua:username
lua-file=/etc/accel-ppp.lua
lease-time=300
max-lease-time=301
attr-dhcp-client-ip=Framed-IP-Address
attr-dhcp-router-ip=DHCP-Router-IP-Address
attr-dhcp-mask=DHCP-Mask
attr-l4-redirect=L4-Redirect
attr-l4-redirect-ipset=L4-Redirect-ipset
attr-dhcp-opt82-remote-id=AccelRemoteId
attr-dhcp-opt82-circuit-id=AccelCircuitId
l4-redirect-ipset=l4
ifcfg=1
start=dhcpv4
proto=100
shared=1
mode=L2
proxy-arp=1
interface=re:^vlan[1-3][0-9]$,shared=1,mode=L2,start=dhcpv4,ifcfg=1
verbose=100
 
[log]
log-file=/var/log/accel-ppp/accel-ppp.log
log-emerg=/var/log/accel-ppp/emerg.log
log-fail-file=/var/log/accel-ppp/auth-fail.log
log-debug=/var/log/accel-ppp/debug
#log-debug=/dev/stdout
copy=1
color=1
level=3
 
[shaper]
attr=Filter-Id
ifb=ifb0
up-limiter=htb
down-limiter=htb
cburst=1375000
r2q=10
quantum=1500
verbose=1
 
[cli]
verbose=0
telnet=127.0.0.1:2000
tcp=127.0.0.1:2001
 
[client-ip-range]
10.0.0.0/8

accel-ppp.lua

#!lua
function username(pkt)
v,b1,b2,b3,b4,b5,b6=string.unpack(pkt:agent_remote_id(),'bbbbbb')
return string.format("%02x:%02x:%02x:%02x:%02x:%02x", b1,b2,b3,b4,b5,b6)
end

Добавить на UPLINK:

interface GigaEthernet0/1
 description UPLINK
 switchport trunk vlan-allowed 1,1500
 switchport trunk vlan-untagged none
 switchport mode trunk
  dhcp snooping trust
  arp inspection trust
  ip-source trust

Включить ip dhcp-relay snooping

ip dhcp-relay snooping
ip dhcp-relay snooping vlan 1500
ip dhcp-relay snooping information option format hn-type

1500 - это клиентский VLAN.

Необходимо добавить в словарь радиуса /usr/share/freeradius/dictionary
и в словарь Accel /usr/local/share/accel-ppp/radius/dictionary атрибуты:

ATTRIBUTE DHCP-Router-IP-Address 241 ipaddr
ATTRIBUTE DHCP-Mask              242 integer
ATTRIBUTE L4-Redirect            243 integer
ATTRIBUTE L4-Redirect-ipset	 244 string
ATTRIBUTE DHCP-Option82          245 octets
ATTRIBUTE AccelRemoteId          246 octets
ATTRIBUTE AccelCircuitId         247 octets
ATTRIBUTE DHCP-Attr-272          272 ipaddr

После перезапуска Radius и Accel, клиент должен авторизоваться, а в сессиях Accel будет такая картина: