{{indexmenu_n>6}}
====== Mirroring RADIUS Traffic via a GRE Tunnel ======
 
This guide describes how to configure the BNG to copy RADIUS traffic into a GRETAP tunnel towards a separate server, for example, for analysis or for saving to a pcap file. Mirroring is performed with ''tc'' (the ''flower'' classifier and the ''mirred'' action) and does not affect the original traffic.
 
This guide covers a specific case: only accounting traffic (UDP port 1813) is mirrored, and only to one server. To mirror other ports or send copies to other servers, add the required filters and parameters to the script.

===== Example parameters =====

^ Variable ^ Value ^ Description ^
| ''IF'' | ens18 | BNG interface that carries RADIUS traffic |
| ''LOCAL'' | 10.16.20.226 | BNG address — local end of the tunnel |
| ''REMOTE'' | 10.16.20.225 | Address of the server that receives the mirrored traffic |
| ''PEER'' | 10.16.20.231 | Address of the RADIUS server whose traffic is mirrored |
| ''TUN'' | gre-mirror | GRETAP interface name |

Before running the script, we recommend replacing these values with ones that match your network.

=== Step 1. Create the script ===

Create the file ''/usr/local/bin/bng_mirror_radius.sh'':

<code bash bng_mirror_radius.sh>
#!/bin/bash
# Mirror RADIUS accounting (udp/1813) between 10.16.20.226 <-> 10.16.20.231 to GRETAP towards 10.16.20.225
set -e

IF=ens18
LOCAL=10.16.20.226
REMOTE=10.16.20.225
PEER=10.16.20.231
TUN=gre-mirror

start() {
  modprobe ip_gre; modprobe cls_flower; modprobe act_mirred

  ip link add $TUN type gretap local $LOCAL remote $REMOTE ttl 64
  ip link set $TUN up

  tc qdisc add dev $IF clsact

  # Incoming from 231 (requests to 1813 or responses from 1813)
  tc filter add dev $IF ingress protocol ip prio 1 flower ip_proto udp src_ip $PEER dst_port 1813 \
     action mirred egress mirror dev $TUN
  tc filter add dev $IF ingress protocol ip prio 2 flower ip_proto udp src_ip $PEER src_port 1813 \
     action mirred egress mirror dev $TUN

  # Outgoing to 231
  tc filter add dev $IF egress protocol ip prio 1 flower ip_proto udp dst_ip $PEER dst_port 1813 \
     action mirred egress mirror dev $TUN
  tc filter add dev $IF egress protocol ip prio 2 flower ip_proto udp dst_ip $PEER src_port 1813 \
     action mirred egress mirror dev $TUN
}

stop() {
  tc qdisc del dev $IF clsact 2>/dev/null || true
  ip link del $TUN 2>/dev/null || true
}

case "$1" in
  start) start ;;
  stop)  stop ;;
  restart) stop; start ;;
  *) echo "Usage: $0 {start|stop|restart}"; exit 1 ;;
esac
</code>

=== Step 2. Make the script executable ===

<code bash>
chmod +x /usr/local/bin/bng_mirror_radius.sh
</code>

=== Step 3. Create a systemd unit ===

Create the file ''/etc/systemd/system/bng_mirror_radius.service'':

<code ini bng_mirror_radius.service>
[Unit]
Description=Mirror RADIUS accounting via GRETAP
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/bng_mirror_radius.sh start
ExecStop=/usr/local/bin/bng_mirror_radius.sh stop

[Install]
WantedBy=multi-user.target
</code>

=== Step 4. Start the service ===

Reload the systemd configuration and start the service:

<code bash>
systemctl daemon-reload
systemctl start bng_mirror_radius.service
</code>

To enable mirroring automatically after a reboot, add the service to startup:

<code bash>
systemctl enable bng_mirror_radius.service
</code>

=== Verification ===

On the BNG, make sure the tunnel is up and the filters are added:

<code bash>
ip -d link show gre-mirror
tc filter show dev ens18 ingress
tc filter show dev ens18 egress
</code>

On the receiving server (10.16.20.225), check that GRE traffic is arriving:

<code bash>
tcpdump -ni <interface> proto gre
</code>

=== Traffic example ===

Sample capture of mirrored traffic: {{en:dpi:bras_bng:radius_integration:radius_accounting:gre_radius.pcap|gre_radius.pcap}}