When RADIUS accounting uses a different server from the RADIUS authentication servers, the accounting server and its key are never written to /run/ocserv/radius_servers.
radiusclient.conf still has acctserver <ip>, so radcli has an accounting server with no shared secret, and accounting fails with "no secret for server".
Authentication is not affected.
Configuration:
set vpn openconnect accounting mode radius set vpn openconnect accounting radius server 127.0.0.1 key 'foo' set vpn openconnect authentication mode radius set vpn openconnect authentication radius server 127.0.0.2 key 'bar' set vpn openconnect authentication radius server 127.0.0.8 key 'bar8' set vpn openconnect ssl ca-certificate 'ca' set vpn openconnect ssl certificate 'cert'
Actual result:
vyos@r14# cat /run/ocserv/radius_servers ### generated by vpn_openconnect.py ### # server key 127.0.0.2 bar 127.0.0.8 bar8
Expected result:
### generated by vpn_openconnect.py ### # server key 127.0.0.1 foo 127.0.0.2 bar 127.0.0.8 bar8