<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Ana,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>The notes in the proxy.conf file describe how proxying works
when you do not receive a response from a home server.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> #<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # If the home
server doesn't respond to the request within<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # this time,
this server will consider the request dead, and<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # respond to
the NAS with an Access-Reject.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> #<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # If NO
responses are received to any requests sent within this<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # time period,
the home server will be marked "zombie", as below.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> #<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # Useful range
of values: 5 to 60<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> response_window = 20<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> #<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # If the home
server does not respond to ANY packets for<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # a certain
time, consider it dead. This time period is<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # called the
"zombie" period, because the server is neither<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # alive nor
dead.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> #<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # If
"status_check" below is something other than "none", then<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # the server
will start sending status checks at the start of<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # the zombie
period. It will continue sending status checks<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # until the
home server is marked "alive".<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> #<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> # Useful range
of values: 20 to 120<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> zombie_period = 40<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>When a home server does not respond to an Access-Request, the
proxy process has failed and the default behavior is to reject the users Access-Request.
The proxy server marks the home server as a zombie and after another 40 seconds
has passed, the proxy server marks the home server as dead. Once a server is
marked dead, the proxy server will not send requests to that server. Access-Requests
that are sent to the proxy server after the home server is marked dead, will
skip the dead home server and fail-over to the next home server.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Since an Access-Reject is sent to the NAS, the NAS will deny the
user/device access. This will happen to all users/devices that try to
authenticate when the proxy server was marked alive but it is actually dead.
You can lessen the impact of a dead server by using type=load-balance instead
of fail-over for the home server pool.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>In 2.1.6 the server can be configured to not respond when it
does not receive a response from a home server. This will cause the NAS to retry
the request multiple times, which will eventually cause the proxy server to send
the request to the alive home server. Let me know if you want to try this and I
can send an example configuration.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Tim<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org
[mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org]
<b>On Behalf Of </b>Ana Gallardo<br>
<b>Sent:</b> Wednesday, June 24, 2009 11:40 PM<br>
<b>To:</b> freeradius-users@lists.freeradius.org<br>
<b>Subject:</b> response_window and zombie_period problem<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'>Hello, first of all, sorry for
my english.<br>
<br>
I'm testing Freeradius 2.0.4+dfsg-6 in Debian. I want to configure proxy like
this (proxy.conf):<br>
<br>
# radiusxx authentication<br>
home_server radiusxx_auth {<br>
type = auth<br>
ipaddr = 1.2.3.4<br>
port = 1812<br>
secret = secret<br>
response_window = 50<br>
zombie_period = 20<br>
status_check = request<br>
username = "user"<br>
password = "pass"<br>
check_interval = 30<br>
num_answers_to_alive = 3<br>
}<br>
<br>
# radiusxx accounting<br>
home_server radiusxx_acct {<br>
type = acct<br>
ipaddr = 1.2.3.4<br>
port = 1813<br>
secret = secret<br>
response_window = 50<br>
zombie_period = 20<br>
status_check = request<br>
username = "user"<br>
password = "pass"<br>
check_interval = 30<br>
num_answers_to_alive = 3<br>
}<br>
<br>
# radiusyy authentication<br>
home_server radiusyy_auth {<br>
type = auth<br>
ipaddr = 1.2.3.5<br>
port = 1812<br>
secret = secret<br>
response_window = 50<br>
zombie_period = 20<br>
status_check = request<br>
username = "user"<br>
password = "pass"<br>
check_interval = 30<br>
num_answers_to_alive = 3<br>
}<br>
<br>
# radiusyy accounting<br>
home_server radiusyy_acct {<br>
type = acct<br>
ipaddr = 1.2.3.5<br>
port = 1813<br>
secret = secret<br>
response_window = 50<br>
zombie_period = 20<br>
status_check = request<br>
username = "user"<br>
password = "pass"<br>
check_interval = 30<br>
num_answers_to_alive = 3<br>
}<br>
<br>
#authentication pool<br>
home_server_pool my_auth {<br>
type = fail-over<br>
home_server = radiusxx_auth<br>
home_server = radiusyy_auth<br>
}<br>
<br>
#accounting pool<br>
home_server_pool my_acct {<br>
type = fail-over<br>
home_server = radiusxx_acct<br>
home_server = radiusyy_acct<br>
}<br>
<br>
<br>
realm myrealm.my {<br>
auth_pool = my_auth<br>
acct_pool = my_acct<br>
# nostrip<br>
}<br>
<br>
<br>
My problem is when I'm going to test failover: I stop Freeradius in xx server
and I send a authentication request. <br>
<br>
Sending Access-Request of id 143 to 1.2.3.4 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2<br>
Proxy-State = 0x3238<br>
Proxying request 0 to home server 1.2.3.4 port 1812<br>
Sending Access-Request of id 143 to 1.2.3.4 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2<br>
Proxy-State = 0x3238<br>
Going to the next request<br>
Waking up in 0.9 seconds.<br>
Waking up in 28.9 seconds.<br>
rad_recv: Access-Request packet from host 1.2.2.2 port 39710, id=28, length=75<br>
Sending duplicate proxied request to home server 1.2.3.4 port 1812 - ID: 143<br>
Sending Access-Request of id 143 to 1.2.3.4 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2<br>
Proxy-State = 0x3238<br>
Waking up in 26.9 seconds.<br>
rad_recv: Access-Request packet from host 1.2.2.2 port 39710, id=28, length=75<br>
Sending duplicate proxied request to home server 1.2.3.4 port 1812 - ID: 143<br>
Sending Access-Request of id 143 to 1.2.3.4 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2<br>
Proxy-State = 0x3238<br>
Waking up in 23.9 seconds.<br>
. . .<br>
WARNING: Marking home server 1.2.3.4 port 1812 as zombie (it looks like it is
dead).<br>
<br>
After 30 seconds I always get an accept_reject the first time. But if my
zombie_period = 20, don't must mark radiusxx as zombie after 20 seconds and
proxy my request to radiusyy. My response_window = 50 and Freeradius must
wait 50 seconds before consider the request dead. <br>
<br>
Then, when I send another authentication request:<br>
<br>
Sending Access-Request of id 129 to 1.2.3.4 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2<br>
Proxy-State = 0x31<br>
Proxying request 1 to home server 1.2.3.4 port 1812<br>
Sending Access-Request of id 129 to 1.2.3.4 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2<br>
Proxy-State = 0x31<br>
Going to the next request<br>
Waking up in 0.9 seconds.<br>
Waking up in 28.9 seconds.<br>
rad_recv: Access-Request packet from host 1.2.2.2 port 59850, id=1, length=75<br>
FAILURE: Marking home server 1.2.3.4 port 1812 as dead.<br>
Sending Access-Request of id 118 to 1.2.3.5 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2 <br>
Proxy-State = 0x31<br>
Proxying request 1 to home server 1.2.3.5 port 1812<br>
Sending Access-Request of id 118 to 1.2.3.5 port 1812<br>
User-Name = "mmmm"<br>
User-Password = "111"<br>
Calling-Station-Id = "00:11:22:33:44:55"<br>
NAS-IP-Address = 1.2.2.2 <br>
Proxy-State = 0x31<br>
Waking up in 26.9 seconds.<br>
rad_recv: Access-Accept packet from host 1.2.3.5 port 1812, id=118, length=23<br>
Proxy-State = 0x31<br>
<br>
<br>
I don't know why Freeradius doesn't send me an acces-accept, when I send the
first request, after mark radiusxx (zombie_period = 20) as zombie and proxy the
request to radiusyy.<br>
<br>
Thank you and sorry for my english.<br>
<br>
<br>
<br>
<br>
<br>
<br>
<o:p></o:p></p>
</div>
</div>
</body>
</html>