<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>During a recent network incident we had some very high churn
in PPP clients. Our NASes (Multiple Cisco 7200 as VPDN LNS) didn’t appear
to be able to authenticate as quickly as they needed to. In the Radius packet
logs we see quite a few Rejects for requests that should have been OK –
indeed the identical requests were repeated and answered correctly seconds
afterwards.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>In the radius log itself we have quite a few of these:-<o:p></o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Mon
Jul 27 22:51:24 2009 : Info: rlm_sql (sql): There are no DB handles to use!
skipped 0, tried to connect 0</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Mon Jul 27
22:51:25 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0,
tried to connect 0</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Mon Jul 27
22:51:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0,
tried to connect 0</span> <br>
<br>
<o:p></o:p></p>
<p class=MsoNormal>From the archives the usual reason for the above would seem
to be the MySQL database not answering quickly enough. The relevant freeradius configs
are at the defaults – but the box(s) themselves don’t appear to
have struggled with CPU.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Would getting that error in the logs result in valid authentication
requests being rejected ?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Unfortunately I’m not very experienced in MySQL to be
able to tune it. Would increasing the number of “num_sql_socks”
within the sql.conf from the default 5 be a good starting point ? Are there
other FreeRadius configs I can adjust before moving onto the MySQL database
itself ?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thanks<o:p></o:p></p>
<p class=MsoNormal>Dean<o:p></o:p></p>
</div>
</body>
</html>