<div dir="ltr">Hello,<div><br></div><div>I'm working to setup a proxy load balance to 3 production RADIUS servers from a CentOS server running freeradius 2.1.12. I believe I have the proxy.conf file setup correctly but there seems to be no load balancing. All the requests are going to one of the three servers. I have attached the proxy.conf file and also the radius debug. I don't see any errors, it just appears the client-balance is not working. Clients are using MAB and are matching the NULL realm. I have looked through all the past posts and can't seem to find an answer. Am I missing something in my configuration?</div>
<div><br></div><div>Thanks.</div><div><br></div><div><br></div><div><br></div><div> # -*- text -*-</div><div>##</div><div>## proxy.conf -- proxy radius and realm configuration directives</div><div>##</div><div>##<span class="" style="white-space:pre"> </span>$Id$</div>
<div><br></div><div>#######################################################################</div><div>#</div><div># Proxy server configuration</div><div>#</div><div><br></div><div>proxy server {</div><div><span class="" style="white-space:pre"> </span>default_fallback = no</div>
<div>}</div><div><br></div><div>home_server server0007 {</div><div><span class="" style="white-space:pre"> </span>type = auth+acct</div><div><span class="" style="white-space:pre"> </span>ipaddr = xxx.xxx.xxx.150</div><div>
<span class="" style="white-space:pre"> </span>port = 1812</div><div><span class="" style="white-space:pre"> </span>secret = secret</div><div>}</div><div>home_server server0011 {</div><div><span class="" style="white-space:pre"> </span>type = auth+acct</div>
<div><span class="" style="white-space:pre"> </span>ipaddr = xxx.xxx.xxx.152</div><div><span class="" style="white-space:pre"> </span>port = 1812</div><div><span class="" style="white-space:pre"> </span>secret = secret</div>
<div>}</div><div>home_server server0012 {</div><div><span class="" style="white-space:pre"> </span>type = auth+acct</div><div><span class="" style="white-space:pre"> </span>ipaddr = xxx.xxx.xxx.153</div><div><span class="" style="white-space:pre"> </span>port = 1812</div>
<div><span class="" style="white-space:pre"> </span>secret = secret</div><div>}</div><div><br></div><div>home_server localhost {</div><div><span class="" style="white-space:pre"> </span>type = auth</div><div><span class="" style="white-space:pre"> </span>ipaddr = 127.0.0.1</div>
<div><span class="" style="white-space:pre"> </span>port = 1812</div><div><span class="" style="white-space:pre"> </span>secret = secret</div><div><span class="" style="white-space:pre"> </span>require_message_authenticator = yes</div>
<div><span class="" style="white-space:pre"> </span>response_window = 20</div><div><span class="" style="white-space:pre"> </span>zombie_period = 40</div><div><span class="" style="white-space:pre"> </span>revive_interval = 120</div>
<div><span class="" style="white-space:pre"> </span>status_check = status-server</div><div><span class="" style="white-space:pre"> </span>check_interval = 30</div><div><span class="" style="white-space:pre"> </span>num_answers_to_alive = 3</div>
<div><span class="" style="white-space:pre"> </span>max_outstanding = 65536</div><div><span class="" style="white-space:pre"> </span>coa {</div><div><span class="" style="white-space:pre"> </span>irt = 2</div><div><span class="" style="white-space:pre"> </span>mrt = 16</div>
<div><span class="" style="white-space:pre"> </span>mrc = 5</div><div><span class="" style="white-space:pre"> </span>mrd = 30</div><div><span class="" style="white-space:pre"> </span>}</div><div>}</div><div><br></div><div>
home_server_pool auth_loadbalance {</div><div><span class="" style="white-space:pre"> </span>type = client-balance</div><div><span class="" style="white-space:pre"> </span>home_server = server0007</div><div><span class="" style="white-space:pre"> </span>home_server = server0011</div>
<div><span class="" style="white-space:pre"> </span>home_server = server0012</div><div>}</div><div><br></div><div><br></div><div>realm <a href="http://example.com">example.com</a> {</div><div><span class="" style="white-space:pre"> </span>pool = auth_loadbalance</div>
<div>}</div><div><br></div><div>realm LOCAL {</div><div>}</div><div><br></div><div>realm NULL {</div><div><span class="" style="white-space:pre"> </span>type = radius</div><div><span class="" style="white-space:pre"> </span>pool = auth_loadbalance</div>
<div> secret = secret</div><div>}</div><div><br></div><div>realm DEFAULT {</div><div><span class="" style="white-space:pre"> </span>type = radius</div><div><span class="" style="white-space:pre"> </span>pool = auth_loadbalance</div>
<div> secret = secret</div><div>}</div><div><br></div><div>______________________________________________________________</div><div><br></div><div><br></div><div><div>FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51</div>
<div>Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. </div><div>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A </div><div>PARTICULAR PURPOSE. </div><div>You may redistribute copies of FreeRADIUS under the terms of the </div>
<div>GNU General Public License v2. </div><div>Starting - reading configuration files ...</div><div>including configuration file /etc/raddb/radiusd.conf</div><div>including configuration file /etc/raddb/proxy.conf</div><div>
including configuration file /etc/raddb/clients.conf</div><div>including files in directory /etc/raddb/modules/</div><div>including configuration file /etc/raddb/modules/replicate</div><div>including configuration file /etc/raddb/modules/logintime</div>
<div>including configuration file /etc/raddb/modules/otp</div><div>including configuration file /etc/raddb/modules/files</div><div>including configuration file /etc/raddb/modules/detail</div><div>including configuration file /etc/raddb/modules/chap</div>
<div>including configuration file /etc/raddb/modules/cui</div><div>including configuration file /etc/raddb/modules/digest</div><div>including configuration file /etc/raddb/modules/realm</div><div>including configuration file /etc/raddb/modules/exec</div>
<div>including configuration file /etc/raddb/modules/attr_rewrite</div><div>including configuration file /etc/raddb/modules/detail.log</div><div>including configuration file /etc/raddb/modules/checkval</div><div>including configuration file /etc/raddb/modules/pam</div>
<div>including configuration file /etc/raddb/modules/linelog</div><div>including configuration file /etc/raddb/modules/expiration</div><div>including configuration file /etc/raddb/modules/sql_log</div><div>including configuration file /etc/raddb/modules/pap</div>
<div>including configuration file /etc/raddb/modules/rediswho</div><div>including configuration file /etc/raddb/modules/preprocess</div><div>including configuration file /etc/raddb/modules/inner-eap</div><div>including configuration file /etc/raddb/modules/sradutmp</div>
<div>including configuration file /etc/raddb/modules/wimax</div><div>including configuration file /etc/raddb/modules/expr</div><div>including configuration file /etc/raddb/modules/unix</div><div>including configuration file /etc/raddb/modules/attr_filter</div>
<div>including configuration file /etc/raddb/modules/policy</div><div>including configuration file /etc/raddb/modules/smsotp</div><div>including configuration file /etc/raddb/modules/passwd</div><div>including configuration file /etc/raddb/modules/acct_unique</div>
<div>including configuration file /etc/raddb/modules/ntlm_auth</div><div>including configuration file /etc/raddb/modules/mac2ip</div><div>including configuration file /etc/raddb/modules/smbpasswd</div><div>including configuration file /etc/raddb/modules/opendirectory</div>
<div>including configuration file /etc/raddb/modules/soh</div><div>including configuration file /etc/raddb/modules/dynamic_clients</div><div>including configuration file /etc/raddb/modules/mschap</div><div>including configuration file /etc/raddb/modules/etc_group</div>
<div>including configuration file /etc/raddb/modules/perl</div><div>including configuration file /etc/raddb/modules/sqlcounter_expire_on_login</div><div>including configuration file /etc/raddb/modules/always</div><div>including configuration file /etc/raddb/modules/counter</div>
<div>including configuration file /etc/raddb/modules/mac2vlan</div><div>including configuration file /etc/raddb/modules/<a href="http://detail.example.com">detail.example.com</a></div><div>including configuration file /etc/raddb/modules/SAConnector</div>
<div>including configuration file /etc/raddb/modules/redis</div><div>including configuration file /etc/raddb/modules/echo</div><div>including configuration file /etc/raddb/modules/radutmp</div><div>including configuration file /etc/raddb/modules/ippool</div>
<div>including configuration file /etc/raddb/eap.conf</div><div>including configuration file /etc/raddb/policy.conf</div><div>including files in directory /etc/raddb/sites-enabled/</div><div>including configuration file /etc/raddb/sites-enabled/default</div>
<div>including configuration file /etc/raddb/sites-enabled/control-socket</div><div>main {</div><div><span class="" style="white-space:pre"> </span>user = "radiusd"</div><div><span class="" style="white-space:pre"> </span>group = "radiusd"</div>
<div><span class="" style="white-space:pre"> </span>allow_core_dumps = no</div><div>}</div><div>including dictionary file /etc/raddb/dictionary</div><div>main {</div><div><span class="" style="white-space:pre"> </span>name = "radiusd"</div>
<div><span class="" style="white-space:pre"> </span>prefix = "/usr"</div><div><span class="" style="white-space:pre"> </span>localstatedir = "/var"</div><div><span class="" style="white-space:pre"> </span>sbindir = "/usr/sbin"</div>
<div><span class="" style="white-space:pre"> </span>logdir = "/var/log/radius"</div><div><span class="" style="white-space:pre"> </span>run_dir = "/var/run/radiusd"</div><div><span class="" style="white-space:pre"> </span>libdir = "/usr/lib64/freeradius"</div>
<div><span class="" style="white-space:pre"> </span>radacctdir = "/var/log/radius/radacct"</div><div><span class="" style="white-space:pre"> </span>hostname_lookups = no</div><div><span class="" style="white-space:pre"> </span>max_request_time = 30</div>
<div><span class="" style="white-space:pre"> </span>cleanup_delay = 5</div><div><span class="" style="white-space:pre"> </span>max_requests = 1024</div><div><span class="" style="white-space:pre"> </span>pidfile = "/var/run/radiusd/radiusd.pid"</div>
<div><span class="" style="white-space:pre"> </span>checkrad = "/usr/sbin/checkrad"</div><div><span class="" style="white-space:pre"> </span>debug_level = 0</div><div><span class="" style="white-space:pre"> </span>proxy_requests = yes</div>
<div> log {</div><div><span class="" style="white-space:pre"> </span>stripped_names = no</div><div><span class="" style="white-space:pre"> </span>auth = no</div><div><span class="" style="white-space:pre"> </span>auth_badpass = no</div>
<div><span class="" style="white-space:pre"> </span>auth_goodpass = no</div><div> }</div><div> security {</div><div><span class="" style="white-space:pre"> </span>max_attributes = 200</div><div><span class="" style="white-space:pre"> </span>reject_delay = 1</div>
<div><span class="" style="white-space:pre"> </span>status_server = yes</div><div> }</div><div>}</div><div>radiusd: #### Loading Realms and Home Servers ####</div><div> proxy server {</div><div><span class="" style="white-space:pre"> </span>retry_delay = 5</div>
<div><span class="" style="white-space:pre"> </span>retry_count = 3</div><div><span class="" style="white-space:pre"> </span>default_fallback = no</div><div><span class="" style="white-space:pre"> </span>dead_time = 120</div>
<div><span class="" style="white-space:pre"> </span>wake_all_if_all_dead = no</div><div> }</div><div> home_server server0007 {</div><div><span class="" style="white-space:pre"> </span>ipaddr = xxx.xxx.xxx.150</div><div><span class="" style="white-space:pre"> </span>port = 1812</div>
<div><span class="" style="white-space:pre"> </span>type = "auth+acct"</div><div><span class="" style="white-space:pre"> </span>secret = "secret"</div><div><span class="" style="white-space:pre"> </span>response_window = 30</div>
<div><span class="" style="white-space:pre"> </span>max_outstanding = 65536</div><div><span class="" style="white-space:pre"> </span>zombie_period = 40</div><div><span class="" style="white-space:pre"> </span>status_check = "none"</div>
<div><span class="" style="white-space:pre"> </span>ping_interval = 30</div><div><span class="" style="white-space:pre"> </span>check_interval = 30</div><div><span class="" style="white-space:pre"> </span>num_answers_to_alive = 3</div>
<div><span class="" style="white-space:pre"> </span>num_pings_to_alive = 3</div><div><span class="" style="white-space:pre"> </span>revive_interval = 300</div><div><span class="" style="white-space:pre"> </span>status_check_timeout = 4</div>
<div> }</div><div> home_server server0011 {</div><div><span class="" style="white-space:pre"> </span>ipaddr = xxx.xxx.xxx.152</div><div><span class="" style="white-space:pre"> </span>port = 1812</div><div><span class="" style="white-space:pre"> </span>type = "auth+acct"</div>
<div><span class="" style="white-space:pre"> </span>secret = "secret"</div><div><span class="" style="white-space:pre"> </span>response_window = 30</div><div><span class="" style="white-space:pre"> </span>max_outstanding = 65536</div>
<div><span class="" style="white-space:pre"> </span>zombie_period = 40</div><div><span class="" style="white-space:pre"> </span>status_check = "none"</div><div><span class="" style="white-space:pre"> </span>ping_interval = 30</div>
<div><span class="" style="white-space:pre"> </span>check_interval = 30</div><div><span class="" style="white-space:pre"> </span>num_answers_to_alive = 3</div><div><span class="" style="white-space:pre"> </span>num_pings_to_alive = 3</div>
<div><span class="" style="white-space:pre"> </span>revive_interval = 300</div><div><span class="" style="white-space:pre"> </span>status_check_timeout = 4</div><div> }</div><div> home_server server0012 {</div><div><span class="" style="white-space:pre"> </span>ipaddr = xxx.xxx.xxx.153</div>
<div><span class="" style="white-space:pre"> </span>port = 1812</div><div><span class="" style="white-space:pre"> </span>type = "auth+acct"</div><div><span class="" style="white-space:pre"> </span>secret = "secret"</div>
<div><span class="" style="white-space:pre"> </span>response_window = 30</div><div><span class="" style="white-space:pre"> </span>max_outstanding = 65536</div><div><span class="" style="white-space:pre"> </span>zombie_period = 40</div>
<div><span class="" style="white-space:pre"> </span>status_check = "none"</div><div><span class="" style="white-space:pre"> </span>ping_interval = 30</div><div><span class="" style="white-space:pre"> </span>check_interval = 30</div>
<div><span class="" style="white-space:pre"> </span>num_answers_to_alive = 3</div><div><span class="" style="white-space:pre"> </span>num_pings_to_alive = 3</div><div><span class="" style="white-space:pre"> </span>revive_interval = 300</div>
<div><span class="" style="white-space:pre"> </span>status_check_timeout = 4</div><div> }</div><div> home_server_pool auth_loadbalance {</div><div><span class="" style="white-space:pre"> </span>type = client-balance</div>
<div><span class="" style="white-space:pre"> </span>home_server = server0007</div><div><span class="" style="white-space:pre"> </span>home_server = server0011</div><div><span class="" style="white-space:pre"> </span>home_server = server0012</div>
<div> }</div><div> realm <a href="http://example.com">example.com</a> {</div><div><span class="" style="white-space:pre"> </span>pool = auth_loadbalance</div><div> }</div><div> realm LOCAL {</div><div> }</div><div> realm NULL {</div>
<div><span class="" style="white-space:pre"> </span>pool = auth_loadbalance</div><div>WARNING: Ignoring old-style configuration entry "secret" in realm "NULL"</div><div> }</div><div> realm DEFAULT {</div>
<div><span class="" style="white-space:pre"> </span>pool = auth_loadbalance</div><div>WARNING: Ignoring old-style configuration entry "secret" in realm "DEFAULT"</div><div> }</div><div>radiusd: #### Loading Clients ####</div>
<div> client localhost {</div><div><span class="" style="white-space:pre"> </span>ipaddr = 127.0.0.1</div><div><span class="" style="white-space:pre"> </span>require_message_authenticator = no</div><div><span class="" style="white-space:pre"> </span>secret = "secret"</div>
<div><span class="" style="white-space:pre"> </span>nastype = "other"</div><div> }</div><div> client xxx.xxx.xxx.116 {</div><div><span class="" style="white-space:pre"> </span>require_message_authenticator = no</div>
<div><span class="" style="white-space:pre"> </span>secret = "secret"</div><div><span class="" style="white-space:pre"> </span>shortname = "shortname"</div><div> }</div><div> client xxx.xxx.xxx.137 {</div>
<div><span class="" style="white-space:pre"> </span>require_message_authenticator = no</div><div><span class="" style="white-space:pre"> </span>secret = "secret"</div><div><span class="" style="white-space:pre"> </span>shortname = "othershortname"</div>
<div> }</div><div>radiusd: #### Instantiating modules ####</div><div> instantiate {</div><div> Module: Linked to module rlm_exec</div><div> Module: Instantiating module "exec" from file /etc/raddb/modules/exec</div>
<div> exec {</div><div><span class="" style="white-space:pre"> </span>wait = no</div><div><span class="" style="white-space:pre"> </span>input_pairs = "request"</div><div><span class="" style="white-space:pre"> </span>shell_escape = yes</div>
<div> }</div><div> Module: Linked to module rlm_expr</div><div> Module: Instantiating module "expr" from file /etc/raddb/modules/expr</div><div> Module: Linked to module rlm_expiration</div><div> Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration</div>
<div> expiration {</div><div><span class="" style="white-space:pre"> </span>reply-message = "Password Has Expired "</div><div> }</div><div> Module: Linked to module rlm_logintime</div><div> Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime</div>
<div> logintime {</div><div><span class="" style="white-space:pre"> </span>reply-message = "You are calling outside your allowed timespan "</div><div><span class="" style="white-space:pre"> </span>minimum-timeout = 60</div>
<div> }</div><div> }</div><div>radiusd: #### Loading Virtual Servers ####</div><div>server { # from file /etc/raddb/radiusd.conf</div><div> modules {</div><div> Module: Creating Auth-Type = digest</div><div> Module: Creating Post-Auth-Type = REJECT</div>
<div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Linked to module rlm_pap</div><div> Module: Instantiating module "pap" from file /etc/raddb/modules/pap</div><div> pap {</div>
<div><span class="" style="white-space:pre"> </span>encryption_scheme = "auto"</div><div><span class="" style="white-space:pre"> </span>auto_header = no</div><div> }</div><div> Module: Linked to module rlm_chap</div>
<div> Module: Instantiating module "chap" from file /etc/raddb/modules/chap</div><div> Module: Linked to module rlm_mschap</div><div> Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap</div>
<div> mschap {</div><div><span class="" style="white-space:pre"> </span>use_mppe = yes</div><div><span class="" style="white-space:pre"> </span>require_encryption = no</div><div><span class="" style="white-space:pre"> </span>require_strong = no</div>
<div><span class="" style="white-space:pre"> </span>with_ntdomain_hack = no</div><div><span class="" style="white-space:pre"> </span>allow_retry = yes</div><div> }</div><div> Module: Linked to module rlm_digest</div><div>
Module: Instantiating module "digest" from file /etc/raddb/modules/digest</div><div> Module: Linked to module rlm_unix</div><div> Module: Instantiating module "unix" from file /etc/raddb/modules/unix</div>
<div> unix {</div><div><span class="" style="white-space:pre"> </span>radwtmp = "/var/log/radius/radwtmp"</div><div> }</div><div> Module: Checking authorize {...} for more modules to load</div><div> Module: Linked to module rlm_preprocess</div>
<div> Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess</div><div> preprocess {</div><div><span class="" style="white-space:pre"> </span>huntgroups = "/etc/raddb/huntgroups"</div>
<div><span class="" style="white-space:pre"> </span>hints = "/etc/raddb/hints"</div><div><span class="" style="white-space:pre"> </span>with_ascend_hack = no</div><div><span class="" style="white-space:pre"> </span>ascend_channels_per_line = 23</div>
<div><span class="" style="white-space:pre"> </span>with_ntdomain_hack = no</div><div><span class="" style="white-space:pre"> </span>with_specialix_jetstream_hack = no</div><div><span class="" style="white-space:pre"> </span>with_cisco_vsa_hack = no</div>
<div><span class="" style="white-space:pre"> </span>with_alvarion_vsa_hack = no</div><div> }</div><div> Module: Linked to module rlm_realm</div><div> Module: Instantiating module "suffix" from file /etc/raddb/modules/realm</div>
<div> realm suffix {</div><div><span class="" style="white-space:pre"> </span>format = "suffix"</div><div><span class="" style="white-space:pre"> </span>delimiter = "@"</div><div><span class="" style="white-space:pre"> </span>ignore_default = no</div>
<div><span class="" style="white-space:pre"> </span>ignore_null = no</div><div> }</div><div> Module: Linked to module rlm_files</div><div> Module: Instantiating module "files" from file /etc/raddb/modules/files</div>
<div> files {</div><div><span class="" style="white-space:pre"> </span>usersfile = "/etc/raddb/users"</div><div><span class="" style="white-space:pre"> </span>acctusersfile = "/etc/raddb/acct_users"</div>
<div><span class="" style="white-space:pre"> </span>preproxy_usersfile = "/etc/raddb/preproxy_users"</div><div><span class="" style="white-space:pre"> </span>compat = "no"</div><div> }</div><div> Module: Checking preacct {...} for more modules to load</div>
<div> Module: Linked to module rlm_acct_unique</div><div> Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique</div><div> acct_unique {</div><div><span class="" style="white-space:pre"> </span>key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"</div>
<div> }</div><div> Module: Checking accounting {...} for more modules to load</div><div> Module: Linked to module rlm_detail</div><div> Module: Instantiating module "detail" from file /etc/raddb/modules/detail</div>
<div> detail {</div><div><span class="" style="white-space:pre"> </span>detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"</div><div><span class="" style="white-space:pre"> </span>header = "%t"</div>
<div><span class="" style="white-space:pre"> </span>detailperm = 384</div><div><span class="" style="white-space:pre"> </span>dirperm = 493</div><div><span class="" style="white-space:pre"> </span>locking = no</div><div>
<span class="" style="white-space:pre"> </span>log_packet_header = no</div>
<div> }</div><div> Module: Linked to module rlm_radutmp</div><div> Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp</div><div> radutmp {</div><div><span class="" style="white-space:pre"> </span>filename = "/var/log/radius/radutmp"</div>
<div><span class="" style="white-space:pre"> </span>username = "%{User-Name}"</div><div><span class="" style="white-space:pre"> </span>case_sensitive = yes</div><div><span class="" style="white-space:pre"> </span>check_with_nas = yes</div>
<div><span class="" style="white-space:pre"> </span>perm = 384</div><div><span class="" style="white-space:pre"> </span>callerid = yes</div><div> }</div><div> Module: Checking session {...} for more modules to load</div>
<div> Module: Checking post-auth {...} for more modules to load</div><div> } # modules</div><div>} # server</div><div>radiusd: #### Opening IP addresses and Ports ####</div><div>listen {</div><div><span class="" style="white-space:pre"> </span>type = "auth"</div>
<div><span class="" style="white-space:pre"> </span>ipaddr = *</div><div><span class="" style="white-space:pre"> </span>port = 1812</div><div>}</div><div>listen {</div><div><span class="" style="white-space:pre"> </span>type = "control"</div>
<div> listen {</div><div><span class="" style="white-space:pre"> </span>socket = "/var/run/radiusd/radiusd.sock"</div><div> }</div><div>}</div><div> ... adding new socket proxy address * port 54463</div><div> ... adding new socket proxy address * port 56731</div>
<div> ... adding new socket proxy address * port 42048</div><div> ... adding new socket proxy address * port 37161</div><div> ... adding new socket proxy address * port 38652</div><div> ... adding new socket proxy address * port 46065</div>
<div>Listening on authentication address * port 1812</div><div>Listening on command file /var/run/radiusd/radiusd.sock</div><div>Listening on proxy address * port 1814</div><div>Ready to process requests.</div></div><div>
<br></div><div><br></div><div><br></div></div>