Alexander Clouter wrote:
Does mean that client-balance, client-port-balance and keyed-balance do not do as advertised on the tin though which I would want to grumble about being a Bad Thing(tm).
Err... that's not at all what I said. They work, and they have *nothing* to do with changes to the EAP module.
It is a receiver side only fix mind you that does not stop FreeRADIUS (or anything else) shifting packets to the wrong place. The fix is that you need to remove any uncertainty about where the traffic goes and having that load comparison[1] and an explicit call to a random shuffler royally breaks things by making things unpredictable.
The only random code in the "find home server' function hasn't changed in nearly 2 1/2 years.
In the 'eduroam' case, if we removed the national RADIUS servers, and lets say I delivered the packets straight to the remote end, nothing stops FreeRADIUS delivering half an EAP session to the wrong box which would result in an Access-Reject.
I would argue you actually want to keep the src_ipaddr check to pick up on upstream *broken* load balancers, unfortunately it's just currently FreeRADIUS does have a broken load balancer.
Could you be more specific?
For what it is worth, NAK? :)
Cheers
[1] obviously you still want the max outstanding check there, but you have to think of the case of (such as for us) where 'outstanding_sessions' is zero ~100% of the time
Maybe what you want is "pick the first live one, even if it's less used than the others". Alan DeKok.