- Freeradius-Users - lists.freeradius.org

Problem with Discarding packets. It is the Radius, MySQL or PostgreSQL?
by Michell 25 Apr '13

25 Apr '13

Hello guys, I would like an opinion concerning a situation that is happening with us. I'm sure you have faced a similar situation. Currently I have about 3000 clients connected simultaneously in 8 concentrators Mikrotik. These concentrators authenticate to 3 servers freeradius doing consulting and accounting users in a mysql db. The time we have the message "Discarding duplicate request ..." and " Discarding conflicting ..." and in recent days began using ippool in postgresql where we started having problems duplicating IPs. We believed that such duplication was due to these messages which were caused by our server mysql which was ancient and did not allow more make the necessary adjustments as the number of clients and memory. So we did the installation of new server Mysql and changed the parameters possible and even indicated by mysqltunner and mysqlprimer, but the message continued Discarding occurs. So we started using two tables for the radacct, but the message remains. Finally, we migrated the radacct for postgresql, where the number (two tables) where the incidence of this message decreased, but remains on average 50 per hour to about 1300 sections with pppoe interim-update 5 minutes. What are the parameters that could be changed to make the tuning of freeradius? The question that remains ... MySQL or PostgreSQL? We've done several settings in radius and mysql and still can not stop these messages. Attached my freeradius settings. I appreciate the attention and the help of everyone, Att

4 3

FreeRadius connection pooling
by Bruce Bauman 25 Apr '13

25 Apr '13

I'm updating an environment from freeradius 2.1.x to freeradius 2.2.x, and I'm trying to figure out connection pooling. Our current configuration has 5 sql {} stanzas in the sql.conf file, each specifying num_sql_socks and several other SQL related variables. WIth connection pooling, can I share these connections between all of the stanzas? Is there a good place to look for documentation? Also, can anyone give some examples of a how a moderately large radius configuration should be configured? Thanks for any insight. -- Bruce Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

2 1

Setting exceptions to Quota calculations
by Khalid Shaka 25 Apr '13

25 Apr '13

Hello all, We are just starting a DSL business so we are getting ourselves familiar with FreeRadius. We are introducing packages that include unlimited traffic to certain domains such as youtube. Is there a way to set up our quota system to exclude traffic to youtube? If so, can we do it on specific users that sign up to the package and not everyone else? I realize that this might require some configuration on the router side, we are running a Cisco 7206/NPE-G1 if that helps. Appreciate your help Khalid

2 1

case insensitive password
by Mehdi Ravanbakhsh 24 Apr '13

24 Apr '13

how i could check case insensitive password for user.. many of users use wring password based on Caps Lock , so i need to check password insensitive and it is better if i could limit this kind of password check for some nas-ip-adress. which part of config file should be modified for this problem? Best regards.

2 2

RE: Have anyone test the performance about FreeRADIUS+jRadius on authentication?
by Okis Chuang 24 Apr '13

24 Apr '13

Thanks for Alan's quick and kindly reply! Yes, I'm under this slow performance trouble now.... Actually I tried let it not going into jradius and completing my easy job only in FreeRADIUS yesterday. And it did it well. It can finish 10000 auth request in 13 sec. However, our goal is more than that ... the brief situation is that user will be redirected to our captive portal during pre-auth if they got IP address, then doing UAM authentication by web portal to our policy manager server(built in FreeRADIUS+JRadius). We'll do some policy based control with our WiFi gateway like CoA request. Then would do subscribers' accounting processing(identify some attributes in accounting packet then modify its value then send to backend acct server). So supposed I stop using jradius, what kinds of module would you recommend me to fulfill these jobs such as that? Or actually FreeRADIUS can satisfy it by itself? Can it send CoA request to WiFi gateway after receiving some predefined attribute value with web portal while it sending access request to FreeRADIUS? I plan to make it become a policy manager. Cheers, Okis ------------------------------------------------------- Chuang Okis wrote: > Have anyone test the performance about FreeRADIUS+jRadius on authentication? Not me. > The test was just for authentication load test from gateway to radius > server. My jradius handler would just do some easy string splitng for > one VSA. Use Perl. It's integrated into the server, and should be much faster. Or, use a regex. See "man unlang". Or, write a C module to do it. > Does this be the most probable factor causing the slow processing? > Even through I doubt it... Yes. It's jradius. > Then I did some interesting test later... > I left my handler empty but still let traffic get into jradius handler > through rlm_jradius by TCP socket. > The result has improved a bit even though not at our level of acceptance.. > Its TPS (Transaction Per Seconds) improved from 30 to 300 approximately. 300 is still MUCH slower than 10,000. > Hence, I'm guessing the bottleneck may be the process of rlm_jradius > communication. > Does anyone get any help or recommendation?? > Or any other performance tuning tips I can do? Don't use jradius. It's very slow. Use pretty much anything else. Alan DeKok. ------------------------------

3 2

How to fix the proxy source port
by Okis Chuang 24 Apr '13

24 Apr '13

Hi all, Can I FIX the source port rather than random src port when proxy request to other RADIUS server? I know it is able to fix src IP address in proxy.conf, but seems no config about fixed src port. What if I set " src_ipaddr = 127.0.0.1:3100 " in proxy.conf, could this work? Thanks in advance! Okis

2 1

How to change request attribute based on NAS IP address
by Mehdi Ravanbakhsh 24 Apr '13

24 Apr '13

Hi All i use Cisco and mikrotik as Access server in my network and i need to limit user access by MAC address. in this case i can use Calling-Station-Id , it works for mikrotik : AUTH Detail Packet-Type = Access-Request Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 11062419 NAS-Port-Type = Ethernet User-Name = "7622240489" Calling-Station-Id = "90:F6:52:D5:74:96" Called-Station-Id = "EHO-L" NAS-Port-Id = "902- ADSL-EMAM-HOSIEN" NAS-Identifier = "2800gs-langha" NAS-IP-Address = 10.185.3.5 SQL-User-Name = "7622240489" But not work for Cisco : Packet-Type = Access-Request Cisco-AVPair = "client-mac-address=9094.e483.390b" Framed-Protocol = PPP User-Name = "5858222251" NAS-Port-Type = Ethernet NAS-Port = 13145502 NAS-Port-Id = "0/0/2/352" Service-Type = Framed-User NAS-IP-Address = 85.185.83.242 Acct-Session-Id = "00C8959E" NAS-Identifier = "BOJNOORD_7204_1" SQL-User-Name = "5858222251" So how i can Set calling station ID to MAC addreess for cisco NAS ? Best regards.

2 2

Have anyone test the performance about FreeRADIUS+jRadius on authentication?
by Okis Chuang 24 Apr '13

24 Apr '13

Thanks Fajar your speedy response and really helpful for me. Yeah..I'm pretty grateful about all contributions here for sure! And I'm definitely not insist on desiring the best solution here. I just want to listen some opinions or advice from all those experienced. Anyway, I'll keep learning and contributing here in one day. About your kind advice, I will take a serious consideration absolutely. Thanks for you helpful recommendations again! -- Okis --------------------------------- Since you seem to have some specific requirement, I'd recommend you engage with someone with experience in freeradius implementation and integration in your area. Most people here won't have the time to go thru your detailed request one-by-one and designing a best solution for you. Remember, those who contribute on this list do so on their free time, out of their good will. Some comments though > Then would do subscribers' accounting processing(identify some attributes in > accounting packet then modify its value then send to backend acct server). FR has all sorts of module that can modify radius packets on proxy scenarios. Unlang is perfect for simple and static rules (e.g. "add attribute X with value Y to every packet") while for complex rules (e.g. get value of attribute X, lookup value in db, then create attribute Y based on that value) mod_perl is probably more suitable. > Can it send CoA request to > WiFi gateway after receiving some predefined attribute value with web portal > while it sending access request to FreeRADIUS? Try reading raddb/sites-available/originate-coa -- Fajar

1 0

Have anyone test the performance about FreeRADIUS+jRadius on authentication?
by Chuang Okis 23 Apr '13

23 Apr '13

Hi all,Have anyone test the performance about FreeRADIUS+jRadius on authentication?I recently did several numbers of load test with radclient in FreeRADIUS.I used radclient -c 10000 to attack my radius server(with jradius), and found that the results are pretty bad...The call per second was approximately under 50...however I tried without jradius, just files in FreeRADIUS for auth, then result is 10000 request with 13 seconds. Honestly, the gap shocks me..my environment is:FreeRADIUS 2.2.0JRadius 1.1.4jdk 1.7rlm_jradius TCP Socket: 128jradius threads: 100The test was just for authentication load test from gateway to radius server. My jradius handler would just do some easy string splitng for one VSA.Does this be the most probable factor causing the slow processing? Even through I doubt it...Then I did some interesting test later... I left my handler empty but still let traffic get into jradius handler through rlm_jradius by TCP socket. The result has improved a bit even though not at our level of acceptance.. Its TPS (Transaction Per Seconds) improved from 30 to 300 approximately. Hence, I'm guessing the bottleneck may be the process of rlm_jradius communication. Does anyone get any help or recommendation??Or any other performance tuning tips I can do? Thanks in advance! Okis

2 1

Re: [Help] How to control the authentication session timeout
by Alan Buxey 23 Apr '13

23 Apr '13

Controlled by the NAS and/or the RADIUS server depending on NAS settings. ie you should be able to set session-timeout on the NAS and then override/update the value on the RADIUS server depending on your chosen policies...eg for particular users/clients etc...and if proxying you may have agreements or filtering in place to set/agree the value alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

4 10