Alan Dekok wrote:
Arran Cudbard-Bell wrote:
Actually ... it might be an idea to add another return path which drops the request and sends no reply, just to make the RADIUS server seem dead if any of it's critical dependencies fail.
I've been discussing similar issues on the IETF RADIUS list. It seems that the RFC's say the server MUST respond to the NAS for Access-Requests. Despite that, many people think it's a good idea to NOT respond in some situations.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Then possibly an agnostic response, though the RFC would have to updated to include the extra packet type... Access-IDontKnowBecauseOurSQLServersBroken -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900