Hi, Just to give some infos if I can help (this mailing has helped me a lot !) I have F5 BigIP devices in two 2 DCs. They have each a VirtualServer with a shared IP (not activated in VLANs used to communicate between the 2 DC to avoid IP conflits, a much simple config for NAS - only one IP address for server). Everything works fine with the following config : The Virtual Server ( IP is A.B.C.D has it's public for external DC .......) ltm virtual /Common/VS-RADIUS-AUTH { destination /Common/A.B.C.D:1812 ip-protocol udp mask 255.255.255.255 pool /Common/POOL-RADIUS-AUTH profiles { /Common/radiusLB { } /Common/udp { } } source 0.0.0.0/0 translate-address enabled translate-port enabled vlans { [...] } vlans-enabled } The pool used : ltm pool /Common/POOL-RADIUS-AUTH { members { /Common/10.10.6.7:1812 { address 10.10.6.7 } /Common/10.20.6.3:1812 { address 10.20.6.3 } } monitor /Common/Radius-Auth } The monitor : ltm monitor radius /Common/Radius-Auth { debug no defaults-from /Common/radius destination *:* interval 30 nas-ip-address 10.16.81.11 password Monitor secret ************** time-until-up 0 timeout 31 username radius@domain } Profile radiusLB is the following : ltm profile radius radiusLB { clients none persist-avp none } And one other not used but available in default config. ltm profile radius radiusLB-subscriber-aware { defaults-from radiusLB subscriber-aware enabled } If I look at pool statistics, each servers has equivalent volume of requests (48.1k against 48.2k). You could play with Priority Group depending location or failover architecture of Radius if you want .... Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits Niveau 3 - Infrastructure & Produits fabien.vincent@coreye.fr De : freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org [mailto:freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org] De la part de Michael Schwartzkopff Envoyé : mercredi 9 octobre 2013 11:17 À : FreeRadius users mailing list Objet : Re: load balancing radius with F5 devices Am Mittwoch, 9. Oktober 2013, 09:41:19 schrieb Alex Sharaz:
Hi,
Is anyone out there load balancing RADIUS with an F5 load balancer? We're doing it here, but I can't help thinking that the actual load balancing algorithm need some tweaking.
As far as I'm aware ( systems section support the F5 boxes)
1). We're using round robin to spread the load over 2 back end radius servers. 2). There is some "general" sticky persistence so that once a RAS device starts talking to a particular back end server it continues to talk to that server for a predetermined length of time ( might be an hour, not sure). This ensures that an eap dialogue will always talk to the same back end server for the duration of the "stuck" time. Not sure what happens when you get to the end of the time interval though.
According to the F5 statistics, overall radius traffic seems to be shared evenly over the 2 back end servers. However, our most heavily loaded RAS client is our wireless network. While we have 900 switches doing mac and 802.1x based auth, we can have 6000+ users on our wireless network all authenticating to RADIUS via 3 RAS clients. Looking at the back end server log files, it does look as if, in general, all wireless RADIUS auths head for the same back end server.
I was wondering if there's a way off having a bit more granularity in terms of how the f5 load balances incoming RADIUS requests. You would need to use application layer load balancing on the BigIPs. But I don't think that you can configure this on the BigIPs. The RADIUS protocol is stateless, so there is no criteria in the application that a load balancer could use to balance inside the application. Greetings, -- Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein