This is my proxy.conf. The only value I've adjusted so far is response window (from 20 down to 5). Otherwise, I believe it's configured correctly to failover between the two home servers. I'll have to work on the debugs. proxy server { default_fallback = yes } home_server proxy1 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = xxxxxxxxxx response_window = 5 zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server proxy2 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = xxxxxxxxxxxx response_window = 5 zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool EDUROAM-FTLR { type = fail-over home_server = proxy1 home_server = proxy2 } realm mydomain.ca { strip } realm LOCAL { nostrip } realm NULL { nostrip } realm DEFAULT { pool = EDUROAM-FTLR nostrip } -Mike On Wed, 5 Dec 2012, Alan Buxey wrote:
Hi,
This is the RedHat RPM which I believe are maintained by RedHat. Hopefully they've back ported any major security issues!
got the changelog for the 2.1.12 RPM release you are running?
It does both autentication and proxy and I do have status-check enabled. On the contraller I increased the default timeout from 2 seconds up to 8 seconds. At the same time I lowered the
2 seconds is very low for international RADIUS proxying...the traffic needs to get to the end site...and then be dealt with by the end site (which may take 1 - many seconds to actually authenticate the user once the tunnel is created). somewhere around 10 seconds is the maximum I would expect for global roaming authentication via multple proxy peers
the RADIUS server is at the mercy of the controller and the remote sites... who might not be answering at all...they could just reject.
I havent seen a sanity error message like that since the troublesome 2.1.7 - 2.1.9 days when the proxy code got some rewrites in places.....
I wonder if your proxy.conf for the home server stuff is correct and not flipping requests between remote proxys?
what does the server show/say in full debug mode with a test remote account?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html