On 26/06/14 13:18, Jason Healy wrote:
annoyed if (say) multiple packets in an EAP conversation don’t go to the same server.
Yes, that's absolutely a problem. All packets in an EAP conversation must go to the same server, and ideally all future EAP sessions to allow you take advantage of session resumption. However, see below.
Basically: has anyone else tried it? Or is this a Bad Idea and I just stick to regular multi-server with failover on the NAS?
A lot depends on how stable the routing is, and how many next-hops are present, as well as how your routers hash between multiple next-hops e.g. ip or ip + port. Basically - if you're going to do this, ensure traffic to the anycast IP only reaches one server from every point during stable operation. During a routing change - which is presumably a failure event - packets will flow differently, but that doesn't matter because it's a failover event anyway. Having said all that - I personally would not use anycast for radius. Specify multiple servers on your NAS, and use some sort of sticky load balancing or active/standby failover of those IPs.