freeradius redundancy
Hi , i need to deploy two redundant Freeradius servers , anyone have like experience to share ,,, Thanks in Advance ,,,
On Mon, May 23, 2011 at 5:16 PM, Student University <studentmf@gmail.com> wrote:
Hi ,
i need to deploy two redundant Freeradius servers ,
anyone have like experience to share ,,,
Er... just do it (r)? Seriously, just try it yourself with the help of existing documentation (default config file, man page, wiki, etc). The biggest problem would probably be setting up some kind of shared storage to store user acctounts. - you could use users file with same entry with both nodes, but it'd mean you have to make sure they're synced manually - you could use a database on separate node (most common option), but that would mean adding another single point of failure - you could use some kind of clustered database setup, but it'd increase the level of complexity greatly, which is beyond the scope of this list. So just try it from the simplest setup (with users file), and see if it can fit your requirement. If not, then after trying you should be able to come up with specific question on what you're having problem with. -- Fajar
Student University <studentmf@gmail.com> wrote:
i need to deploy two redundant Freeradius servers ,
anyone have like experience to share ,,,
If your network topology can support it (speak to your network sysadmin) then you can get "the ether" to do the failover/high-availability without having to buy an expensive and/or complicated load-balancer: http://www.digriz.org.uk/ha-ospf-anycast Cheers -- Alexander Clouter .sigmonster says: If you knew what to say next, would you say it?
Hi, my testing lab like this : Node1 (FreeRadius+MySQL) Node2 (FreeRadius+MySQL) i am setting Master-Master MySQL Replication between this two node , initially it seems OK , now i am going to deploy this in production environment ,,,, i asked if any one have further investigation (issues , recommendations ) , or any advice ,,,, Thanks in advance ,,, On Mon, May 23, 2011 at 3:56 PM, Alexander Clouter <alex@digriz.org.uk>wrote:
Student University <studentmf@gmail.com> wrote:
i need to deploy two redundant Freeradius servers ,
anyone have like experience to share ,,,
If your network topology can support it (speak to your network sysadmin) then you can get "the ether" to do the failover/high-availability without having to buy an expensive and/or complicated load-balancer:
http://www.digriz.org.uk/ha-ospf-anycast
Cheers
-- Alexander Clouter .sigmonster says: If you knew what to say next, would you say it?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, May 24, 2011 at 3:40 PM, Student University <studentmf@gmail.com> wrote:
Hi,
my testing lab like this :
Node1 (FreeRadius+MySQL) Node2 (FreeRadius+MySQL)
i am setting Master-Master MySQL Replication between this two node ,
Master-Master seems easy, but needs proper care. For example: - have you taken care of auto increment values? What if there's concurrent insert of different acct record to both sql node, will they have the same radacctid? - what happens when an acct-start got to node 1, but before the change was replicated, an acct-stop for the same session got to node 2? Can your sql query/replication setup handle that? -- Fajar
also ,,, each node (FR+MySQL) is connected to different NAS server like this : Cisco NAS1 --> Node1 (FR+MySQL) <==> Node2(FR+MySQL) <-- Cisco NAS2 This is what we need to deploy exactly , so does the master-master replication is suited enough to accommodates our needs or there is any better recommendations . Thanks in Advance , On Tue, May 24, 2011 at 11:48 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, May 24, 2011 at 3:40 PM, Student University <studentmf@gmail.com> wrote:
Hi,
my testing lab like this :
Node1 (FreeRadius+MySQL) Node2 (FreeRadius+MySQL)
i am setting Master-Master MySQL Replication between this two node ,
Master-Master seems easy, but needs proper care. For example: - have you taken care of auto increment values? What if there's concurrent insert of different acct record to both sql node, will they have the same radacctid? - what happens when an acct-start got to node 1, but before the change was replicated, an acct-stop for the same session got to node 2? Can your sql query/replication setup handle that?
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Student University <studentmf@gmail.com> wrote:
each node (FR+MySQL) is connected to different NAS server like this :
Cisco NAS1 --> Node1 (FR+MySQL) <==> Node2(FR+MySQL) <-- Cisco NAS2
This is what we need to deploy exactly ,
Yes, but what do you do with the MySQL database? authentication? authorization? Record just log/accounting information?
so does the master-master replication is suited enough to accommodates our needs or there is any better recommendations .
To be honest, we have not had the need for HA SQL; as we only use it for logging, we use LDAP for authentication/authorization (LDAP is trivial to deploy in an HA configuration). We have a single PostgreSQL database between two active-active FreeRADIUS servers. Various network/power failures here have tempered our configuration to skip logging in the right places and not block/hang the entire campus if the SQL server is unreachable as our priorities swing towards getting the user/workstation connected rather than recording everything. Over the year, for our university (~4000 students and ~600 staff), the SQL server has probably be down only for power reasons (active-active MySQL will not save you there unless you can put a good physical kilometer and L3 separation between the boxes). If the RADIUS blocks (as they are waiting for a non-existent backend[1]) you are in a lot more trouble... I recommend you design a system/service that *expects* failure in it's components and gracefully fails where possible. People who go straight for active-active SQL servers and try to prevent failure and have themselves no operation experience with deploying a FreeRADIUS service are possibly lining themselves up for a tough ride. As advice from someone how has made the mistake (we all have), although the chance of a failure might be less, the actual occasions when failures occur are typically much nastier. Look at your priorities, and before asking for advice you have to list your *requirements* otherwise we simply cannot help. Cheers [1] there is actually a 'bug' in FreeRADIUS I keep meaning to submit a patch for to avoid this (add ' connect_timeout=3' to the end of your PgSQL password to see the effect[2] on an unpatched system) [2] http://www.postgresql.org/docs/7.3/static/libpq-connect.html -- Alexander Clouter .sigmonster says: You auto buy now.
Student University <studentmf@gmail.com> wrote:
my testing lab like this :
Node1 (FreeRadius+MySQL) Node2 (FreeRadius+MySQL)
i am setting Master-Master MySQL Replication between this two node , initially it seems OK ,
now i am going to deploy this in production environment ,,,,
You have not said anything about how you are using the SQL servers so I have no idea whether what you are doing is good or bad or overkill.
i asked if any one have further investigation (issues , recommendations ) , or any advice ,,,,
MySQL *will* burn you. Be sensible and use PostgreSQL. Cheers -- Alexander Clouter .sigmonster says: BOFH excuse #350: paradigm shift...without a clutch
participants (3)
-
Alexander Clouter -
Fajar A. Nugraha -
Student University