Hi Craig, Thanks for you response. I have tried to implement this but Im going wrong somewhere. Below I will show my configuration, then the debug that shows what the server is doing. First my 2 detail files. modules/detail: --------------- detail detail-radrelay { detailfile = ${radacctdir}/detail-combined detailperm = 0600 dirperm = 0755 locking = yes } detail detail-radrelay2 { detailfile = ${radacctdir}/detail-combined2 detailperm = 0600 dirperm = 0755 locking = yes } Then in my accounting section I write incoming packets to both detail files. sites-enable/default: accounting { detail-radrelay detail-radrelay2 } The above then writes any incoming packets to 2 files "detail-combined" and "detail-combined2". Cool, so now I need to process one and send it to server A and process the other and send it to server B. I already have the following which processes detail-combined and sends to server A (for all realms). proxy.conf: ----------- home_server copy-acct-to-home-server { type = acct ipaddr = server.A.ip port = 1813 secret = server_A_secret } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } sites-enabled/copy-acct-to-home-server: --------------------------------------- server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-combined } accounting { ok } } So now there is already a home_server_pool assigned to the default realm, but I continue and create a home_server entry for server B proxy.conf (now including home_server entry for server B): ---------------------------------------------------------- home_server copy-acct-to-home-server { type = acct ipaddr = server.A.ip port = 1813 secret = server_A_secret } home_server copy-acct-to-server-B { type = acct ipaddr = server.B.ip port = 1813 secret = server_B_secret } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } And corresponding sites-enabled files. sites-enabled/copy-acct-to-home-server: --------------------------------------- server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-combined } accounting { ok } } sites-enabled/copy-acct-to-server-B: --------------------------------------- server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-combined2 } accounting { ok } } Now I fire up radiusd in debug mode and send a test packet to the server to see what it does. As the debug shows, it gets the packet, writes it to the detail-combined2. Then the listener copy-acct-to-server-B picks up the detail-combined2 and processes it, but instead of sending to server B its sending to server A Fri Nov 13 09:19:57 2009 : Debug: Module: Instantiating detail-radrelay2 Fri Nov 13 09:19:57 2009 : Debug: detail detail-radrelay2 { Fri Nov 13 09:19:57 2009 : Debug: detailfile = "/var/log/radius/radacct/detail-combined2" Fri Nov 13 09:19:57 2009 : Debug: header = "%t" Fri Nov 13 09:19:57 2009 : Debug: detailperm = 384 Fri Nov 13 09:19:57 2009 : Debug: dirperm = 493 Fri Nov 13 09:19:57 2009 : Debug: locking = yes Fri Nov 13 09:19:57 2009 : Debug: log_packet_header = no Fri Nov 13 09:19:57 2009 : Debug: } Fri Nov 13 09:19:57 2009 : Debug: Module: Instantiating detail-radrelay Fri Nov 13 09:19:57 2009 : Debug: detail detail-radrelay { Fri Nov 13 09:19:57 2009 : Debug: detailfile = "/var/log/radius/radacct/detail-combined" Fri Nov 13 09:19:57 2009 : Debug: header = "%t" Fri Nov 13 09:19:57 2009 : Debug: detailperm = 384 Fri Nov 13 09:19:57 2009 : Debug: dirperm = 493 Fri Nov 13 09:19:57 2009 : Debug: locking = yes Fri Nov 13 09:19:57 2009 : Debug: log_packet_header = no Fri Nov 13 09:19:57 2009 : Debug: } Fri Nov 13 09:19:57 2009 : Debug: including configuration file /etc/raddb/sites-enabled/copy-acct-to-radius01 Fri Nov 13 09:19:57 2009 : Debug: including configuration file /etc/raddb/sites-enabled/copy-acct-to-home-server Fri Nov 13 09:19:57 2009 : Debug: server copy-acct-to-radius01 { Fri Nov 13 09:19:57 2009 : Debug: modules { Fri Nov 13 09:19:57 2009 : Debug: Module: Checking preacct {...} for more modules to load Fri Nov 13 09:19:57 2009 : Debug: (Loaded rlm_realm, checking if it's valid) Fri Nov 13 09:19:57 2009 : Debug: Module: Linked to module rlm_realm Fri Nov 13 09:19:57 2009 : Debug: Module: Instantiating suffix Fri Nov 13 09:19:57 2009 : Debug: realm suffix { Fri Nov 13 09:19:57 2009 : Debug: format = "suffix" Fri Nov 13 09:19:57 2009 : Debug: delimiter = "@" Fri Nov 13 09:19:57 2009 : Debug: ignore_default = no Fri Nov 13 09:19:57 2009 : Debug: ignore_null = no Fri Nov 13 09:19:57 2009 : Debug: } Fri Nov 13 09:19:57 2009 : Debug: Module: Checking accounting {...} for more modules to load Fri Nov 13 09:19:57 2009 : Debug: } # modules Fri Nov 13 09:19:57 2009 : Debug: } # server Fri Nov 13 09:19:57 2009 : Debug: server copy-acct-to-home-server { Fri Nov 13 09:19:57 2009 : Debug: modules { Fri Nov 13 09:19:57 2009 : Debug: Module: Checking preacct {...} for more modules to load Fri Nov 13 09:19:57 2009 : Debug: Module: Checking accounting {...} for more modules to load Fri Nov 13 09:19:57 2009 : Debug: } # modules Fri Nov 13 09:19:57 2009 : Debug: } # server Fri Nov 13 09:19:57 2009 : Debug: Listening on detail file /var/log/radius/radacct/detail-combined2 as server copy-acct-to-radius01 Fri Nov 13 09:19:57 2009 : Debug: Listening on detail file /var/log/radius/radacct/detail-combined as server copy-acct-to-home-server Fri Nov 13 09:19:58 2009 : Debug: Polling for detail file /var/log/radius/radacct/detail-combined2 Fri Nov 13 09:19:58 2009 : Debug: Polling for detail file /var/log/radius/radacct/detail-combined rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 40660, id=2, length=273 User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: +- entering group preacct {...} Fri Nov 13 09:19:59 2009 : Info: ++[preprocess] returns ok Fri Nov 13 09:19:59 2009 : Info: +- entering group accounting {...} Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay] expand: /var/log/radius/radacct/detail-combined -> /var/log/radius/radacct/detail-combined Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay] /var/log/radius/radacct/detail-combined expands to /var/log/radius/radacct/detail-combined Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay] Acquired filelock, tried 1 time(s) Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay] expand: %t -> Fri Nov 13 09:19:59 2009 Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay] Released filelock Fri Nov 13 09:19:59 2009 : Info: ++[detail-radrelay] returns ok Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay2] expand: /var/log/radius/radacct/detail-combined2 -> /var/log/radius/radacct/detail-combined2 Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay2] /var/log/radius/radacct/detail-combined2 expands to /var/log/radius/radacct/detail-combined2 Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay2] Acquired filelock, tried 1 time(s) Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay2] expand: %t -> Fri Nov 13 09:19:59 2009 Fri Nov 13 09:19:59 2009 : Info: [detail-radrelay2] Released filelock Fri Nov 13 09:19:59 2009 : Info: ++[detail-radrelay2] returns ok Sending Accounting-Response of id 2 to xxx.xxx.xxx.xxx port 40660 Proxy-State = 0x313433 Fri Nov 13 09:19:59 2009 : Info: Finished request 0. Fri Nov 13 09:19:59 2009 : Info: Cleaning up request 0 ID 2 with timestamp +2 Fri Nov 13 09:19:59 2009 : Debug: Going to the next request So by this point the request has been written to both detail-combined files, excellent. Now: Fri Nov 13 09:19:59 2009 : Debug: Waking up in 0.3 seconds. Fri Nov 13 09:19:59 2009 : Debug: Polling for detail file /var/log/radius/radacct/detail-combined Fri Nov 13 09:19:59 2009 : Debug: detail_recv: Renaming /var/log/radius/radacct/detail-combined -> /var/log/radius/radacct/detail-combined.work detail_recv: Read packet from /var/log/radius/radacct/detail-combined.work User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: server copy-acct-to-server-A { Fri Nov 13 09:19:59 2009 : Info: +- entering group preacct {...} Fri Nov 13 09:19:59 2009 : Info: [suffix] Looking up realm "realm" for User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: [suffix] Found realm "DEFAULT" Fri Nov 13 09:19:59 2009 : Info: [suffix] Adding Realm = "DEFAULT" Fri Nov 13 09:19:59 2009 : Info: [suffix] Proxying request from user user to realm DEFAULT Fri Nov 13 09:19:59 2009 : Info: [suffix] Preparing to proxy accounting request to realm "DEFAULT" Fri Nov 13 09:19:59 2009 : Info: ++[suffix] returns updated Fri Nov 13 09:19:59 2009 : Info: +- entering group accounting {...} Fri Nov 13 09:19:59 2009 : Info: ++[ok] returns ok Fri Nov 13 09:19:59 2009 : Info: } # server copy-acct-to-server-A Fri Nov 13 09:19:59 2009 : Info: WARNING: Empty section. Using default return values. Sending Accounting-Request of id 121 to ip_address_of_server_A port 1813 User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: Proxying request 2 to home server server_ip_A port 1813 Sending Accounting-Request of id 121 to ip_address_of_server_A port 1813 User-Name = "user@realm" rad_recv: Accounting-Response packet from host ip_address_of_server_A port 1813, id=121, length=32 Proxy-State = 0x313438 Proxy-State = 0x3137383533 Ok so sending to server A worked correctly. Now: Fri Nov 13 09:19:59 2009 : Debug: Waking up in 0.3 seconds. Fri Nov 13 09:19:59 2009 : Debug: Polling for detail file /var/log/radius/radacct/detail-combined2 Fri Nov 13 09:19:59 2009 : Debug: detail_recv: Renaming /var/log/radius/radacct/detail-combined2 -> /var/log/radius/radacct/detail-combined2.work detail_recv: Read packet from /var/log/radius/radacct/detail-combined2.work User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: server copy-acct-to-server-B { Fri Nov 13 09:19:59 2009 : Info: +- entering group preacct {...} Fri Nov 13 09:19:59 2009 : Info: [suffix] Looking up realm "realm" for User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: [suffix] Found realm "DEFAULT" Fri Nov 13 09:19:59 2009 : Info: [suffix] Adding Realm = "DEFAULT" Fri Nov 13 09:19:59 2009 : Info: [suffix] Proxying request from user user to realm DEFAULT Fri Nov 13 09:19:59 2009 : Info: [suffix] Preparing to proxy accounting request to realm "DEFAULT" Fri Nov 13 09:19:59 2009 : Info: ++[suffix] returns updated Fri Nov 13 09:19:59 2009 : Info: +- entering group accounting {...} Fri Nov 13 09:19:59 2009 : Info: ++[ok] returns ok Fri Nov 13 09:19:59 2009 : Info: } # server copy-acct-to-server-B Fri Nov 13 09:19:59 2009 : Info: WARNING: Empty section. Using default return values. Sending Accounting-Request of id 121 to ip_address_of_server_A port 1813 You can see from the line above that it is sending this request to server A as well. This is where Im getting stuck :( Any pointers, suggestions, examples appreciated as always. Thanks again, Patric Craig Campbell wrote:

Re: "Do I need a second site-enable/copy-acct-to-home-server1 file that reads from a different detail file?"

As far as I can tell (and have done) - Yes, you do.

Cheers, -craig

----- Original Message ----- From: "Patric" <patricrt@gmail.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, November 12, 2009 9:50 AM Subject: Proxy to multiple servers in FR 2.1.7

...

Hi again all :)

I am attempting to proxy all accounting packets to 2 servers. In my proxy.conf I am using a default realm.

realm DEFAULT { acct_pool = my_acct_failover nostrip }

I create a home_server entry for each server, and add them to the home_server_pool for that realm:

home_server copy-acct-to-home-server { }

home_server copy-acct-to-home-server2 { }

home_server_pool my_acct_failover { home_server = copy-acct-to-home-server home_server = copy-acct-to-home-server2 }

If I have site-enable/copy-acct-to-home-server it then appears to work in a fail-over method, where it will send to the first server until it is not reachable, then it sends to the second server.

Is there a way I can configure this to send to both at once? Do I need a second site-enable/copy-acct-to-home-server1 file that reads from a different detail file?

I am using the default realm so I dont know how to setup a second home_server_pool either...

Any help is much appreciated, Im going in circles :) Many thanks Patric - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

__________ Information from ESET Smart Security, version of virus signature database 4600 (20091112) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature database 4600 (20091112) __________

The message was checked by ESET Smart Security.

http://www.eset.com

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi Alan, Thanks for responding,

...

So now there is already a home_server_pool assigned to the default realm, but I continue and create a home_server entry for server B

...

...

sites-enabled/copy-acct-to-server-B: ---------------------------------------

server copy-acct-to-home-server {

Uh... you have TWO virtual servers with the same name. This isn't allowed. And this config isn't the same as what's shown in the debug log.

Can you explain why you're posting WRONG configurations? It's not like we can't notice.

Sorry, I didnt clarify properly - I _repeated_ my original configuration, this time including the changes I had made. So right now my entire proxy.conf looks as follows: proxy server { default_fallback = no } home_server copy-acct-to-server-A { type = acct ipaddr = server_A port = 1813 secret = secret } home_server copy-acct-to-server-B { type = acct ipaddr = server_B port = 1813 secret = secret } home_server_pool my_acct_failover { home_server = copy-acct-to-server-A } realm DEFAULT { acct_pool = my_acct_failover nostrip }

...

detail_recv: Read packet from /var/log/radius/radacct/detail-combined.work User-Name = "user@realm" Fri Nov 13 09:19:59 2009 : Info: server copy-acct-to-server-A { Fri Nov 13 09:19:59 2009 : Info: +- entering group preacct {...} Fri Nov 13 09:19:59 2009 : Info: [suffix] Looking up realm "realm" for User-Name = "user@realm"

Where did this come from? There's no "preacct" section in the config you posted, and there's no "suffix" module, either.

I had attempted to only include relevant sections of my configuration in an attempt to keep it short and readable, but perhaps this has confused the issue more than helped, my apologies.

...

You can see from the line above that it is sending this request to server A as well. This is where Im getting stuck :(

Because that's what you told it to do. Your config is telling it to proxy BOTH requests to the "DEFAULT" realm. And it does so. The debug log clearly shows this.

If you want the requests to be proxied to a DIFFERENT location, you will need to set the "Proxy-To-Realm" attribute manually. i.e.

server a { preacct { update control { Proxy-To-Realm := "realm for home server A" } } }

And do the same thing for B. And configure two realms, too.

YES! This is where Im getting lost :) Maybe I am misunderstanding the word "realm". All my requests are for a single realm, eg user@"patric.com". This was the reason I used the "DEFAULT" realm... It occurs to me now that perhaps in the config file the word "realm" does not refer to my domain, but instead are names I give to servers A and B? Or am I completely off track? Ok, so is it possible for me to create a realm for server A and another realm for server B, but both are processing "user@patric.com" ? If so please could you point me to some docs that might help me understand how, clearly Im missing or not understanding something *bangs head on wall* Thanks for your patience and time! Patric

Hi once again Alan, I must apologize for my previous grasping at straws, it was not from lack of trying, just lack of knowledge... I have managed to figure it out thanks to your last comment Alan DeKok wrote:

If you want the requests to be proxied to a DIFFERENT location, you will need to set the "Proxy-To-Realm" attribute manually. i.e.

server a { preacct { update control { Proxy-To-Realm := "realm for home server A" } } }

And do the same thing for B. And configure two realms, too.

Since you are TELLING it what realm to use you can call your realm what you like and you dont need to rely on your domain suffix... Thanks to all the required fiddling I have a much better understanding of the configuration files. If anyone is stuck with this just drop me a mail, Ill be happy to help :) Thanks again for your time and assistance Alan & Craig, appreciated as always, Patric