Hi Stefan, Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements. -- Stephen On 6/15/2010 15:20, Stefan A. wrote:
Stephen,
what's about using instances in the sql.conf like
sql sql_virtual_1{ database = "mysql" driver = "rlm_sql_${database}" server = "dbcnode2" port="3306" login = "user" password = "pw" radius_db = "dbname" ...all the other stuff... }
Having several such sections, you'd be able to call them in cour virtual server as
authorize { preprocess chap mschap suffix eap { ok = return } unix --> sql_virtual_1 files expiration logintime pap }
You only have to exchange the values of server = "dbcnode2" port="3306" login = "user" password = "pw"
for each instance...
Does this help? Stefan
-----Original Message----- From: freeradius-users- bounces+a.freeradius=premit.de@lists.freeradius.org [mailto:freeradius- users-bounces+a.freeradius=premit.de@lists.freeradius.org] On Behalf Of Stephen Fulton Sent: Tuesday, June 15, 2010 8:43 PM To: freeradius user Subject: Virtual server specific SQL schema.
Greetings,
I am building an FR server using a shared MySQL database that will have multiple virtual servers. Each of the virtual servers needs to use different radcheck and radacct tables, each of which has a unique name (eg. radcheck1, radcheck2). The stated preference is that a single database be used, and the different tables reside within. For performance reasons, I would rather specify the DB server specific parameters (hostname, user/pass, maximum number of sockets etc) globally.
My question: Is it possible to use a global DB configuration as outlined above, but call the schema specific info from within a virtual server?
Thanks,
-- Stephen - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements.
What level of performance do you need - authentication/sec & accounting packets/sec? FreeRADIUS with MySQL is able to 1,000s of authentications/sec and reasonably large number of accounting packets/second. You should be able to tune MySQL to improve the performance. Tim
Tim, You're correct, though there are a few factors causing me to cautious. The first is I'm working on new, untested hardware, and given the complexity of the requirements, I'd rather defer to the knowledge of the list re: performance, before fully implementing it. The second is that the NAS'es which will communicate with this RADIUS cluster are known to drop auth requests and issue a denial if the response is not "quick" enough. Unfortunately this is a 3rd party managed set of NAS'es, and therefore limited in what I can do. All that said, I have no concerns about FR, its mainly the DB and the 3rd party NAS'es. -- Stephen On 6/15/2010 16:00, Tim Sylvester wrote:
Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements.
What level of performance do you need - authentication/sec& accounting packets/sec? FreeRADIUS with MySQL is able to 1,000s of authentications/sec and reasonably large number of accounting packets/second. You should be able to tune MySQL to improve the performance.
Tim
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Stephen, I had have the same problem a few years ago. In our case, the Firewall was broken and dropped Auth Accept packets on their way to 2 of the 10 NASs. We got flooded with requests from this NAS at a rate of about 600/s At these days, the RADIUS Server was capable of handling only 200/s and literally stopped working after a few minutes... As the radius server won't be able to deal with this situations, we configures QoS on the Cisco router in front of the RADIUS Server. We calculated the size of a single Access Request Packet, multiplied it with 200 and set this as the maximum bytes to pass per second on :1812 . We did not QoS Accounting packets, as they are needed to keep sessions and IP Pools clean. It's working since these days... Using Telnet, we are checking the counters on regular basis, which proves, that it is needed from time to time... We have shared the QoS bandwidth over the actual 22 NASs. If some of them go creasy, the others will be served as usual. So If you problem comes from outside and is known as an error at the NAS, you might think about such solution. Regards Stefan
-----Original Message----- From: freeradius-users- bounces+a.freeradius=premit.de@lists.freeradius.org [mailto:freeradius- users-bounces+a.freeradius=premit.de@lists.freeradius.org] On Behalf Of Stephen Fulton Sent: Tuesday, June 15, 2010 10:46 PM To: FreeRadius users mailing list Subject: Re: Virtual server specific SQL schema.
Tim,
You're correct, though there are a few factors causing me to cautious. The first is I'm working on new, untested hardware, and given the complexity of the requirements, I'd rather defer to the knowledge of the list re: performance, before fully implementing it. The second is that the NAS'es which will communicate with this RADIUS cluster are known to drop auth requests and issue a denial if the response is not "quick" enough. Unfortunately this is a 3rd party managed set of NAS'es, and therefore limited in what I can do.
All that said, I have no concerns about FR, its mainly the DB and the 3rd party NAS'es.
-- Stephen
Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements.
What level of performance do you need - authentication/sec& accounting packets/sec? FreeRADIUS with MySQL is able to 1,000s of authentications/sec and reasonably large number of accounting packets/second. You should be able to tune MySQL to improve the performance.
Tim
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 6/15/2010 16:00, Tim Sylvester wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
You're correct, though there are a few factors causing me to cautious. The first is I'm working on new, untested hardware, and given the complexity of the requirements, I'd rather defer to the knowledge of the list re: performance, before fully implementing it. The second is that the NAS'es which will communicate with this RADIUS cluster are known to drop auth requests and issue a denial if the response is not "quick" enough. Unfortunately this is a 3rd party managed set of NAS'es, and therefore limited in what I can do.
All that said, I have no concerns about FR, its mainly the DB and the 3rd party NAS'es.
OK. That makes sense. What I should have said in my previous message is that FreeRADIUS should be able perform 1,000s of authentications/second with the "normal" configuration. The best way to approach this performance optimization is to start with the standard installation of FreeRADIUS and configure FR to use MySQL and increase the number of SQL connections to 20 to 50 connections. Then benchmark the performance using radclient or radperf (http://networkradius.com/radperf.html). If you have enough performance, you are done. If not, then start optimizing the database performance, test and repeat. Google MySQL performance for ton of information on database optimization. If you are concerned about the authentication performance, then you should move the accounting function to a separate server. You should not have to resort to complicated FR configurations to improve performance. Tim
Stephen Fulton wrote:
The second is that the NAS'es which will communicate with this RADIUS cluster are known to drop auth requests and issue a denial if the response is not "quick" enough. Unfortunately this is a 3rd party managed set of NAS'es, and therefore limited in what I can do.
Refer them to RFC 5080, which has a recommended retransmit policy. i.e. ask them to implement RADIUS. :) If you want to share one MySQL instance across multiple virtual servers, it's relatively easy. The MySQL queries are editable for a reason. Change the ${authcheck_table} references to %{SQL-Auth-Check-Table} and similarly for the rest of the table names. Go to raddb/dictionary, and define SQL-Auth-Check-Table as a "string" attribute. Then for each virtual server "authorize" and "preacct" sections, do: update request { SQL-Auth-Check-Table := "table-for-this-vs" ... } i.e. add a layer of indirection for the table names, and update them in each virtual server. Alan DeKok.
participants (4)
-
Alan DeKok -
Stefan A. -
Stephen Fulton -
Tim Sylvester