How to cache the EAP-TLS session-state in redis
Hi all, We have some radius server pods with an external load balancer in front of them. So, when the TLS requests come from the load balancer, there will be an error sometimes as follows: ERROR: (2208) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x64000d7e672c0070 Can I save the session state in Redis and share it with multiple RADIUS servers? I noticed that there is a cache TLS session module in FreeRADIUS 4.0.0, but I am using FreeRADIUS 3.2.0. Thanks. James
On Jun 10, 2024, at 23:43, James Fan <polysorb@gmail.com> wrote:
Hi all, We have some radius server pods with an external load balancer in front of them. So, when the TLS requests come from the load balancer, there will be an error sometimes as follows:
ERROR: (2208) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x64000d7e672c0070
Can I save the session state in Redis and share it with multiple RADIUS servers?
Not how you want. AFAIK there's no way of serialising a SSL * (an OpenSSL TLS session) and transferring it to another server. You can serialise the TLS session resumption data and share it between a cluster, but your load balancer still needs to be capable of routing related requests to the same node for the initial authentication attempt. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks for answering my question. I still have a specific question regarding the configuration of multiple server instances. If we have multiple FreeRADIUS server instances with a load balancer in front of them, how do we ensure the TLS session is successful? The handshake requests will be sent to different servers, which will cause the session mismatching issue. Do we need to use the load balancer settings, or is the FreeRADIUS server able to handle this? On Tue, Jun 11, 2024 at 11:51 AM Arran Cudbard-Bell via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Not how you want. AFAIK there's no way of serialising a SSL * (an OpenSSL TLS session) and transferring it to another server.
You can serialise the TLS session resumption data and share it between a cluster, but your load balancer still needs to be capable of routing related requests to the same node for the initial authentication attempt.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 17, 2024, at 4:33 AM, James Fan <polysorb@gmail.com> wrote:
If we have multiple FreeRADIUS server instances with a load balancer in front of them, how do we ensure the TLS session is successful?
Configure the load balancer to send all packets for the same TLS session to the same back-end server. That's what Arran said in his reply to you.
The handshake requests will be sent to different servers, which will cause the session mismatching issue.
Exactly.
Do we need to use the load balancer settings, or is the FreeRADIUS server able to handle this?
Configure the load balancer correctly. Alan DeKok.
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
James Fan