Load Balancing FreeRADIUS with CLUSTERIP
Hi, Does anyone have any experience of load balancing two or more FreeRADIUS servers using the iptables CLUSTERIP target? For those unaware, it allows a single IP address to be assigned to multiple servers. A multicast MAC address is used so that the traffic is forwarded to each server, then iptables uses hashing to determine if the receiving server should handle the traffic. The hashing can be based on the source IP, the source IP and destination port, or the source IP and both source and destination ports. I have a pair of FreeRADIUS servers that are backed by a four node MySQL Cluster. The FreeRADIUS servers are used by our peers in a primary/secondary configuration, and the secondary only ever receives requests if the primary is unavailable. This results in the secondary server idling 99.99% of the time. I'm considering assigning a CLUSTERIP to the servers so we can make full use of the resources. Does anyone see any potential issues of using this with FreeRADIUS or know of any caveats I should be aware of? I have some production SMTP and FTP clusters that are load balanced in a similar way, with Pacemaker handling the failover, that have been running quite well for over a year. Thanks. REW
Randy Wilson <randyedwilson@gmail.com> wrote:
Does anyone have any experience of load balancing two or more FreeRADIUS servers using the iptables CLUSTERIP target?
[snipped]
I have some production SMTP and FTP clusters that are load balanced in a similar way, with Pacemaker handling the failover, that have been running quite well for over a year.
We anycast our FreeRADIUS servers and have had great success with this. http://www.digriz.org.uk/ha-ospf-anycast No single points of failure to fail as the resilence is in your routers, if those fail you have bigger problems :) Cheers [1] also we do this for unbound (DNS resolver), squid (HTTP proxy) and syslog-ng -- Alexander Clouter .sigmonster says: Fine day for friends. So-so day for you.
Alexander Clouter <alex@digriz.org.uk> wrote:
We anycast our FreeRADIUS servers and have had great success with this.
Very interesting. Many thanks for that. May look into deploying this, especially for DNS. REW
Randy Wilson <randyedwilson@gmail.com> wrote:
We anycast our FreeRADIUS servers and have had great success with this.
Very interesting. Many thanks for that. May look into deploying this, especially for DNS.
The most surprising helpful and unexpected tool I got out of the deployment was the ease of being able to remove the service (unbound, freeradius, whatever) from active use by just sending SIGTSTP to the shell script daemon, and re-enabling it with SIGCONT...all on the server it's-self without having to interact with other servers/routers/switches. It makes fixes problematic services during working hours, rather than during official maintenance windows, possible and trivial. Another advantage though is that load-balancers are complicated and they have non-trivial failure states. Cheers -- Alexander Clouter .sigmonster says: You are as I am with You.
Randy Wilson wrote:
I'm considering assigning a CLUSTERIP to the servers so we can make full use of the resources. Does anyone see any potential issues of using this with FreeRADIUS or know of any caveats I should be aware of?
EAP won't work. It requires multi-packet round trips between one client and one server. But for accounting, and PAP/CHAP authentication, it will work fine. Alan DeKok.
Alan DeKok <aland@deployingradius.com> wrote:
Randy Wilson wrote:
I'm considering assigning a CLUSTERIP to the servers so we can make full use of the resources. Does anyone see any potential issues of using this with FreeRADIUS or know of any caveats I should be aware of?
EAP won't work. It requires multi-packet round trips between one client and one server.
If the hashing is stable (which it is, if I understand the CLUSTERIP feature of netfilter right) and thus one IP always connects to the same cluster server, EAP should work as well. And if one server goes down, EAP sessions in progress at that moment will fail anyway and need to be restarted with a new target server, no matter if one uses a classic primary/secondary setup or the clusterip variant. Grüße, Sven. -- Sig lost. Core dumped.
participants (4)
-
Alan DeKok -
Alexander Clouter -
Randy Wilson -
Sven Hartge