How can I set freeradius to connect to another freeradius server to find external database.
Hello all I need to setup 2 freeradius servers for mac address authentication. My scenario is Access point send access-request to 1st freeradius server to do mac address authentication .If 1st server doesn’t have MAC Address in database ,it must send this request to 2nd server(which is freeradius server too) to find in another database. I try to config proxy.conf file in 1st server as follow home_server pri_home_server { type = auth+acct ipaddr = localhost port = 1812 secret = xxx response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3}home_server sec_home_server { type = auth+acct ipaddr = xxx port = 1812 secret = xxx response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3} home_server_pool auth_failover_pool { type = fail-over home_server = pri_home_server home_server = sec_home_server} realm users{ type=radius auth_pool=auth_failover_pool acct_pool=auth_failover_pool nostrip} but it doesn’t work So the question is Do I need to config proxy.conf or others files ?or other method to setup for this scenario ? Any help is appreciated. Thanks in advance.
Hi,
but it doesn’t work
yep. that wont work. reason? because you proxied to the remote RADIUS. it didnt know the user and therefore you got a reject. once you get a reject then all bets are off with this config - the 'fail-over' is if there is no answer from the RADIUS server - at which point it will try the second server.
Do I need to config proxy.conf or others files ? or other method to setup for this scenario ?
personally? why do you have a second RADIUS server with the MAC info? why not consolidate? if not...so you have SQL access to the other RADIUS server? if so , then you can do a fall-through authentication eg use local mysql and if that fails, then dont care and hit the second mysql server eg change the current SQL config from sql { stuff detailing your servers etc } to sql first_sql_server{ stuff detailing the first server } sql second_sql_server{ stuff detailing second server } then, instead of calling 'sql' in the auth section, you call first_sql_server second_sql_server (with the relevant wrapper around it to ensure that if the first fails, then the second gets called... - check out the docs http://wiki.freeradius.org/Fail-over ) alan
participants (2)
-
Alan Buxey -
joe joe