Freeradius Clustering for HA
Hi Freeradius users , Im planning to move my Radius service to a virtualized enviroment so I can create a server cluster. Is there any official / unofficial documentation about freeradius clustering for HA to start reading ? Maybe some feature for primary and secondary radius support or F5 load balancer integration, etc. Regards, Leandro.
Am Dienstag, 2. Juni 2015, 16:08:15 schrieb Leandro:
Hi Freeradius users , Im planning to move my Radius service to a virtualized enviroment so I can create a server cluster. Is there any official / unofficial documentation about freeradius clustering for HA to start reading ? Maybe some feature for primary and secondary radius support or F5 load balancer integration, etc. Regards, Leandro.
Basically building a HA cluster of RADIUS servers is a bad idea. The protocol supports the use of multiple RADIUS servers. So there is no need for HA. HA causes a lot of pain if you want to do it really right. Set up two (or more) radius servers and configure both IP addresses in your RADIUS clients. If you really need a load balancer, it still is no HA cluster. Just set up two (or more) RADIUS servers and hode them behind a virtual IP address of the load balancer. Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein
On Jun 2, 2015, at 3:14 PM, Michael Schwartzkopff <ms@sys4.de> wrote:
Basically building a HA cluster of RADIUS servers is a bad idea. The protocol supports the use of multiple RADIUS servers. So there is no need for HA. HA causes a lot of pain if you want to do it really right.
Many RADIUS clients are *very* bad at fail-over. They might take 2 RADIUS servers in "fail-over" mode, and fail over from one to the other. BUT they will often never fail back. Even if the second RADIUS server goes down. An HA system can be better. Though HA is complicated, too.
Set up two (or more) radius servers and configure both IP addresses in your RADIUS clients.
If the RADIUS clients are sane. Which is not always the case.
If you really need a load balancer, it still is no HA cluster. Just set up two (or more) RADIUS servers and hode them behind a virtual IP address of the load balancer.
Or, set up a VM with FreeRADIUS as a proxy. It can be tiny, because it has nearly no configuration. It shouldn't go down, because it's not doing anything. If it does go down, you can reboot the entire VM in less than a second/ Alan DeKok.
Thanks again Alan !!!! On 02/06/15 16:32, Alan DeKok wrote:
On Jun 2, 2015, at 3:14 PM, Michael Schwartzkopff <ms@sys4.de> wrote:
Basically building a HA cluster of RADIUS servers is a bad idea. The protocol supports the use of multiple RADIUS servers. So there is no need for HA. HA causes a lot of pain if you want to do it really right. Many RADIUS clients are *very* bad at fail-over. They might take 2 RADIUS servers in "fail-over" mode, and fail over from one to the other. BUT they will often never fail back. Even if the second RADIUS server goes down.
An HA system can be better. Though HA is complicated, too.
Set up two (or more) radius servers and configure both IP addresses in your RADIUS clients. If the RADIUS clients are sane. Which is not always the case.
If you really need a load balancer, it still is no HA cluster. Just set up two (or more) RADIUS servers and hode them behind a virtual IP address of the load balancer. Or, set up a VM with FreeRADIUS as a proxy. It can be tiny, because it has nearly no configuration. It shouldn't go down, because it's not doing anything. If it does go down, you can reboot the entire VM in less than a second/
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for your advice Michael!!! Leandro. On 02/06/15 16:14, Michael Schwartzkopff wrote:
Am Dienstag, 2. Juni 2015, 16:08:15 schrieb Leandro:
Hi Freeradius users , Im planning to move my Radius service to a virtualized enviroment so I can create a server cluster. Is there any official / unofficial documentation about freeradius clustering for HA to start reading ? Maybe some feature for primary and secondary radius support or F5 load balancer integration, etc. Regards, Leandro. Basically building a HA cluster of RADIUS servers is a bad idea. The protocol supports the use of multiple RADIUS servers. So there is no need for HA. HA causes a lot of pain if you want to do it really right.
Set up two (or more) radius servers and configure both IP addresses in your RADIUS clients.
If you really need a load balancer, it still is no HA cluster. Just set up two (or more) RADIUS servers and hode them behind a virtual IP address of the load balancer.
Mit freundlichen Grüßen,
Michael Schwartzkopff
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have in my smb.conf this line log file = /usr/local/samba/var/LOGS/%U.%m.log But when I see this log sometime do not show the username example jonh.10.10.1.53.log PC38.10.10.1.38.log Why PC38 log do not show the username
On 2 Jun 2015, at 15:40, sandy.napoles@eccmg.cupet.cu wrote:
I have in my smb.conf this line
log file = /usr/local/samba/var/LOGS/%U.%m.log
But when I see this log sometime do not show the username example
jonh.10.10.1.53.log PC38.10.10.1.38.log
Why PC38 log do not show the username
Did you mean to send this to the samba list? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
sorry....sorry, it is a wrong mail list...sorry please
On 2 Jun 2015, at 15:40, sandy.napoles@eccmg.cupet.cu wrote:
I have in my smb.conf this line
log file = /usr/local/samba/var/LOGS/%U.%m.log
But when I see this log sometime do not show the username example
jonh.10.10.1.53.log PC38.10.10.1.38.log
Why PC38 log do not show the username
Did you mean to send this to the samba list?
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
Leandro -
Michael Schwartzkopff -
sandy.napoles＠eccmg.cupet.cu