TCP - FR3 client/server connection timeout
With TCP/TLS I have a curious comportment Imagine this scenario: # server : port case (1) FR3:33001 -> radsecproxy:2083 case (2) radsecproxy: 44001 -> FR3:2083 For case (1) FR3 is the client, and radsecproxy is the server. Case (2) shows FR3 as a server of radsecproxy for TCP/TLS connections. In case (1) FR3 TCP connection always keeps ESTABLISHED with radsecproxy, but in case (2) FR3 closes its connection with radsecproxy (client) after less than 1 minute (sending a FIN, normal...). So, is it possible to set FR3 to don't send FIN and close the TCP connection with radsecproxy client? Thank you, --E
On Jul 20, 2017, at 5:19 PM, Edelberto Franco <esilva@midiacom.uff.br> wrote:
With TCP/TLS I have a curious comportment Imagine this scenario:
# server : port case (1) FR3:33001 -> radsecproxy:2083 case (2) radsecproxy: 44001 -> FR3:2083
For case (1) FR3 is the client, and radsecproxy is the server. Case (2) shows FR3 as a server of radsecproxy for TCP/TLS connections.
In case (1) FR3 TCP connection always keeps ESTABLISHED with radsecproxy, but in case (2) FR3 closes its connection with radsecproxy (client) after less than 1 minute (sending a FIN, normal...).
So, is it possible to set FR3 to don't send FIN and close the TCP connection with radsecproxy client?
Read the "tls" virtual server, and look for "idle_timeout". This is documented. Alan DeKok.
Em 20-Jul-17 6:23 PM, Alan DeKok escreveu:
On Jul 20, 2017, at 5:19 PM, Edelberto Franco <esilva@midiacom.uff.br> wrote:
With TCP/TLS I have a curious comportment Imagine this scenario:
# server : port case (1) FR3:33001 -> radsecproxy:2083 case (2) radsecproxy: 44001 -> FR3:2083
For case (1) FR3 is the client, and radsecproxy is the server. Case (2) shows FR3 as a server of radsecproxy for TCP/TLS connections.
In case (1) FR3 TCP connection always keeps ESTABLISHED with radsecproxy, but in case (2) FR3 closes its connection with radsecproxy (client) after less than 1 minute (sending a FIN, normal...).
So, is it possible to set FR3 to don't send FIN and close the TCP connection with radsecproxy client? Read the "tls" virtual server, and look for "idle_timeout". We were changed "idle_timeout" and other parameters in 'limit block' to 'tls' virtual server to high numbers (and infinite too), but TCP connection in case (2) keeps to be finalized
--E
This is documented.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 21, 2017, at 8:28 AM, Edelberto Franco <esilva@midiacom.uff.br> wrote:
We were changed "idle_timeout" and other parameters in 'limit block' to 'tls' virtual server to high numbers (and infinite too), but TCP connection in case (2) keeps to be finalized
Then: a) read the debug output to see why FreeRADIUS is closing the connection b) read the debug output to see why the client is closing the connection There's no magic here. ALL of the information you need to solve the problem is in the debug output. All you need to do is read it. If you don't understand it, post it here. This isn't complicated. We ask DAILY for people to post debug output, and for some reason, a significant percentage of them refuse. Alan DeKok.
participants (2)
-
Alan DeKok -
Edelberto Franco