Virtual Server Pool Problem
Hello all, I am attempting to setup a FreeRADIUS server to listen only on one IP address, but have two virtual servers. At the moment I am testing with simple servers, one that accepts and one that rejects. I have a freeradius server that is dependent on another server, and want to provide an alternate authentication method when the server is down. I sort of have an idea but i feel far from getting to a working setup. The following is part of my setup configuration. listen { type = auth ipaddr = 192.168.100.251 port = 1812 virtual_server = primary } listen { ipaddr = 192.168.100.251 port = 1813 type = acct virtual_server = primary } server primary { authorize { update control { Auth-Type := Reject } } ... } server secondary { authorize { update control { Auth-Type := Accept } } } proxy server { default_fallback = yes } home_server first { type = auth+acct ipaddr = 192.168.100.251 #virtual_server = primary port = 1812 secret = secret require_message_authenticator = no ... } home_server second { virtual_server = secondary type = auth+acct port = 1822 secret = secret } home_server_pool my_auth_failover { type = fail-over home_server = first home_server = second } This is the result from radtest [root@chive raddb]# radtest test test123 192.168.100.251 1812 secret Sending Access-Request of id 239 to 192.168.100.251 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 192.168.100.251 port 1812, id=239, length=20 [root@chive raddb]# This is the result after I use radmin to set home_server as dead (set home_server state 192.168.100.251 812 dead): [root@localhost raddb]# radtest test test123 192.168.100.251 1812 secret Sending Access-Request of id 1 to 192.168.100.251 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 192.168.100.251 port 1812, id=1, length=20 [root@localhost raddb]# It is my understanding that once a home_server is dead, it tries the next one, but here I see that port 1812 is still used instead of 1822. Your help is greatly appreciated. Thanks, Manny ----- Test. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Virtual-Server-Pool-Problem-tp571361... Sent from the FreeRadius - User mailing list archive at Nabble.com.
So what I want to do is the following: Have two virtual servers listening on one IP and port (e.g. 192.168.100.251 1812) so that when the primary server fails or is down, the requests are proxied to the secondary virtual server. Is this possible? I want to be able to point to only one IP port pair but have multiple instances of freeradius server. ----- Test. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Virtual-Server-Pool-Problem-tp571361... Sent from the FreeRadius - User mailing list archive at Nabble.com.
manny wrote:
I am attempting to setup a FreeRADIUS server to listen only on one IP address, but have two virtual servers.
The documentation says that packets coming from a "listen" section go to one virtual server. You will need to have multiple "listen" sections.
At the moment I am testing with simple servers, one that accepts and one that rejects. I have a freeradius server that is dependent on another server, and want to provide an alternate authentication method when the server is down.
What you can do is to put the home servers into a fail-over pool. Have the proxy fail over from the external home server, to one that you control.
home_server_pool my_auth_failover { type = fail-over home_server = first home_server = second }
That should works.
This is the result from radtest
<sigh> If you're debugging the server, why are you looking at radtest, instead of the output of "radiusd -X"? This is documented in the FAQ, web page, documentation, "man" pages, and daily on this list.
[root@localhost raddb]# radtest test test123 192.168.100.251 1812 secret Sending Access-Request of id 1 to 192.168.100.251 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 192.168.100.251 port 1812, id=1, length=20 [root@localhost raddb]#
It is my understanding that once a home_server is dead, it tries the next one, but here I see that port 1812 is still used instead of 1822.
You do understand that "radtest" is not a RADIUS server, right? Radtest will send packets to where *you* tell it to send packets. Here, you've told it to send packets to port 1812. So it does that. radtest is *not* FreeRADIUS. Again, look at the debug output of the *server* to see how the *server* is behaving. Alan DeKok.
I got it working, but rlm_perl accesses a web service that could possibly be unavailable. How can I declare the virtual server to be dead within rlm_perl. In simple terms, how can I do the equivalent of the following with unlang. radmin> set home_server state IP PORT dead ----- Test. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Virtual-Server-Pool-Problem-tp571361... Sent from the FreeRadius - User mailing list archive at Nabble.com.
manny wrote:
I got it working, but rlm_perl accesses a web service that could possibly be unavailable. How can I declare the virtual server to be dead within rlm_perl. In simple terms, how can I do the equivalent of the following with unlang.
radmin> set home_server state IP PORT dead
You can't set a home server dead using unlang. You can't set a virtual server dead. Alan DeKok.
participants (2)
-
Alan DeKok -
manny