IPv4 *and* IPv6 addresses for home_servers and failover
Hello, I'd just just to check FreeRADIUS operates as I'm expecting (and have observed, in the limited amount of testing I've been able to do, before plugging things into the real world). I'm trying to get our FreeRADIUS 2.1.12 servers ready to handle IPv4 and IPv6 and, in particular, IPv6-accessible home_servers (e.g. the UK JANET Roaming NRPS ones). If I do: home_server ja-net-roaming0_server { ... I have to put ONE of: ipaddr = roaming0.ja.net ipv6addr = roaming0.ja.net ... which one I put will control whether IPv4 or IPv6 is used to contact that host. If so, does this mean that, if I want to allow the possibility of talking to the servers over IPv6 as well as IPv4 (and failing between one and other, if either are unavailable), I have to configure two distinct servers and set them up in the pool? e.g. home_server ja-net-roaming0_server { ipaddr = roaming0.ja.net [or the IPv4 address] ... } home_server ja-net-roaming0_server6 { ipv6addr = roaming0.ja.net [or the IPv6 address] ... } ... server_pool ja-net_pool { type = client-balance home_server = ja-net-roaming0_server home_server = ja-net-roaming0_server6 home_server = ja-net-roaming1_server home_server = ja-net-roaming1_server6 ... } This will mean that, when everything in the pool is up, some clients will always get an IPv4 home_server and some an IPv6 one. I just want to confirm there's no way to configure a single home server that can use both IPv4 and IPv6, or have ones that use IPv6 unless it's available, then fail back to IPv4, and that what I'm proposing above is the recommended way of doing this. [I realise that, if I configure them separately like this, I have to manually manage whether individual home servers have IPv4 or IPv6 registrations.] Thanks for your help, - Bob -- Bob Franklin <rcf34@cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service
Bob Franklin wrote:
I'd just just to check FreeRADIUS operates as I'm expecting (and have observed, in the limited amount of testing I've been able to do, before plugging things into the real world). I'm trying to get our FreeRADIUS 2.1.12 servers ready to handle IPv4 and IPv6 and, in particular, IPv6-accessible home_servers (e.g. the UK JANET Roaming NRPS ones).
It supports IPv6...
If I do:
home_server ja-net-roaming0_server {
... I have to put ONE of:
ipaddr = roaming0.ja.net ipv6addr = roaming0.ja.net
... which one I put will control whether IPv4 or IPv6 is used to contact that host.
Yes. That's how it works.
If so, does this mean that, if I want to allow the possibility of talking to the servers over IPv6 as well as IPv4 (and failing between one and other, if either are unavailable), I have to configure two distinct servers and set them up in the pool? e.g.
Yes.
server_pool ja-net_pool { type = client-balance home_server = ja-net-roaming0_server home_server = ja-net-roaming0_server6 home_server = ja-net-roaming1_server home_server = ja-net-roaming1_server6 ... }
This will mean that, when everything in the pool is up, some clients will always get an IPv4 home_server and some an IPv6 one.
That's a limitation of the current design. There are no "tiered" pools.
I just want to confirm there's no way to configure a single home server that can use both IPv4 and IPv6, or have ones that use IPv6 unless it's available, then fail back to IPv4, and that what I'm proposing above is the recommended way of doing this.
There's really not many ways of doing this simply.
[I realise that, if I configure them separately like this, I have to manually manage whether individual home servers have IPv4 or IPv6 registrations.]
That has to be managed manually. Home servers in RADIUS are tied to IP addresses. It *may* be possible to automatically create multiple home servers when the hostname resolves to multiple IPs. But that would require code changes. Alan DeKok.
Hi,
server_pool ja-net_pool { type = client-balance home_server = ja-net-roaming0_server home_server = ja-net-roaming0_server6 home_server = ja-net-roaming1_server home_server = ja-net-roaming1_server6 ... }
yes - but I wouldnt advise to do it that way - as all you are doing there is using one client balance - with the alternates being the same server.... ie roaming0 or roaming-ipv6 - if roaming0 was down/dead then the ipv6 one is too. so, better with eg ja-net-roaming0_server6 ja-net-roaming1_server6 ja-net-roaming2_server6 ja-net-roaming0_server ja-net-roaming2_server ja-net-roaming3_server ..or actually, why bother with IPv4 - just go native... ja-net-roaming0_server6 ja-net-roaming1_server6 ja-net-roaming2_server6 you might want to look at client-port-balance or the hashed balance method as you get more spread through the remote proxies then. also, keep the name in the config but add the IPv6/IP address in /etc/hosts (also, dont forget that you'll need to add a listener to your virtual-server or radiusd.conf too - you cannot have ipv4 and ipv6 listener in the same statement - you just add a second listener alan
On Wed, 13 Jun 2012, alan buxey wrote:
server_pool ja-net_pool { type = client-balance home_server = ja-net-roaming0_server home_server = ja-net-roaming0_server6 home_server = ja-net-roaming1_server home_server = ja-net-roaming1_server6 ... }
yes - but I wouldnt advise to do it that way - as all you are doing there is using one client balance - with the alternates being the same server.... ie roaming0 or roaming-ipv6
- if roaming0 was down/dead then the ipv6 one is too.
so, better with eg
ja-net-roaming0_server6 ja-net-roaming1_server6 ja-net-roaming2_server6 ja-net-roaming0_server ja-net-roaming2_server ja-net-roaming3_server
Reading the proxy.conf information, it says that if a particular home server is unavailable, the next one up in the list is used. Working that through with what happens in each case, your way does a better job of coping with a server going down; I think my way is better at coping with one of an IPv4 or IPv6 failure. The network connectivity should be more reliable than the servers themselves (not that I'm slighting the people running the NRPS, here ;-]) - as such, I think your way is better, so I'll do that.
..or actually, why bother with IPv4 - just go native...
ja-net-roaming0_server6 ja-net-roaming1_server6 ja-net-roaming2_server6
Maybe when things have been running on v6 for a while and I'm happy with all the other aspects of that. ;)
you might want to look at client-port-balance or the hashed balance method as you get more spread through the remote proxies then.
also, keep the name in the config but add the IPv6/IP address in /etc/hosts
I'll look at those - we certainly have the majority of our access from our two main wireless controllers - I haven't checked if those hash to different home servers.
(also, dont forget that you'll need to add a listener to your virtual-server or radiusd.conf too - you cannot have ipv4 and ipv6 listener in the same statement - you just add a second listener
Yup -- I have the client side going (although just on the EUI-64 address so far - not on the service address; getting that set up was something slightly lateral in the distribution we use). We have a large number of internal proxies/clients so work needs to be done on our configuration script to auto-generate the v4 and v6 client and home server entries. Thanks for yours and other Alan's help -- we should have this going in a couple of weeks, when we renumber the other of our two servers. - Bob -- Bob Franklin <rcf34@cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service
Working that through with what happens in each case, your way does a better job of coping with a server going down; I think my way is better at coping with one of an IPv4 or IPv6 failure.
How about mixing it up a bit more: roaming0_server roaming1_server6 roaming2_server roaming0_server6 roaming1_server roaming2_server6 ? -- George D M Ross MSc PhD CEng MBCS CITP, University of Edinburgh, School of Informatics, 10 Crichton Street, Edinburgh, Scotland, EH8 9AB Mail: gdmr@inf.ed.ac.uk Voice: 0131 650 5147 Fax: 0131 650 6899 PGP: 1024D/AD758CC5 B91E D430 1E0D 5883 EF6A 426C B676 5C2B AD75 8CC5 The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.
participants (4)
-
alan buxey -
Alan DeKok -
Bob Franklin -
George Ross