free radius behind a load balancer?
Hi all, Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute? -- Coy Hile coy.hile@coyhile.com
On Jan 14, 2021, at 10:39 AM, Coy Hile <coy.hile@coyhile.com> wrote:
Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute?
Lots of people put it behind a load balancer. The only real caveat is that if you're doing EAP, the load balancer has to be aware of that. And then load balance on things like the User-Name, instead of randomly spamming packets across the back-ends. IIRC things like the F5 load balancers don't do that. But FreeRADIUS as a load balancer will do that. :) Alan DeKok.
On Jan 14, 2021, at 10:43 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jan 14, 2021, at 10:39 AM, Coy Hile <coy.hile@coyhile.com> wrote:
Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute?
Lots of people put it behind a load balancer. The only real caveat is that if you're doing EAP, the load balancer has to be aware of that. And then load balance on things like the User-Name, instead of randomly spamming packets across the back-ends.
IIRC things like the F5 load balancers don't do that. But FreeRADIUS as a load balancer will do that. :)
Work isn’t doing that, at all. We’re simply using RADIUS to authenticate and authorize administrative access to network devices. Nothing cute. -- Coy Hile coy.hile@coyhile.com
Within the load-balancer you can setup session stickiness so that requests from clients stick with the same back-end server. Only if the health-check fails will it move those clients away. Same thing with accounting, you should bind both port 1812 and 1813 to the same stickiness profile. —Joe
On Jan 14, 2021, at 10:51 AM, Coy Hile <coy.hile@coyhile.com> wrote:
On Jan 14, 2021, at 10:43 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jan 14, 2021, at 10:39 AM, Coy Hile <coy.hile@coyhile.com> wrote:
Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute?
Lots of people put it behind a load balancer. The only real caveat is that if you're doing EAP, the load balancer has to be aware of that. And then load balance on things like the User-Name, instead of randomly spamming packets across the back-ends.
IIRC things like the F5 load balancers don't do that. But FreeRADIUS as a load balancer will do that. :)
Work isn’t doing that, at all. We’re simply using RADIUS to authenticate and authorize administrative access to network devices. Nothing cute.
-- Coy Hile coy.hile@coyhile.com <mailto:coy.hile@coyhile.com>
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>
On 15/01/2021, at 4:43 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jan 14, 2021, at 10:39 AM, Coy Hile <coy.hile@coyhile.com> wrote:
Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute?
Lots of people put it behind a load balancer. The only real caveat is that if you're doing EAP, the load balancer has to be aware of that. And then load balance on things like the User-Name, instead of randomly spamming packets across the back-ends.
IIRC things like the F5 load balancers don't do that. But FreeRADIUS as a load balancer will do that. :)
F5 can do that sort of stuff with iRules, which lets you parse packets in their DSL - so if you know the protocol and want to muck about with some code you can do most things. They have sample code to parse RADIUS online. However, modern (last.. I dunno 10 years?) F5 has better RADIUS awareness, and you can specify an attribute to be used for stickiness to a particular backend. "Persist Attribute” is the parameter. Of course - I would just use FreeRADIUS, but some places it fits their model to use F5 so that’s an option too. -- Nathan Ward
Yes, free-radius works great behind load-balancers. We have multiple clusters behind f5 load balancers. I would look at setting up a two-arm load balancer so that the originating IP address of the client is presented to the radius server. Outside of that, it won’t modify or change any attribute of the packet itself. —Joe
On Jan 14, 2021, at 10:39 AM, Coy Hile <coy.hile@coyhile.com> wrote:
Hi all,
Has anyone tried putting the FreeRADIUS server behind a load balancer? I see dynamic-clients does queries based on the Packet-Src-IP-Address, but can one reasonably do similar based on NAS-IP-Address (assuming that the client sends that attribute?
-- Coy Hile coy.hile@coyhile.com
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jan 14, 2021, at 10:45 AM, Joseph Nordone via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Yes, free-radius works great behind load-balancers. We have multiple clusters behind f5 load balancers. I would look at setting up a two-arm load balancer so that the originating IP address of the client is presented to the radius server. Outside of that, it won’t modify or change any attribute of the packet itself.
How do you mean? What specific things did you have to do for that to happen? (What I’ve seen is the NATed IP come through as the Packet-Src-IP-Address, rather than the machine from whence I was testing.) -- Coy Hile coy.hile@coyhile.com
On Jan 14, 2021, at 11:25 AM, Coy Hile <coy.hile@coyhile.com> wrote:
How do you mean? What specific things did you have to do for that to happen? (What I’ve seen is the NATed IP come through as the Packet-Src-IP-Address, rather than the machine from whence I was testing.)
That's a bad load balancer then. You want either a ethernet layer load balancer, which doesn't muck with the IP headers. Or, you want a RADIUS aware load balancer, which does the right things for RADIUS. What you have is a generic UDP load balancer. It receives UDP packets, and then re-sends them to the RADIUS server. You just can't do this with RADIUS. As you've seen, all packets will appear to come from the load balancer. It might "work", in that packets will go back and forth. But it won't be what you want. So... what are you using for the UDP layer load balancer? Alan DeKok.
Read this, even though its Cisco ISE, same principals apply. https://community.cisco.com/t5/security-documents/how-to-cisco-amp-f5-deploy... <https://community.cisco.com/t5/security-documents/how-to-cisco-amp-f5-deployment-guide-ise-load-balancing-using/ta-p/3631159> —Joe
On Jan 14, 2021, at 11:25 AM, Coy Hile <coy.hile@coyhile.com> wrote:
On Jan 14, 2021, at 10:45 AM, Joseph Nordone via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Yes, free-radius works great behind load-balancers. We have multiple clusters behind f5 load balancers. I would look at setting up a two-arm load balancer so that the originating IP address of the client is presented to the radius server. Outside of that, it won’t modify or change any attribute of the packet itself.
How do you mean? What specific things did you have to do for that to happen? (What I’ve seen is the NATed IP come through as the Packet-Src-IP-Address, rather than the machine from whence I was testing.)
-- Coy Hile coy.hile@coyhile.com
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 15/01/2021, at 5:25 AM, Coy Hile <coy.hile@coyhile.com> wrote:
On Jan 14, 2021, at 10:45 AM, Joseph Nordone via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Yes, free-radius works great behind load-balancers. We have multiple clusters behind f5 load balancers. I would look at setting up a two-arm load balancer so that the originating IP address of the client is presented to the radius server. Outside of that, it won’t modify or change any attribute of the packet itself.
How do you mean? What specific things did you have to do for that to happen? (What I’ve seen is the NATed IP come through as the Packet-Src-IP-Address, rather than the machine from whence I was testing.)
Packet-Src-IP-Address is the source IP of the packet as received by the RADIUS server - F5 (or other LB) doesn’t insert that, it’s not like X-Forwarded-For in HTTP land. You can disable SNAT in the F5 config to avoid that - the F5 has to be in the IP return path for that traffic from the client though - usually that means it’s the default gateway but of course there are more complicated environments where that’s not the case :-) -- Nathan Ward
participants (4)
-
Alan DeKok -
Coy Hile -
Joseph Nordone -
Nathan Ward