Hi every body,, I have fallen into a serious trouble :( I have configured a proxy server, that is proxying all incoming requests to two backend servers. in 'proxy.conf' i have configured 'type=client-balance' so that it can work with EAP. Now i wanna do load testing of this configuration with EAP-TLS. So with configuration i need to have a lot of NAS, with different IP's. But I only have 2. Could any one please help me in this situation. Could please suggest me a tool or a guideline to achieve my goal. Thanks in advance
Hi,
requests to two backend servers. in 'proxy.conf' i have configured 'type=client-balance' so that it can work with EAP.
client-port-balance
Now i wanna do load testing of this configuration with EAP-TLS. So with configuration i need to have a lot of NAS, with different IP's. But I only have 2.
the NAS should be sending their requests using different ports and this other balance method will be fine
Could any one please help me in this situation. Could please suggest me a tool or a guideline to achieve my goal.
up until now, we are not sure what your goal really is - you seem to be doing a lot of testing but with no real requirements or case. alan
On 2/20/13, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
requests to two backend servers. in 'proxy.conf' i have configured 'type=client-balance' so that it can work with EAP.
client-port-balance
Now i wanna do load testing of this configuration with EAP-TLS. So with configuration i need to have a lot of NAS, with different IP's. But I only have 2.
the NAS should be sending their requests using different ports and this other balance method will be fine
Could any one please help me in this situation. Could please suggest me a tool or a guideline to achieve my goal.
up until now, we are not sure what your goal really is - you seem to be doing a lot of testing but with no real requirements or case.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University thanc A.L.M for your answer,, My primary goal is to configure a fast system to authenticate EAP-TLS requests. For this purpose i used proxy (to distribute requests to different freeradius servers). Now i just wanna confirm NumberOfRequests/second , handled by my system.
Hi,
My primary goal is to configure a fast system to authenticate EAP-TLS requests. For this purpose i used proxy (to distribute requests to different freeradius servers). Now i just wanna confirm NumberOfRequests/second , handled by my system.
what is fast? (I can make a RADIUS server faster by chucking more CPU power at it.. 8 core Xeon instead of a core duo II etc.) - what are your actual requirements? ie what number of concurrent client connections/authentications are you looking for, what EAP methods (each method has its own quirks/requirements/number of packets) have you looked at crypto offloading technology to take CPU load down as part of this requirement? what AAA policy are you going to have for EAP-TLS - CRL? dynamic checking? (each has their own load/impact) do you need this proxy? Can your kit be configured to just talk directly to a few back end RADIUS servers? what is the purpose of this proxy? alan
On 2/20/13, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
My primary goal is to configure a fast system to authenticate EAP-TLS requests. For this purpose i used proxy (to distribute requests to different freeradius servers). Now i just wanna confirm NumberOfRequests/second , handled by my system.
what is fast? (I can make a RADIUS server faster by chucking more CPU power at it.. 8 core Xeon instead of a core duo II etc.) - what are your actual requirements? ie what number of concurrent client connections/authentications are you looking for, what EAP methods (each method has its own quirks/requirements/number of packets) have you looked at crypto offloading technology to take CPU load down as part of this requirement? what AAA policy are you going to have for EAP-TLS - CRL? dynamic checking? (each has their own load/impact)
do you need this proxy? Can your kit be configured to just talk directly to a few back end RADIUS servers? what is the purpose of this proxy?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
ie what number of concurrent client connections/authentications are you looking about 250/sec for, what EAP methods (each method has its own quirks/requirements/number of packets) EAP-TLS what is the purpose of this proxy? Basic purpose is 'load-balancing' on a cluster of Freeradius servers.
I am donot using any 3rd party Load balancing Tool (like Virtual Linux server etc etc). -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
Hi,
Basic purpose is 'load-balancing' on a cluster of Freeradius servers.
why? do you need to load-balance in this manner? can your clients not do any load balancing? the FR balance code works....as you say, if you only have 2 NAS then you only get 50/50 - with more it will spread. apart from some academic research/course assignment I am still wondering why you are putting this into place. alan
On 2/20/13, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Basic purpose is 'load-balancing' on a cluster of Freeradius servers.
why? do you need to load-balance in this manner? can your clients not do any load balancing? the FR balance code works....as you say, if you only have 2 NAS then you only get 50/50 - with more it will spread.
apart from some academic research/course assignment I am still wondering why you are putting this into place.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanx alan
why? do you need to load-balance in this manner? Is there any other way to do this??? suppose i have hundreds of NAS, how their requests can be sent in parallel, to different FR??? Is FR support such a mechanism without using REALM and PROXY??? If yes.,........ what is it???
-- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
Hi,
Is there any other way to do this??? suppose i have hundreds of NAS, how their requests can be sent in parallel, to different FR??? Is FR support such a mechanism without using REALM and PROXY??? If yes.,........ what is it???
1) why would you want to send a request from a NAS in parallel to different servers? that is just asking for major problems 2) what NAS kit are yu dealing with? Can this kit not do its own load-balancing? 3) are you simply balancing realm targets? - why just one proxy anyway? that would be single point failure and bottleneck. have multiple proxies alan
On 2/20/13, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Is there any other way to do this??? suppose i have hundreds of NAS, how their requests can be sent in parallel, to different FR??? Is FR support such a mechanism without using REALM and PROXY??? If yes.,........ what is it???
1) why would you want to send a request from a NAS in parallel to different servers? that is just asking for major problems
2) what NAS kit are yu dealing with? Can this kit not do its own load-balancing?
3) are you simply balancing realm targets? - why just one proxy anyway? that would be single point failure and bottleneck. have multiple proxies
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanx alan, now we are aligned :)
1) why would you want to send a request from a NAS in parallel to different servers? that is just asking for major problems I dont want to do this,,, I just want that requests from NAS (Their are thousands of NAS, which send requests for AAA to FR) should be distributed among many backend Free Radius servers.
2) what NAS kit are yu dealing with? Can this kit not do its own load-balancing?
No it didnot,
3) are you simply balancing realm targets? - why just one proxy anyway? that would be single point failure and bottleneck. have multiple proxies
Yes this was in my mind, so further research cleared me that a NAS have some backup server IP's (may have multiple backup IP's that can be used if a proxy server become down). So i can configure multiple Proxy servers, which are load balancing among same Freeradius servers. hopefully u understand the scenario. Thanks -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
Hi,
be used if a proxy server become down). So i can configure multiple Proxy servers, which are load balancing among same Freeradius servers. hopefully u understand the scenario. Thanks
okay. so back to the other questions - how many clients and what sort of auths/sec speed are you looking for? you can run a whole campus infrastructure from one single RADIUS server on 3yr old hardware with over 10k concurrent users - depending on AAA requirements and policy. the same server can choke if the backend uses some single threaded table locking junk like MySQL ;-) alan
On 2/20/13, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
be used if a proxy server become down). So i can configure multiple Proxy servers, which are load balancing among same Freeradius servers. hopefully u understand the scenario. Thanks
okay. so back to the other questions - how many clients and what sort of auths/sec speed are you looking for? you can run a whole campus infrastructure from one single RADIUS server on 3yr old hardware with over 10k concurrent users - depending on AAA requirements and policy.
the same server can choke if the backend uses some single threaded table locking junk like MySQL ;-)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
thanx alan
how many clients and what sort of auths/sec speed are you looking for? EAP-TLS and about 250 requests/second, and client can be up to 0.5 million to 1.5 million (its just not a campus project, this could be used for commercial purpose , but i am not quite sure, wether it will be or not ;( ) the same server can choke if the backend uses some single threaded table locking dont worry about this ,, I have a clustered, high speed and indexed database as backend database. -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
On 2/20/13, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
requests to two backend servers. in 'proxy.conf' i have configured 'type=client-balance' so that it can work with EAP.
client-port-balance
Now i wanna do load testing of this configuration with EAP-TLS. So with configuration i need to have a lot of NAS, with different IP's. But I only have 2.
the NAS should be sending their requests using different ports and this other balance method will be fine
Could any one please help me in this situation. Could please suggest me a tool or a guideline to achieve my goal.
up until now, we are not sure what your goal really is - you seem to be doing a lot of testing but with no real requirements or case.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
And A.L.M, i have used type=client-port-balance,,,, But it didnot make any difference from previous (type=client-balance). What could be the issue.\???/ -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
participants (2)
-
A.L.M.Buxey＠lboro.ac.uk -
Muhammad Nadeem