radrelay: cross-replication of accounting records between two redundant freeradius servers
Hi List I've got radrelay replicating accounting packets from a primary radius server to a secondary radius server. The secondary radius server is capable of handling radius accounting/auth requests if NASes cannot reach the primary or the primary fails. I want to replicate packets from the secondary to the primary server in addition to replicating from primary to secondary, and so I tried setting up radrelay on the secondary identically to the one on the primary. The idea is to use radrelay as a simple mechanism to ensure that both servers have a copy of all the accounting packets. However, when I test sending accounting packets to the secondary, the two systems go into some kind of circular loop, neither being smart enough to recognise a replicated auth packet when it sees one :-) When I look at the incoming packet dumps I see accounting requests being replicated and responded to with ever-increasing numbers of Proxy-State attributes, until the radrelay instance crashes with a thread related error: --- Sending Accounting-Request of id 76 to 10.1.1.112 port 1646 User-Name = "morpork@ankh.morpork.org" Service-Type = Framed-User NAS-IP-Address = 196.7.321.6 NAS-Identifier = "196.7.321.6" NAS-Port = 1234 NAS-Port-Type = Async Acct-Session-Id = "00001234" Acct-Status-Type = Stop Called-Station-Id = "123456789" Calling-Station-Id = "987654321" Acct-Delay-Time = 5108 Acct-Session-Time = 1000 Acct-Input-Octets = 20000 Acct-Output-Octets = 30000 Proxy-State = 0x3231353235 Proxy-State = 0x3236333439 Proxy-State = 0x3135343437 Proxy-State = 0x3136313331 Proxy-State = 0x35383236 Proxy-State = 0x3435313436 Proxy-State = 0x3532303932 Proxy-State = 0x3137323331 Proxy-State = 0x39323331 Proxy-State = 0x3239343737 Proxy-State = 0x3435383237 Proxy-State = 0x3138313734 Proxy-State = 0x3239343138 Proxy-State = 0x373430 Proxy-State = 0x393131 . . --- My question is, how would i configure two-way replication in a scenario like this, without the loops ? Informational: Server 1/Primary : FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, (Debian squeeze/sid) Server 2/Secondary : FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu (CentOS 5.5) (both systems on the same physical network and subnet) Thanks in advance, Arch
Arch Mangle wrote:
I've got radrelay replicating accounting packets from a primary radius server to a secondary radius server. The secondary radius server is capable of handling radius accounting/auth requests if NASes cannot reach the primary or the primary fails. ... However, when I test sending accounting packets to the secondary, the two systems go into some kind of circular loop, neither being smart enough to recognise a replicated auth packet when it sees one :-)
You're replicating authentication packets? In any case... loops are simple to avoid. You don't proxy ALL packets back & forth. You only proxy the ones that came from real clients. You DON'T proxy ones which came from the other server.
My question is, how would i configure two-way replication in a scenario like this, without the loops ?
I'm presuming you're writing the accounting packets to the detail file, and then using radrelay to read that, and send them to the other server. When you write to do detail file, make it conditional, on the IP address of the source of the packet: if (Packet-Src-IP-Address != 1.2.3.4) { detail } Where "1.2.3.4" is the IP of the other server. Alan DeKok.
Hi Alan On Sat, Dec 17, 2011 at 3:47 PM, Alan DeKok <aland@deployingradius.com>wrote:
Arch Mangle wrote:
I've got radrelay replicating accounting packets from a primary radius server to a secondary radius server. The secondary radius server is capable of handling radius accounting/auth requests if NASes cannot reach the primary or the primary fails. ... However, when I test sending accounting packets to the secondary, the two systems go into some kind of circular loop, neither being smart enough to recognise a replicated auth packet when it sees one :-)
You're replicating authentication packets?
Sorry, mis-type! Accounting only.
In any case... loops are simple to avoid. You don't proxy ALL packets back & forth. You only proxy the ones that came from real clients. You DON'T proxy ones which came from the other server.
Agreed. So my question would be: how do I only proxy packets from real clients, not ones from the other server?
My question is, how would i configure two-way replication in a scenario like this, without the loops ?
I'm presuming you're writing the accounting packets to the detail file, and then using radrelay to read that, and send them to the other server.
That's what I'm doing.
When you write to do detail file, make it conditional, on the IP address of the source of the packet:
if (Packet-Src-IP-Address != 1.2.3.4) { detail }
Where "1.2.3.4" is the IP of the other server.
Thanks Alan, this works :-)
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Arch Mangle