FreeRadius Load balancing AWS Network Load Balancer
Hi, We're implementing containerised Freeradius servers on AWS which we intend to scale horizontally to accommodate current load. We use ECS Fargate and currently have 6 servers running behind a Network Load balancer. Each of these servers have exactly the same configuration and connect to a centralised RDS database. We've tested this setup and it's all looking successful. Ran performance tests using eapol_test pointed at the load balancer. The fear was that authentication requests could be broken up and fail when distributed incorrectly to the containers. This seems to not be an issue because of a concept known as the "UDP Flow" ( https://aws.amazon.com/blogs/containers/aws-fargate-now-supports-udp-load-ba...) with AWS Network load balancers. For extra assurance on this proof of concept, I wanted to check if anyone is aware any potential pitfalls with this design that I might be missing? It looks like the Radius servers don't keep much state in memory (beyond eap sessions), which would be a problem. Beyond that, does this architecture design sound feasible? Thanks, Emile
On May 21, 2021, at 7:55 AM, Emile Swarts <emile.swarts123@gmail.com> wrote:
We've tested this setup and it's all looking successful. Ran performance tests using eapol_test pointed at the load balancer. The fear was that authentication requests could be broken up and fail when distributed incorrectly to the containers. This seems to not be an issue because of a concept known as the "UDP Flow" ( https://aws.amazon.com/blogs/containers/aws-fargate-now-supports-udp-load-ba...) with AWS Network load balancers.
That's new, then. Last I looked (a while ago), it didn't do that.
For extra assurance on this proof of concept, I wanted to check if anyone is aware any potential pitfalls with this design that I might be missing? It looks like the Radius servers don't keep much state in memory (beyond eap sessions), which would be a problem. Beyond that, does this architecture design sound feasible?
Yes. If the NAS is sending packets directly to the load balancer, it's fine. When there are proxies involved, the EAP packets from the NAS *might* take different paths through the network. But it's likely not a huge issue. Alan DeKok.
participants (2)
-
Alan DeKok -
Emile Swarts