load balanced freeradius
Is there a way to setup FreeRADIUS with HAProxy? I know that FreeRADIUS can do TCP. But is it worth it to set it up like this or just setup the mysql backend? Also can I do mysql backend with LDAP? Thank you!
On 07/03/2017 01:51 PM, Andrew Meyer via Freeradius-Users wrote:
Is there a way to setup FreeRADIUS with HAProxy? I know that FreeRADIUS can do TCP. But is it worth it to set it up like this or just setup the mysql backend? Also can I do mysql backend with LDAP? Thank you! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
why not continue using UDP, for the speed/performance, and setup anycast to share load between your FR instances? i do, and have no issues at all. not sure what you mean about mysql and ldap? i point to mysql (actually mariadb) for audit, etc, and that is a load balanced VIP of 3 instances behind HAProxy. I also point to Kerberos/LDAP for AuthN/AuthZ respectively. what are you looking to do?
I'm looking to setup FreeRADIUS to work with FreeIPA (AD replacement) and have my network gear authenticate to it. I am doing all the testing in my home lab and writing my own instructions. So I can really create a VIP, but I can use HAProxy. And I did have this setup about 3 weeks ago. But I tore it all down to do it the right way and document the procedure for all steps required. On Monday, July 3, 2017 1:20 PM, Brendan Kearney <bpk678@gmail.com> wrote: On 07/03/2017 01:51 PM, Andrew Meyer via Freeradius-Users wrote:
Is there a way to setup FreeRADIUS with HAProxy? I know that FreeRADIUS can do TCP. But is it worth it to set it up like this or just setup the mysql backend? Also can I do mysql backend with LDAP? Thank you! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
why not continue using UDP, for the speed/performance, and setup anycast to share load between your FR instances? i do, and have no issues at all. not sure what you mean about mysql and ldap? i point to mysql (actually mariadb) for audit, etc, and that is a load balanced VIP of 3 instances behind HAProxy. I also point to Kerberos/LDAP for AuthN/AuthZ respectively. what are you looking to do? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 3, 2017, at 1:51 PM, Andrew Meyer via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Is there a way to setup FreeRADIUS with HAProxy?
If HAproxy blindly forwards TCP connections, just use that.
I know that FreeRADIUS can do TCP. But is it worth it to set it up like this or just setup the mysql backend?
It's generally not worth doing haproxy. RADIUS loads are usually small. And I have no idea what haproxy on the front-end has to do with MySQL on the back-end. They are completely independent.
Also can I do mysql backend with LDAP?
You can use MySQL and LDAP at the same time, yes. Alan DeKok.
participants (3)
-
Alan DeKok -
Andrew Meyer -
Brendan Kearney