W dniu 20.05.2022 o 14:01, Marek Zarychta pisze:

W dniu 20.05.2022 o 13:56, Mark Lybarger pisze:

...

hi,

i'm looking to have a health check for my freeradius servers. they're doing udp on 1812/1813, but my aws nlb only handles health check via tcp (http).  is there a way to expose an http port in addition to the udp ports for freeradius? or any clever ways to handle this?

thanks! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

M/Monit[1] can handle this. It's free tool with support for RADIUS protocol.

Works flawlessly.

[1]https://mmonit.com

Maybe I misled some people. I was to recommend Monit. M/Monit and Monit are not the same. M/Monit requires a license to run more than the 30-day trial. Monit does not require any license, it's AGPLv3 licensed. -- Marek Zarychta

These are great tips! So, freeradius can do udp on normal ports and tcp on another port? I'll start to play with it. On Fri, May 20, 2022, 9:59 AM Alan DeKok <aland@deployingradius.com> wrote:

On May 20, 2022, at 7:56 AM, Mark Lybarger <mlybarger@gmail.com> wrote:

...

i'm looking to have a health check for my freeradius servers. they're doing udp on 1812/1813, but my aws nlb only handles health check via tcp (http). is there a way to expose an http port in addition to the udp ports for freeradius? or any clever ways to handle this?

I'd second Monit. The RADIUS implementation there was contributed by myself, so I know it works. :) We use it all of the time in production.

According to this page, you can use TCP:

https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-healthch...

So you should be able to configure the source IP of the load balancer as a RADIUS client, and then listen on port 80:

listen { type = status proto = tcp ipaddr = * port = 80

clients = aws_nlb }

You'll also need to edit clients.conf, and add:

clients aws_nlb { client aws_nlb { ipaddr = ip.of.the.aws.nlb proto = tcp secret = "nothing" } }

The load balancer is not going to actually send any RADIUS packets. It will just connect, and then disconnect. But the above configuration should allow it to work.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html