RADIUS, anycast, and high availability

[Alan DeKok]

Jason Healy wrote:
> We’re looking into using anycast and a group of servers for some of our stateless services (like DNS and NTP) to increase availability, as anycast “automatically” routes traffic to one machine in a group.  I’m wondering if RADIUS is a good candidate for this as well.  Being UDP-based is a good start, but I don’t know if the servers will get annoyed if (say) multiple packets in an EAP conversation don’t go to the same server.  DNS is much simpler as its usually single-shot (request -> reply).

  Anycast will work for RADIUS under the following conditions:

- only PAP, CHAP, or MS-CHAP is used
- all RADIUS servers share the same list of clients
  - including the same shared secret for each client <-> IP pair

> Basically: has anyone else tried it?  Or is this a Bad Idea and I just stick to regular multi-server with failover on the NAS?

  It will work.  NAS failover is generally horrible.

  Alan DeKok.