Discarding Duplicate Request

[Rando Nakarmi]

when I set winbind max domain connections = 12

I get following message

Ignoring unknown parameter "winbind max domain connections"

On Thu, Oct 2, 2014 at 4:56 PM, John Douglass <john.douglass at oit.gatech.edu>
wrote:

>
> On 10/02/2014 12:35 PM, Rando Nakarmi wrote:
>
> Hello John,
>
>  Thanks
>
>  you increased max_request = 16384 (so you have only 64 clients ?)
>
>
> That was a cut/paste from Phil Huxley who responded to my question. I'm
> still figuring out how to optimize. I can say that the max domain
> connections helped A LOT. However, the faster you churn, the more you might
> hit the Cisco WLC bug. We've seen _less_ but we've added radius servers and
> moved some controllers to their own radius server pairs. I hate adding
> radius servers as I feel it masks the real problem and it doesn't solve
> peak (change of classes) issues.
>
>  you set winbind max domain connections = 12 (how do I know which value
> is right ) (we have around 300 clients (WAPs)
>
> It's really mainly about handling peak connections. With 300 WAPs you
> probably won't go that high. I have about 500 aps/controller but we have
> 30k users online at once spread across maybe 20 controllers with multiple
> controllers on each radius server.
>
> Actually I increased winbind max domain connections to 128. The way I kind
> of felt that out was to (on the linux/unix server)
>
> lsof | grep winbind | grep TCP
>
> You can see the number of TCP connections to the AD server. We were
> hitting or initial limit of 50 during peak times. I just increased it to a
> high enough number so that I probably won't reach it. The number of
> connections goes up and down. On a radius failover we might be generating a
> lot of connections but they eventually close and die off.
>
>
>  so I set the max_request= 300*256 (I use 256 the value which is in the
> radious.conf file)
>
>  winbind max clients = 1200 ( has anybody used this parameter ? is this
> mean how many winbind client can connect to AD ?
>
>
> I'm actually not 100% sure on that stat/setting. :) I don't think I really
> care about it enough. No really sure how to determine this one. The
> documentation isn't really pointing out what that means (on samba.org)
>
>
>  --cheers
> Rando
>
>
>
> On Thu, Oct 2, 2014 at 3:27 PM, John Douglass <
> john.douglass at oit.gatech.edu> wrote:
>
>>  :) Rando,
>>
>> There has been much discussion on this list about that problem. IF you
>> are using Cisco WLC, there is a flaw in the way radius is processed which
>> could lead to these log messages. Here is the previous set of threads that
>> have some pointers as to what to look at.
>>
>> Cisco WLCs use the same source port and the 8-bit ID that is used to
>> track radius conversations during peak times, gets cycled so fast that it
>> creates duplicates where there really shouldn't be. We are pushing Cisco
>> hard to fix this flaw in their design especially since they are creating
>> controllers with more and more capacity. The problem is only going to get
>> worse.
>>
>> I highly suggest you move to radius 2.2.5 and enable the ntlm_auth
>> timeout and upgrade your samba to 3.6 where you can add some additional
>> parameters. Here are some hints that Phil Huxley shared with us that have
>> been helpful in making our services better. The issues haven't been handled
>> 100%, and there are other things to consider like if using a Cisco WLC,
>> enabling client exclusion, etc, etc but I don't have a ton of info on that
>> as I just run the radius servers.
>>
>>
>> http://lists.freeradius.org/pipermail/freeradius-users/2014-September/073929.html
>>
>> - John Douglass @ Georgia Tech
>>
>> PS: I really need to write up a blog post about this :)
>> PSS: Yes we know AD is slow and it sucks as a backend but for a lot of
>> us, it's what we have to deal with :)
>>
>>
>>
>> On 10/02/2014 11:10 AM, Rando Nakarmi wrote:
>>
>>   I been seeing quite a large number of message like below logged in
>> radius.log lately.
>>
>>  Discarding duplicate request from client classroom98 port 32880 - ID:
>> 131 due to unfinished request 241848
>>
>>  I read some thread, this might be the case when back-end server (i.e
>> auth servers) are too slow to respond.
>>
>>  My back-end is AD, using ntlm_auth.
>> radius version 2.1.12-4
>> samba version 3.5.8-68
>>
>>  Any hints or suggestion how to resolve this would be very helpful.
>>
>>  Most of the users get authenticated ( I don't think ntlm_auth is
>> responding slow), I could not figure this out
>>
>>  --cheers,
>> Rando
>>
>>
>>   -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>>
>>
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20141003/a82c2462/attachment.html>