RE: [USR-TC] TC/RADIUS performance
My experience has been this: If the ARC get's a response from a RADIUS server, that becomes the active server and will be tried first until the ARC gets a response from another server, and so on. In other words, if your primary goes down, the arc hits the secondary, then the secondary becomes active. From that point forward, the ARC tries the secondary server first. Only when the secondary server fails to respond and the ARC has to request to the primary (and the primary responds) will the primary become the "active" authentication server. You can see this if you do a "show authentication" on the ARC - toward the bottom it displays "Active Authentication Server", which for me often is the secondary. Doing a "mon rad" shows that the secondary is then being requested first. So, your primary was probably NOT down for two hours - could have been just once for 5 seconds if someone tried to log in at that time. - Joel -----Original Message----- From: Paul Farber [mailto:farber@admin.f-tech.net] Sent: Wednesday, April 16, 2003 9:43 PM To: usr-tc@lists.xmission.com Subject: [USR-TC] TC/RADIUS performance Have a radius performance question. On April 16th my primary radius server (800Mhz, 256Mb RAM, Linux 2.4.20, ICRADIUS + MySQL, 1600 users) authenticated 2930 radius requests. It is also a local DNS resolver for all dial ins running djbdns. My backup RADIUS server (1.6Ghz, 256Mb RAM, Linux 2.4.20 ICRADIUS + MySQL 1600 users) caught 284 authentications. I have 3 HiperARC set up to authenticate off these servers with a timeout of 3 seconds and 10 retries. If 284 requests had to fail over to the secondary radius server that means that I had (3 x 10 x 284) 8520 seconds of primary RADIUS server being unavailable????? Thats 142 minutes or over two hours?!!?!?!?!?! With over 9% of the total requests having to go to the secondary?!?!?!?! Even if the ARC switched to the secondary after the first 3 second timeout thats (3x1x284) 852 seconds or over 14 minutes of primary auth server unavailibility?!?!?!?! ?!?!?!?!?!??!?!?!?!?!?!?!??!? How long will the the ARC retry the primary auth server??? The config says 10 times 3 seconds. But if I do the simple math then I had over two hours of downtime. I don't belive that or I am missing something. The primary radius server is on the same network as 1 ARC, the other two are routed from two other local LAN segments. The Secondary is 3 hops away. What am I missing??? -- Paul Farber Farber Technology farber@admin.f-tech.net Ph 570-628-5303 Fax 570-628-5545 _______________________________________________ USR-TC mailing list USR-TC@mailman.xmission.com http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc
Then you are saying the secondary has to fail before the primary is tried again? So then both my primary AND secondary are failing... I find that hard to believe. Logs show that the daemons are not stopping or restarting. -- Paul Farber Farber Technology farber@admin.f-tech.net Ph 570-628-5303 Fax 570-628-5545 On Wed, 16 Apr 2003, Joel - Fox Computers wrote:
My experience has been this:
If the ARC get's a response from a RADIUS server, that becomes the active server and will be tried first until the ARC gets a response from another server, and so on.
In other words, if your primary goes down, the arc hits the secondary, then the secondary becomes active. From that point forward, the ARC tries the secondary server first. Only when the secondary server fails to respond and the ARC has to request to the primary (and the primary responds) will the primary become the "active" authentication server.
You can see this if you do a "show authentication" on the ARC - toward the bottom it displays "Active Authentication Server", which for me often is the secondary. Doing a "mon rad" shows that the secondary is then being requested first.
So, your primary was probably NOT down for two hours - could have been just once for 5 seconds if someone tried to log in at that time.
- Joel
-----Original Message----- From: Paul Farber [mailto:farber@admin.f-tech.net] Sent: Wednesday, April 16, 2003 9:43 PM To: usr-tc@lists.xmission.com Subject: [USR-TC] TC/RADIUS performance
Have a radius performance question.
On April 16th my primary radius server (800Mhz, 256Mb RAM, Linux 2.4.20, ICRADIUS + MySQL, 1600 users) authenticated 2930 radius requests. It is also a local DNS resolver for all dial ins running djbdns.
My backup RADIUS server (1.6Ghz, 256Mb RAM, Linux 2.4.20 ICRADIUS + MySQL 1600 users) caught 284 authentications.
I have 3 HiperARC set up to authenticate off these servers with a timeout of 3 seconds and 10 retries.
If 284 requests had to fail over to the secondary radius server that means that I had (3 x 10 x 284) 8520 seconds of primary RADIUS server being unavailable????? Thats 142 minutes or over two hours?!!?!?!?!?! With over 9% of the total requests having to go to the secondary?!?!?!?!
Even if the ARC switched to the secondary after the first 3 second timeout thats (3x1x284) 852 seconds or over 14 minutes of primary auth server unavailibility?!?!?!?!
?!?!?!?!?!??!?!?!?!?!?!?!??!?
How long will the the ARC retry the primary auth server??? The config says 10 times 3 seconds. But if I do the simple math then I had over two hours of downtime. I don't belive that or I am missing something.
The primary radius server is on the same network as 1 ARC, the other two are routed from two other local LAN segments. The Secondary is 3 hops away.
What am I missing???
On Thursday 17 April 2003 01:49 pm, Paul Farber wrote:
Then you are saying the secondary has to fail before the primary is tried again?
So then both my primary AND secondary are failing... I find that hard to believe. Logs show that the daemons are not stopping or restarting. No. I am saying that you should look at man radiusd and set some options that will log what is going so you can debug it. Make some calls. test it out. It will print out so much crap it will make your headspin.
If it has never worked I would suspect that your TC and ICRADIUS are on different port settings. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115
Yea, the -x -x -x option will fill up the logs. I'll try it. -- Paul Farber Farber Technology farber@admin.f-tech.net Ph 570-628-5303 Fax 570-628-5545 On Thu, 17 Apr 2003, Lewis Bergman wrote:
On Thursday 17 April 2003 01:49 pm, Paul Farber wrote:
Then you are saying the secondary has to fail before the primary is tried again?
So then both my primary AND secondary are failing... I find that hard to believe. Logs show that the daemons are not stopping or restarting. No. I am saying that you should look at man radiusd and set some options that will log what is going so you can debug it. Make some calls. test it out. It will print out so much crap it will make your headspin.
If it has never worked I would suspect that your TC and ICRADIUS are on different port settings.
Accounting and authentication in Radius are seperate. Does your accounting follow your authentication problem? Does that make sense? On my TCs I 'enable prioritize_first_accounting_server_in_a_group' so that my accounting always goes back to the primary if it has to use the secondary briefly for some reason. I only use the primary and primary_first_backup entries. The secondary accounting is disabled completely. And I 'set authentication prioritize_flag enable' so that my primary auth server is always used. I always get about 5 - 10 accounting and authentication hits on my secondary each day, usually during peak periods in the evening. I just assumed it's because Radius uses UDP and traffic on the network is higher so communication breaks down briefly somewhere between (and including) the NASes and the primary Radius server. Do you monitor the ethernet traffic on your primary Radius server. Maybe it has a higher load at times or is being attacked and causes packet loss. Or what about the network that these 3 TCs are using. Maybe there is a high amount of traffic there at times. Bill Dunn ----- Original Message ----- From: "Paul Farber" <farber@admin.f-tech.net> To: "Discussion relating to the 3Com/US Robotics Total Control modem systems." <usr-tc@mailman.xmission.com> Sent: Thursday, April 17, 2003 1:49 PM Subject: RE: [USR-TC] TC/RADIUS performance Then you are saying the secondary has to fail before the primary is tried again? So then both my primary AND secondary are failing... I find that hard to believe. Logs show that the daemons are not stopping or restarting. -- Paul Farber Farber Technology farber@admin.f-tech.net Ph 570-628-5303 Fax 570-628-5545 On Wed, 16 Apr 2003, Joel - Fox Computers wrote:
My experience has been this:
If the ARC get's a response from a RADIUS server, that becomes the active server and will be tried first until the ARC gets a response from another server, and so on.
In other words, if your primary goes down, the arc hits the secondary, then the secondary becomes active. From that point forward, the ARC tries the secondary server first. Only when the secondary server fails to respond and the ARC has to request to the primary (and the primary responds) will the primary become the "active" authentication server.
You can see this if you do a "show authentication" on the ARC - toward the bottom it displays "Active Authentication Server", which for me often is the secondary. Doing a "mon rad" shows that the secondary is then being requested first.
So, your primary was probably NOT down for two hours - could have been just once for 5 seconds if someone tried to log in at that time.
- Joel
-----Original Message----- From: Paul Farber [mailto:farber@admin.f-tech.net] Sent: Wednesday, April 16, 2003 9:43 PM To: usr-tc@lists.xmission.com Subject: [USR-TC] TC/RADIUS performance
Have a radius performance question.
On April 16th my primary radius server (800Mhz, 256Mb RAM, Linux 2.4.20, ICRADIUS + MySQL, 1600 users) authenticated 2930 radius requests. It is also a local DNS resolver for all dial ins running djbdns.
My backup RADIUS server (1.6Ghz, 256Mb RAM, Linux 2.4.20 ICRADIUS + MySQL 1600 users) caught 284 authentications.
I have 3 HiperARC set up to authenticate off these servers with a timeout of 3 seconds and 10 retries.
If 284 requests had to fail over to the secondary radius server that means that I had (3 x 10 x 284) 8520 seconds of primary RADIUS server being unavailable????? Thats 142 minutes or over two hours?!!?!?!?!?! With over 9% of the total requests having to go to the secondary?!?!?!?!
Even if the ARC switched to the secondary after the first 3 second timeout thats (3x1x284) 852 seconds or over 14 minutes of primary auth server unavailibility?!?!?!?!
?!?!?!?!?!??!?!?!?!?!?!?!??!?
How long will the the ARC retry the primary auth server??? The config says 10 times 3 seconds. But if I do the simple math then I had over two hours of downtime. I don't belive that or I am missing something.
The primary radius server is on the same network as 1 ARC, the other two are routed from two other local LAN segments. The Secondary is 3 hops away.
What am I missing???
_______________________________________________ USR-TC mailing list USR-TC@mailman.xmission.com http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc
The primary server is running a dns resolver, radius and mysql. Load averages are < .5 at thier highest. Not sure if this is an ongoing issue... i only found it 3 days ago when I looked. -- Paul Farber Farber Technology farber@admin.f-tech.net Ph 570-628-5303 Fax 570-628-5545 On Thu, 17 Apr 2003, VCI Help Desk wrote:
Accounting and authentication in Radius are seperate. Does your accounting follow your authentication problem? Does that make sense?
On my TCs I 'enable prioritize_first_accounting_server_in_a_group' so that my accounting always goes back to the primary if it has to use the secondary briefly for some reason. I only use the primary and primary_first_backup entries. The secondary accounting is disabled completely. And I 'set authentication prioritize_flag enable' so that my primary auth server is always used. I always get about 5 - 10 accounting and authentication hits on my secondary each day, usually during peak periods in the evening. I just assumed it's because Radius uses UDP and traffic on the network is higher so communication breaks down briefly somewhere between (and including) the NASes and the primary Radius server.
Do you monitor the ethernet traffic on your primary Radius server. Maybe it has a higher load at times or is being attacked and causes packet loss. Or what about the network that these 3 TCs are using. Maybe there is a high amount of traffic there at times.
Bill Dunn
----- Original Message ----- From: "Paul Farber" <farber@admin.f-tech.net> To: "Discussion relating to the 3Com/US Robotics Total Control modem systems." <usr-tc@mailman.xmission.com> Sent: Thursday, April 17, 2003 1:49 PM Subject: RE: [USR-TC] TC/RADIUS performance
Then you are saying the secondary has to fail before the primary is tried again?
So then both my primary AND secondary are failing... I find that hard to believe. Logs show that the daemons are not stopping or restarting.
-- Paul Farber Farber Technology farber@admin.f-tech.net Ph 570-628-5303 Fax 570-628-5545
On Wed, 16 Apr 2003, Joel - Fox Computers wrote:
My experience has been this:
If the ARC get's a response from a RADIUS server, that becomes the active server and will be tried first until the ARC gets a response from another server, and so on.
In other words, if your primary goes down, the arc hits the secondary, then the secondary becomes active. From that point forward, the ARC tries the secondary server first. Only when the secondary server fails to respond and the ARC has to request to the primary (and the primary responds) will the primary become the "active" authentication server.
You can see this if you do a "show authentication" on the ARC - toward the bottom it displays "Active Authentication Server", which for me often is the secondary. Doing a "mon rad" shows that the secondary is then being requested first.
So, your primary was probably NOT down for two hours - could have been just once for 5 seconds if someone tried to log in at that time.
- Joel
-----Original Message----- From: Paul Farber [mailto:farber@admin.f-tech.net] Sent: Wednesday, April 16, 2003 9:43 PM To: usr-tc@lists.xmission.com Subject: [USR-TC] TC/RADIUS performance
Have a radius performance question.
On April 16th my primary radius server (800Mhz, 256Mb RAM, Linux 2.4.20, ICRADIUS + MySQL, 1600 users) authenticated 2930 radius requests. It is also a local DNS resolver for all dial ins running djbdns.
My backup RADIUS server (1.6Ghz, 256Mb RAM, Linux 2.4.20 ICRADIUS + MySQL 1600 users) caught 284 authentications.
I have 3 HiperARC set up to authenticate off these servers with a timeout of 3 seconds and 10 retries.
If 284 requests had to fail over to the secondary radius server that means that I had (3 x 10 x 284) 8520 seconds of primary RADIUS server being unavailable????? Thats 142 minutes or over two hours?!!?!?!?!?! With over 9% of the total requests having to go to the secondary?!?!?!?!
Even if the ARC switched to the secondary after the first 3 second timeout thats (3x1x284) 852 seconds or over 14 minutes of primary auth server unavailibility?!?!?!?!
?!?!?!?!?!??!?!?!?!?!?!?!??!?
How long will the the ARC retry the primary auth server??? The config says 10 times 3 seconds. But if I do the simple math then I had over two hours of downtime. I don't belive that or I am missing something.
The primary radius server is on the same network as 1 ARC, the other two are routed from two other local LAN segments. The Secondary is 3 hops away.
What am I missing???
_______________________________________________ USR-TC mailing list USR-TC@mailman.xmission.com http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc
_______________________________________________ USR-TC mailing list USR-TC@mailman.xmission.com http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc
participants (4)
-
Joel - Fox Computers -
Lewis Bergman -
Paul Farber -
VCI Help Desk