Subject: RE: [USR-TC] Radius Authentication Algorithms.

From: Joel - Fox Computers <[email-masked]>
Date: Sun, 08 Sep 2002 01:32:40 +0000

Can you please clarify - I'm a little lost on the difference between "secondary" and "Backup" servers.  

Here's what I would want to do - I want all accounting and authentication requests to go to a single server.  BUT - if that server fails - I want those to go to a different server, until my main one comes back online.  

So are you saying I should be using the "backup first server" rather than a "secondary"?  Would be great if someone can ellaborate.

Thanks,

Joel

-----Original Message-----
From: Steve Brown [mailto:[email-masked]]
Sent: Saturday, September 07, 2002 2:48 PM
To: [email-masked]
Subject: RE: [USR-TC] Radius Authentication Algorithms.

Ummm, sounds like an accounting server setup issue. There is a primary and
secondary server, but I thought both are used for logging at the same time.
Maybe you have secondary setup as a "backup" server when you should have
primary backup server set as backup?

That is to say use "set accounting_backup primary first_server" instead of
"set accounting secondary_server"

Just a guess, I can't really imagine the chassis trying to authenticate from
two sources simultaneously, but if it can be done I'm open to learning about
it and why the heck you would want to do that.

Steve Brown
Netease
Santa Rosa, CA
steve[AT]neteze.com

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Casen
> Sent: Saturday, September 07, 2002 11:29 AM
> To: [email-masked]
> Subject: [USR-TC] Radius Authentication Algorithms.
>
>
> Hey List,
>
> We just recently upgraded all of our firmware's to try and solve a
> problem we've been having.  All connections made to our TCR equipment
> end up getting double logged in our database when the user disconnects.
> We had thought the problem might have been a firmware bug, but the
> upgrades didn't help, so we dug a little bit deeper.
>
> We run a primary/secondary radius server, and after putting them into
> debug mode were able to find that the TCR equipment is authenticating
> with both of them, instead of trying the primary before falling back to
> the secondary.  Consequently, both servers are logging the connection
> information and we end up with twice as many log files as we care for.
> :)
>
> Here's a list of the RADIUS settings we have for the ARC.  We suspect
> that the problem lies in the 'Authentication Algorithm' but aren't
> entirely positive, so I thought I would ask you.
>
> HiPer>> show radius
>
> RADIUS SETTINGS
> Fill Null Attributes:                      DISABLED
> Attribute Style:                           STANDARD
> NAS Port Style :                           DEFAULT
> Authentication Algorithm:                  ROUND_ROBIN
> Interim Accounting Interval Status:        DISABLED
> Interim Accounting Interval:               240 seconds
> IEA Radius Source Port Authentication      DISABLED
> IEA User Radius supplied username          DISABLED
> Send Unauthenticated STOP record           ENABLED
> Report Acct IP Addr only for Primary Link: DISABLED
> Send only STOP Acct for failed services:   DISABLED
> DNIS Authentication Service Type:          10
> Configured Authentation Service Type:      0
> Radius NAS-PORT id style:                  DENSITY BASED
> Radius Resource Reclaim style:             DRAFT
> Radius Reboot Indication style:            FALL-THROUGH
> Authentication Failure Trap State :        ENABLED
> DNIS NAS Port Style :                      DEFAULT
> Radius Send Acct for Default User:         ENABLED
> HiPer>>
>
> And the options available for the algorithm setting:
>
> HiPer>> set radius authentication_algorithm
> CLI - Missing Required Argument(s):
>
> This field is a KEYWORD LIST. The possible values are:
>         [ ACTIVE_SERVER FALL_THROUGH PREFERRED ROUND_ROBIN  ]
> HiPer>>
>
> Thanks for any help!
>
> Casen
> ArosNet Systems Administration
>
>
> _______________________________________________
> USR-TC mailing list
> [email-masked]
> http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc
>

_______________________________________________
USR-TC mailing list
[email-masked]
http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc

---

From: Charles Sprickman <[email-masked]>
Date: Sun, 08 Sep 2002 06:22:26 +0000

> "secondary" and "Backup" servers.

Secondary is for sending all accounting to a secondary server, in addition
to the primary.

> Here's what I would want to do - I want all accounting and
> authentication requests to go to a single server.  BUT - if that server
> fails - I want those to go to a different server, until my main one
> comes back online.

For accounting you want the backup first server.  Accounting will only go
there if the primary is not reachable.

> So are you saying I should be using the "backup first server" rather
> than a "secondary"?  Would be great if someone can ellaborate.

It's hard to find where to set it because it doesn't show up in a "set
accounting ?".  Do a "set accounting_backup ?" to see how to set the
primary backup.

Just to confuse you, the authentication is not set up this way, just
primary and secondary.  You can alter the authentication behaviour with
"set radIUS auTHENTICATION_ALGORITHM ?".

Charles

---

From: Casen <[email-masked]>
Date: Tue, 10 Sep 2002 11:31:01 +0000

Thank you so much.  You and Steve were both a great help.  We had our
primary radius server setup as that, the primary server.  And the
secondary one was setup as a full secondary server.  Moving the
secondary server's information over to the primary first backup brought
everything back in line.

Thanks, I appreciate all of your help!

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Charles
Sprickman
Sent: Sunday, September 08, 2002 12:22 AM
To: [email-masked]
Subject: RE: [USR-TC] Radius Authentication Algorithms.

> "secondary" and "Backup" servers.

Secondary is for sending all accounting to a secondary server, in
addition to the primary.

> authentication requests to go to a single server.  BUT - if that 
> server fails - I want those to go to a different server, until my main

> one comes back online.

For accounting you want the backup first server.  Accounting will only
go there if the primary is not reachable.

Charles

> Ummm, sounds like an accounting server setup issue. There is a primary

> and secondary server, but I thought both are used for logging at the 
> same time. Maybe you have secondary setup as a "backup" server when 
> you should have primary backup server set as backup?
>
> That is to say use "set accounting_backup primary first_server" 
> instead of "set accounting secondary_server"
>
> Just a guess, I can't really imagine the chassis trying to 
> authenticate from two sources simultaneously, but if it can be done 
> I'm open to learning about it and why the heck you would want to do 
> that.
>
> Steve Brown
> Netease
> Santa Rosa, CA
> steve[AT]neteze.com
>
> > problem we've been having.  All connections made to our TCR 
> > equipment end up getting double logged in our database when the user

> > disconnects. We had thought the problem might have been a firmware 
> > bug, but the upgrades didn't help, so we dug a little bit deeper.
> >
> > We run a primary/secondary radius server, and after putting them 
> > into debug mode were able to find that the TCR equipment is 
> > authenticating with both of them, instead of trying the primary 
> > before falling back to the secondary.  Consequently, both servers 
> > are logging the connection information and we end up with twice as 
> > many log files as we care for.
> > :)
> >
> > Here's a list of the RADIUS settings we have for the ARC.  We 
> > suspect that the problem lies in the 'Authentication Algorithm' but 
> > aren't entirely positive, so I thought I would ask you.
> >
> > HiPer>> show radius
> >
> > RADIUS SETTINGS