Subject: Re: (usr-tc) Radius accounting

From: Vance McIndoe <[email-masked]>
Date: Tue, 20 Jun 2000 03:40:12 +0000

Scot,

It sounds like you shouldn't use the secondary server option - turn them off.  Check out the first 4 lines of "sh accounting".  They show your "primary" and first/second "backup" servers.  You obviously know how to set the primary already.... the first and second backups can be set by the commands:

set accounting_backup primary first_server x.x.x.x
set accounting_backup primary second_server x.x.x.x

You may also like to check the "Authentication Algorithm" with "sh radius settings", and then adjust it with "set radius authentication_algorithm".  Sounds to me like you need the fall_through option.

--
Vance McIndoe
Data Platforms, Operations,
Telecom NZ Ltd.
+64-6-3507004

>>> [email-masked] 20/06/00 12:57:45 >>>
What is the difference between "Primary backup accounting server" and
"Secondary accounting server" on the HARC?

I only want accounting packets to be sent to the secondary radius server
when the primary is down. So, do I use the primary backup accounting server
field? I am currently using the secondary accounting field, and that server
is getting all requests even when the primary is functioning fine.

--
Scot

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

---

From: Scot Desort <[email-masked]>
Date: Tue, 20 Jun 2000 03:49:12 +0000

Yes, I think that is the problem. Slightly ambiguous use of Primary first
backup, and secondary terminology by 3COM. I am already using fall_through.

I'll give your commands a try and see if the acctg packets to the "first
backup" stop.

Thanks,

--
Scot

----- Original Message -----
From: Vance McIndoe <[email-masked]>
To: <[email-masked]>
Sent: Monday, June 19, 2000 9:35 PM
Subject: Re: (usr-tc) Radius accounting

Scot,

It sounds like you shouldn't use the secondary server option - turn them
off.  Check out the first 4 lines of "sh accounting".  They show your
"primary" and first/second "backup" servers.  You obviously know how to set
the primary already.... the first and second backups can be set by the
commands:

You may also like to check the "Authentication Algorithm" with "sh radius
settings", and then adjust it with "set radius authentication_algorithm".
Sounds to me like you need the fall_through option.

--
Scot

-

-

-

---

From: Jeff Mcadams <[email-masked]>
Date: Tue, 20 Jun 2000 04:56:39 +0000

Also sprach Scot Desort
>Yes, I think that is the problem. Slightly ambiguous use of Primary
>first backup, and secondary terminology by 3COM. I am already using
>fall_through.

>I'll give your commands a try and see if the acctg packets to the
>"first backup" stop.

As a little bit of clarification on the differences between
authentication and accounting.  There are differences in the needs of
the two parts of the RADIUS protocol.

For authentication, you don't have a need for multiple RADIUS servers to
get the request in normal operation.  Yes, if you have a server go down,
you need to fail over to the next.  The question then becomes, when the
first comes back up, do you switch back over to it, or just stay with
the second one?  Thus the authentication_algorithm settings to let you
control that.

With accounting, however, its easily conceivable that you could want
accounting messages to be sent multiple places in normal operation, and
further, that each one of those potentially independant information
might have a fail-over system available to it if it should fail.  The
possible permutations here get too much for a single controlling
variable, so you have primary, secondary, tertiary, etc. servers that
are for the individual locations, and that get a copy of all the
accounting messages independantly.  Then you have the first_backup,
second_backup, etc. for each of those to handle the case where one of
the servers fails that normally gets the accounting messages, and each
one has its own backup servers.

Anyway...hopefully this clarifies things a bit more as to why
authentication and accounting are handled differently, and how they are
handled.  Hopefully I haven't confused you further.  :)
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-

---

From: Charles Sprickman <[email-masked]>
Date: Tue, 20 Jun 2000 07:21:24 +0000

Speaking of which, does anyone know how to force the authentication server
to flip back to primary after it's failed over to secondary?  If I remove
the secondary, that brings the primary back, but I'm hoping for a
switch.  I'm currently set for fall-through, is that correct?  Little luck
on finding 4.2.x radius questions answered on 3KB...

Thanks,

Charles

| Charles Sprickman                  | Internet Channel
| INCH System Administration Team    | (212)243-5200 
| [email-masked]                     | [email-masked]

-