topic Re: Radius - load balance in General Topics

Radius - load balance

tiagobigode — Fri, 13 Mar 2020 13:58:42 GMT

We set up VPN in our environment. And we are using Radius authentication. We will activate MFA, we use Idaptive.
We have four Radius servers. Is it possible to balance Radius connections? Round-robin?
R:

Is it possible to check if the server is available before sending the connection?
R:

Re: Radius - load balance

PhoneBoy — Mon, 16 Mar 2020 02:10:27 GMT

Yes, you can create RADIUS Server Group--a specific type of object that contains all your RADIUS Server objects.
However, it's more of an "HA" setup where it tries the most high-priority one first, then if no response, it tries the next one, etc.

Re: Radius - load balance

tiagobigode — Mon, 16 Mar 2020 14:01:05 GMT

I understand, there is no balancing using Round-robin. In our scenario we have 7k users and we are having a crash problem because one server is not able to handle all connections.
We need a load balancer.

Re: Radius - load balance

rlamerico — Fri, 27 Aug 2021 03:36:26 GMT

Hello PhoneBoy,

I have made this configuration on my environment, created a RADIUS group, and added both radius servers inside them with priority 1 to first and priority 2 to the second, but when the first server is down firewall doesn´t recognize that this server is down and doesn´t forward the connection to the second server, Does have any specific configuration to do on this case?

PS. If I configure my authentication to use directly the radius servers it works.

Re: Radius - load balance

PhoneBoy — Fri, 27 Aug 2021 03:59:00 GMT

You might need a TAC case to understand why this isn’t working.

Re: Radius - load balance

Timothy_Hall — Fri, 27 Aug 2021 12:02:57 GMT

You probably need to adjust the values of radius_retrant_timeout and radius_retrant_num to shorten up how long the firewall waits before going on to the next server, see sk42449: How to change a failover timeout of RADIUS Server

Re: Radius - load balance

rlamerico — Mon, 30 Aug 2021 14:50:51 GMT

Hi Timothy_Hall,

This information is not clear to me ( print with my configuration below ), today I have an MFA configured on these RADIUS servers and my user have until 60 seconds to inform the radius challenger and as I could understand field "radius_user_timeout" is responsible by it, but I have 750 seconds configured on this field.

Do you know how values I need to configure on properties below to have a failover in 60 seconds for example?

radius_retrant_num

radius_retrant_timeout

Re: Radius - load balance

the_rock — Mon, 30 Aug 2021 15:08:16 GMT

You want radius auth request to fail over to your other server in 60 seconds if first one time sout or does not respond, correct? Thats the setting you are looking for?

Re: Radius - load balance

the_rock — Mon, 30 Aug 2021 15:16:55 GMT

Im pretty sure its retrant timeout setting, but you may wish to confirm 100% with TAC.

Re: Radius - load balance

rlamerico — Mon, 30 Aug 2021 15:16:55 GMT

Hi the_rock,

Exactly, if one server stay down the firewall send the authentication to another server inside de RADIUS group.

Re: Radius - load balance

the_rock — Mon, 30 Aug 2021 15:19:11 GMT

So phoneboy mentioned last year to create radius group for this, which works 100%, as I seen it with customers before, but again, for timeout setting, Im 95% sure its what I advised, but to be 100% positive, maybe better get confirmation from TAC.

Re: Radius - load balance

rlamerico — Tue, 31 Aug 2021 02:21:38 GMT

Thanks everyone,

I will raise a case with TAC to check this issue.