Radius - load balance

[tiagobigode]

We set up VPN in our environment. And we are using Radius authentication. We will activate MFA, we use Idaptive.
We have four Radius servers. Is it possible to balance Radius connections? Round-robin?
R:

Is it possible to check if the server is available before sending the connection?
R:

[PhoneBoy · Accepted solution]

Yes, you can create RADIUS Server Group--a specific type of object that contains all your RADIUS Server objects.
However, it's more of an "HA" setup where it tries the most high-priority one first, then if no response, it tries the next one, etc.

[tiagobigode]

I understand, there is no balancing using Round-robin. In our scenario we have 7k users and we are having a crash problem because one server is not able to handle all connections.
We need a load balancer.

[rlamerico]

Hello PhoneBoy,

I have made this configuration on my environment, created a RADIUS group, and added both radius servers inside them with priority 1 to first and priority 2 to the second, but when the first server is down firewall doesn´t recognize that this server is down and doesn´t forward the connection to the second server, Does have any specific configuration to do on this case?

PS. If I configure my authentication to use directly the radius servers it works.

[PhoneBoy]

You might need a TAC case to understand why this isn’t working.

[Timothy_Hall]

You probably need to adjust the values of radius_retrant_timeout and radius_retrant_num to shorten up how long the firewall waits before going on to the next server, see sk42449: How to change a failover timeout of RADIUS Server

[rlamerico]

Hi Timothy_Hall,

This information is not clear to me ( print with my configuration below ), today I have an MFA configured on these RADIUS servers and my user have until 60 seconds to inform the radius challenger and as I could understand field "radius_user_timeout" is responsible by it, but I have 750 seconds configured on this field.

Do you know how values I need to configure on properties below to have a failover in 60 seconds for example?

radius_retrant_num

radius_retrant_timeout

[the_rock]

You want radius auth request to fail over to your other server in 60 seconds if first one time sout or does not respond, correct? Thats the setting you are looking for?

[the_rock]

Im pretty sure its retrant timeout setting, but you may wish to confirm 100% with TAC.

[rlamerico]

Hi the_rock,

Exactly, if one server stay down the firewall send the authentication to another server inside de RADIUS group.

[the_rock]

So phoneboy mentioned last year to create radius group for this, which works 100%, as I seen it with customers before, but again, for timeout setting, Im 95% sure its what I advised, but to be 100% positive, maybe better get confirmation from TAC.

[rlamerico]

Thanks everyone,

I will raise a case with TAC to check this issue.