Forum Discussion
Is there a way for a single request to be received by all pool members
we are setting up an anti-spam server farm and to be load balanced by F5, but to determine that the mail is valid, there is a Radius AVP that is to be received by all anti-spam servers. In this case, we might need a Virtual server that all pool members shall receive the Raduis AVP. Is this possible?
18 Replies
- Samir_Jha_52506
Noctilucent
To achieve this, You can synchronize all Anti-span server.
- Spidey_29396
Nimbostratus
Hi Samir,
I'm not familiar with Anti-Spam server configuration, but as per our client the flow will be:
- Client sends request
- GGSN will send copy of Radius AVP to Anti-SPAM server for authentication
- Client will then send the data(email)
- Anti-spam server will validate the data based on the authentication.
Is this possible then?
Thanks! Ferdz
- Sam_Pickles_110
Nimbostratus
Hi Ferdz;
Not sure if I understand your use case correctly; however I recall a few years back having some success copying RADIUS accounting messages to multiple servers using the high speed logging function in irules. The basic rule is applied to a UDP virtual server which receives the message, and forwards copies of it to multiple destinations as required.
when CLIENT_ACCEPTED {
set pool_1 [HSL::open -proto UDP -pool blade_1] set pool_2 [HSL::open -proto UDP -pool blade_2] HSL::send $pool_1 [UDP::payload] HSL::send $pool_2 [UDP::payload]
}
I have a question however; it sounds like you are copying the message to all servers, when only one will end up needing to use it when the email arrives - is it worth doing something different and hashing a value which appears in both the RADIUS message, and the email, to select one server only; send the message to that server only, and then load balance the relevant email to the same server?
Or, select the pool member at random when sending the RADIUS message, write a state table entry, look it up later when the email arrives and send to the same server.
- Sujay_Prabu_195
Nimbostratus
I need basic rule is applied to a virtual server which receives the message, and forwards copies of it to multiple pool members.
- Spidey_29396
Nimbostratus
HI Sam,
What is the less CPU intensive of the three options? and how do i apply option 2 and 3? Is it via iRule?
Thank you in advance.
Thanks! Ferdz
- Sam_Pickles_110
Nimbostratus
Hi Ferdz, options 2 and 3 would also be done via iRules. Its hard to predict exactly what CPU consumption would be, without creating POC code and measuring it empirically (see the "timing" command if you are unsure on this process). How much traffic do you have? (RADIUS messages and emails per second is probably the best indicator here). These rules aren't doing anything too intensive, its not likely to be a major issue. I'd probably go with option 1 as the rule above has been tested and used in production, and requires the minimum of R&D on your part. - Spidey_29396
Nimbostratus
Hi Sam, So you mean i'll be creating a standard VS with udp port 1813, no pool resources just using the iRule? when CLIENT_ACCEPTED { set pool_1 [HSL::open -proto UDP -pool blade_1] set pool_2 [HSL::open -proto UDP -pool blade_2] HSL::send $pool_1 [UDP::payload] HSL::send $pool_2 [UDP::payload] } What will be the value of pool_1 and pool_2 as well as blade_1 and blade_2?
- Kevin_Stewart
Employee
Maybe I'm missing something, but do you need to receive a response from the servers you're sending the Raduis AVP messages to? An HSL won't give you that - it's one way. Are you doing something based on how one or more servers responds to the AVP message?
- Kevin_Stewart
Employee
Hi Kevin, you mean the will the GGSN needs to receive a response from the anti-spam servers?
I was hoping you knew the answer to that question. Your original post indicates a potential need to send the same request to multiple pool members. This isn't generally possible (in a simultaneous way) if you expect to get a response. You could certainly send the same data out to multiple logging servers, or even potentially to multiple hosts (serially) using a sideband process, but ultimately it depends on what you need to happen and the timing of events. Can you elaborate on the intended traffic flow?
- Spidey_29396
Nimbostratus
Hi Kevin,
They don't need to respond to the RADIUS packets. Is HSL can work on this way?
Thanks! Ferdz
- Spidey_29396
Nimbostratus
Hi Kevin,
They don't need to respond to the RADIUS packets. Is HSL can work on this way?
Thanks! Ferdz
- Spidey_29396
Nimbostratus
Hi Kevin,
- First packet will be UDP packets from client to GGSN
- GGSN will send a copy of Radius AVP(Containing MObile number of user) to anti-spam servers
- Client will then send email but will be intercepted by ANti-Spam servers based on the Radius AVP received by the server). Either drop it or forward.
Thanks! Ferdz
- Kevin_Stewart
Employee
So then do you really need the AVP message to go to all of the anti-spam servers, or do you simply need the client's email to go to the same (single) anti-spam server that received the AVP message from the GGSN?
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com