Forum Discussion

Jason_L_40779's avatar
Jason_L_40779
Icon for Nimbostratus rankNimbostratus
Oct 22, 2010

Radius Load Balancing

We use Radius authentication for our corporate wireless users. I'm looking at load balancing our radius servers for our wireless controllers. We had an issue recently where one of the radius servers went down, all clients connected on that wireless controller to that radius server, lost their authentication. Hence, about 400 people dropped off the network. The server was physically up, but the service was hung. The controllers have both IP addresses of the Radius servers in their configuration. But have no way of knowing if the service is up or not. Only if the server was completely down.

 

 

My idea is to use the BigiP, use one VIP the controllers point to, and do the health checks. That way the controllers can send to one IP, and the BigIP manages the traffic.

 

 

Does anyone have experience with load balancing radius. I have already created a VIP, a UDP profile specifying the Datagram LB option. I also created a health monitor which checks radius the port. I would really like to build a good health monitor to actually check authentication and make sure the radius server is online. Any input is appreciated...

 

 

Thanks....

 

basic
getting started
new to f5
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Nov 01, 2010
    I've load balanced RADIUS before and it worked very well.

     

     

    From the "new monitor" page, you can select RADIUS and input the proper credentials. Simply associate your monitor with a RADIUS pool and you should be set.
  • IAbhijit_184389's avatar
    IAbhijit_184389
    Icon for Nimbostratus rankNimbostratus
    Feb 04, 2015

    Hi,

     

    I am new to F5 and with an assignment to load balance the radius traffic using 2 number of f5 big ip ltm 2000s with multiple radius server.

     

    Would be grateful if I can get help of IP design which we need to allocate on F5 to achieve it.

     

    Thanks AA

     

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      Feb 04, 2015
      it is always wiser to start your own question and not add to another one. it is quite difficult on a forum to design a whole IP network for you. do you have an F5 partner that can help you out?
  • pdawson1983's avatar
    pdawson1983
    Icon for Nimbostratus rankNimbostratus
    Mar 24, 2017

    I would suggest looking into using a RADIUS service profile. I would think that using the Datagram LB option might cause different parts of the RADIUS process to go to different servers.

     

    "The BIG-IP system includes a profile type that you can use to load balance Remote Authentication Dial-In User Service (RADIUS) traffic. When you configure a RADIUS type of profile, the BIG-IP system can send client-initiated RADIUS messages to load balancing servers. The BIG-IP system can also ensure that those messages are persisted on the servers." Taken from Here.