Forum Discussion

mikeinet_61712's avatar
mikeinet_61712
Icon for Nimbostratus rankNimbostratus
May 18, 2009

UDP Radius Client - Need Source IP

Hi,

 

 

I'm presented with an interesting problem that I'm not sure how to attack.

 

 

I'm working with a RADIUS environment (UDP ports 1812,1813)and trying to setup some basic load balancing between multiple RADIUS servers.

 

 

We have everything working -- but the problem we're seeing right now is that the RADIUS servers are seeing the source IP of the F5 device, rather than the actual source server.

 

 

This is a bad thing as it affects our RADIUS authentication and logging capabilities.

 

 

Does anyone know how we could keep that source IP address to allow the RADIUS server to see/use it?

 

 

Thanks.
application delivery
dev
devops
iRules
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    May 18, 2009
    Hi,

     

     

    Since the LTM preserves client source address by default, you likely have the LTM set up in a SNAT or "one-armed" configuration. If you are in a flat network, without SNAT, the packets will take an asymmetric path as I described in this post: Click here.

     

     

    iRules can insert headers, but since there's no way to do an X-Forwarded-For header for RADIUS that I'm aware of (like there is for HTTP), your only choice may be to rearchitect the network such that the LTM is the default gateway for the RADIUS servers and you can remove the SNAT and go back to the default of preserving client source IP.

     

     

    Denny