Forum Discussion

Mate_132781's avatar
Mate_132781
Icon for Cirrostratus rankCirrostratus
Jul 15, 2014

RADIUS Proxy and Forwarding packets to multiple destinations

Hi,

 

we have need for forwarding RADIUS packets from one source to multiple hosts (like RADIUS server, DPI boxes etc.).

 

What is, in your oppinion, the best way to do this?

 

For example, I have router (BRAS) which is sending RADIUS packet to BIG-IP and I want that BIG-IP forward that packet to 3 different IP addresses. What would be the bes solution from perspective of scalability and optimal usage of BIG-IP resources?

 

Br, Mate

 

APM
application delivery
deployment
design
devops
iRules
performance
security

6 Replies

Sort By
  • Andrew_Husking's avatar
    Andrew_Husking
    Icon for Cirrus rankCirrus
    Jul 16, 2014

    We used this to send RADIUS accounting packets to multiple servers

     

    https://devcentral.f5.com/wiki/iapp.UDP-Packet-Duplication.ashx

     

    Regards,

     

  • Nuwan_120101's avatar
    Nuwan_120101
    Icon for Nimbostratus rankNimbostratus
    Jul 16, 2014

    Hi I am looking for the same as Mate. My problem is I am load balancing radius servers on the F5 appliance. Hence cannot use the same VIP on the udp packet duplication iApp. Do some one knows an iRule to forward udp packets to multiple destinations.

     

    Thank you.

     

    Regards Nuwan

     

    • Andrew_Husking's avatar
      Andrew_Husking
      Icon for Cirrus rankCirrus
      Jul 16, 2014
      What traffic are you trying to duplicate? if RADIUS, what part of the RADIUS? Auth or accounting?
  • Nuwan_120101's avatar
    Nuwan_120101
    Icon for Nimbostratus rankNimbostratus
    Jul 16, 2014

    Hi Andrew

     

    Yes it is Radius and Accounting Packets. These packets should be forwarded to multiple destinations simultaneously for billing purpose.

     

    Thank you.

     

    regards Nuwan

     

    • Andrew_Husking's avatar
      Andrew_Husking
      Icon for Cirrus rankCirrus
      Jul 16, 2014
      Do your standard load balancing for auth. Setup the duplication iApp on a new address. Setup your each of your radius servers to send accounting to the duplication VIP. That's how we did it, i believe one of my colleagues change the irule slightly so that radius didn't mark the accounting servers as down.
  • hartono's avatar
    hartono
    Icon for Nimbostratus rankNimbostratus
    Jul 16, 2014

    I think you can using sideband connection on your irules to forward the traffic to multiple destination / pool members.

     

    Regards