iRule not working to have a RADIUS presistant load balancing.

Question

Hello All, &nbsp;I having trouble with an iRule that I created to load balance the RADIUS traffic on F5. I have a virtual server created that is listening on "all ports" and I have created an iRule in which it will only accept packets with ports 1812 &amp; 1813. This iRule is called in a Persistent profile I created (where parent profile is Universal). This Persistent profile was called under the Virtual server --resources--&gt; Default Persistent profile. &nbsp;Somehow this is it is not working for me. I see that the packets are reaching the F5 , but "Access-Request" packets are not being sent out to the pool members. iRule for reference is shown below :&nbsp;when RULE_INIT {&nbsp;array set ::attr_code2name { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;User-Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;User-Password&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CHAP-Password&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NAS-IP-Address&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NAS-Port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Service-Type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-Protocol&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-IP-Address&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-IP-Netmask&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-Routing&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;11&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Filter-Id&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-MTU&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-Compression&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;14&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-IP-Host&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;15&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-Service&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-TCP-Port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;17&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(unassigned)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Reply-Message&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;19&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Callback-Number&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Callback-Id&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;21&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(unassigned)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-Route&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;23&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-IPX-Network&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;24&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;State&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;25&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Class&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;26&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Vendor-Specific&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;27&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Session-Timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;28&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Idle-Timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;29&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Termination-Action&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;30&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Called-Station-Id&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;31&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Calling-Station-Id&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NAS-Identifier&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;33&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Proxy-State&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;34&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-LAT-Service&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;35&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-LAT-Node&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;36&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-LAT-Group&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;37&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-AppleTalk-Link&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-AppleTalk-Network&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;39&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Framed-AppleTalk-Zone&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;60&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CHAP-Challenge&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;61&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NAS-Port-Type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;62&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Port-Limit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;63&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Login-LAT-Port&nbsp;&nbsp;&nbsp;}}when CLIENT_ACCEPTED {&nbsp;&nbsp;if { ([UDP::local_port] != 1812) &amp;&amp; ([UDP::local_port] != 1813) } {&nbsp;&nbsp;&nbsp;log local0. "packet on port [UDP::local_port] dropped"&nbsp;&nbsp;&nbsp;drop&nbsp;&nbsp;}else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set CALLID [RADIUS::avp 31 string]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;persist uie $CALLID &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "persisted $CALLID"&nbsp;&nbsp;}}when CLIENT_DATA {&nbsp;&nbsp;&nbsp;if { [UDP::local_port] == 1813 } {&nbsp;&nbsp;&nbsp;set CALLID [RADIUS::avp 31 string]&nbsp;&nbsp;&nbsp;set IP [RADIUS::avp 8 ip4]&nbsp;&nbsp;&nbsp;if { $IP != "" } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;table set $IP [LB::server addr] 900&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Radius maps $IP to [LB::server addr] for $CALLID"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;}}when LB_SELECTED {&nbsp;&nbsp;&nbsp;log local0. "Selected [LB::server addr] [LB::server port]"}when SERVER_DATA {&nbsp;&nbsp;&nbsp;persist add uie $CALLID&nbsp;&nbsp;&nbsp;log local0. "persist added for $CALLID to [LB::server addr]"}&nbsp;&nbsp;&nbsp;

enes_afsin_al · Answer

Hi ZANOOB,[RADIUS::avp 31 string] may be returning empty string. If empty, iRule will throw an error.Can you investigate the ltm logs and try this iRule?when CLIENT_DATA {
	if { [UDP::local_port] == 1813 } {
		set CALLID [RADIUS::avp 31 string]
		set IP [RADIUS::avp 8 ip4]
		if { $IP != "" } {
			table set $IP [LB::server addr] 900
			log local0. "Radius maps $IP to [LB::server addr] for $CALLID"
		}
	}
}
&nbsp;
when CLIENT_ACCEPTED {
	if { ([UDP::local_port] != 1812) &amp;&amp; ([UDP::local_port] != 1813) } {
		log local0. "packet on port [UDP::local_port] dropped"
		drop
	}
	elseif {
		set CALLID [RADIUS::avp 31 string]
		log local0. "persisted $CALLID"
		
		if { $CALLID ne "" } {
			persist uie $CALLID
		}
	}
}
&nbsp;
when CLIENT_DATA {
	if { [UDP::local_port] == 1813 } {
		set CALLID [RADIUS::avp 31 string]
		set IP [RADIUS::avp 8 ip4]
		if { $IP ne "" &amp;&amp; $CALLID ne "" } {
			table set $IP [LB::server addr] 900
			log local0. "Radius maps $IP to [LB::server addr] for $CALLID"
		}
	}
}
&nbsp;
when LB_SELECTED {
	log local0. "Selected [LB::server addr] [LB::server port]"
}
&nbsp;
when SERVER_DATA {
	if { $CALLID ne "" } {
		persist add uie $CALLID
		log local0. "persist added for $CALLID to [LB::server addr]"
	}
}

zanoob · Answer

Hello Enes Afsin Al, &nbsp;Thank you for your reply. Much appreciated. The above iRule, I was not able to save it since it shows some syntax errors. Not an expert in scripts, so couldn't find what is wrong with the syntax of it. -------------------------------01070151:3: Rule [/Common/CallIDUIE2] error: /Common/CallIDUIE2:17: error: [parse error: PARSE syntax 501 {syntax error in expression " set CALLID [RADIUS::avp 31 string] log local0. ...": variable references require preceding $}][{ set CALLID [RADIUS::avp 31 string] log local0. "persisted $CALLID"&nbsp; if { $CALLID ne "" } { persist uie $CALLID } }]/Common/CallIDUIE2:24: error: [missing a script after "elseif"][]/Common/CallIDUIE2:27: error: ["Duplicate event"][when CLIENT_DATA { if { [UDP::local_port] == 1813 } { set CALLID [RADIUS::avp 31 string] set IP [RADIUS::avp 8 ip4] if { $IP ne "" &amp;&amp; $CALLID ne "" } { table set $IP [LB::server addr] 900 log local0. "Radius maps $IP to [LB::server addr] for $CALLID" } } }]&nbsp;&nbsp;--------------------------------&nbsp;The packet capture shows the AVP 31 attribute  (&nbsp;Calling-Station-Id) in it.  So the issue is not the attribute value missing, however, something that F5 is not able to understand is the packet not processing it forwards. &nbsp;&nbsp;Frame 2: 317 bytes on wire (2536 bits), 317 bytes captured (2536 bits)Ethernet II, Src: Fortinet_09:00:12 (00:09:0f:09:00:12), Dst: VMware_f5:03:01 (00:50:56:f5:03:01)802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 4091Internet Protocol Version 4, Src: 172.17.70.60, Dst: 10.1.6.100User Datagram Protocol, Src Port: 54892, Dst Port: 1812RADIUS Protocol&nbsp;&nbsp;&nbsp;Code: Access-Request (1)&nbsp;&nbsp;&nbsp;Packet identifier: 0x5e (94)&nbsp;&nbsp;&nbsp;Length: 164&nbsp;&nbsp;&nbsp;Authenticator: e0a10849518a2fc1f0827505db9f8a5c&nbsp;&nbsp;&nbsp;Attribute Value Pairs&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=NAS-IP-Address(4) l=6 val=172.17.70.60&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=NAS-Port(5) l=6 val=0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=NAS-Port-Type(61) l=6 val=Virtual(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=User-Name(1) l=15 val=mgalantowicza&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=User-Password(2) l=18 val=Encrypted&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=Service-Type(6) l=6 val=Shell-User(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=Calling-Station-Id(31) l=14 val=b0b867cd68ee&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Type: 31&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Length: 14&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Calling-Station-Id: b0b867cd68ee&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=Called-Station-Id(30) l=14 val=b0b867cd68ee&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=Vendor-Specific(26) l=23 vnd=Aruba, a Hewlett Packard Enterprise company(14823)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=Vendor-Specific(26) l=18 vnd=Aruba, a Hewlett Packard Enterprise company(14823)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AVP: t=Message-Authenticator(80) l=18 val=a0d082620a1137f9110e2a5975c7d6a8F5 Ethernet Trailer Protocol&nbsp;&nbsp;However, I will check the LTM logs. But last time I checked it really didn't give any error for the virtual server. It simply is not forwarding the traffic, to the load-balanced Radius servers. &nbsp;&nbsp;

Forum Discussion

iRule not working to have a RADIUS presistant load balancing.

2 Replies

Recent Discussions

F5 Rseries HA

Error when running bigip_command Playbook against LTM : Syntax Error: unexpected argument /bin/sh\n

Can iRule be used to perform exception of IPI category based on Geolocation

Can iRule mask the payload content on event logs of security

minimum tmos software version for connect CIS (openshift)

Related Content

Active/Active load balancing examples with F5 BIG-IP and Azure load balancer

Simple balancing doesn't work

NGINXaaS for Azure: Load Balancing

Recommended Persistence for F5 working as ISP-LB ( ISP Load Balancing )

What is Load Balancing?