Radius Accounting Authentication Association

Revision as of 15:23, 5 February 2014

Applies to version(s): v2.7

With version 2.7.31+, Toolpack has the Associated server field in the RADIUS Client configuration page:

Association Field in Radius Configuration

General Usage

Link accounting and authorization together.

This allows to specify that whenever one of the two associated server is the Current one, then the other one should also be set as the current one.

So both servers have to be the 'current' at the same time.

The association can ensure that Toolpack sends RADIUS requests to a single physical RADIUS server at a time.

The association resolves a problem when you would have two physical RADIUS servers, each server hosts an accounting and authorization server, and you have a limitation on the Radius server to run the primary accounting and authentication on the same server (identical IP).

A specific scenario

There are 2 Radius AUTH servers provisioned (IPerbill & IPeradius) and 2 Radius ACCT servers provisioned (the same IPerbill & IPeradius)

So there are 3 different possibilities for switchover:

1.- Toolpack will work with IPerbill as master for ACCT and AUTH

2.- In case of external failure Toolpack will switchover both stacks ACCT and AUTH to IPeradius

3.- In some specific cases of external failures Toolpack will switchover only one stack, so we will have AUTH to IPerbill and ACCT to IPeradius:

- either: AUTH to IPerbill and ACCT to IPeradius

- or: ACCT to IPerbill and AUTH to IPeradius

In this case, associating the accounting and authentication to the same IP will prevent occurrence of scenario 3.