Hi Alan, Thanks for your information.
Regards, Nikitha On 2/17/07, Alan DeKok <[EMAIL PROTECTED]> wrote:
nikitha wrote: > When the request comes to the radius server, it goes one entry by entry > in "users" file, ie., It connects to ldap-server-1 with the Ldap-Group > tries from g1 till g20, and then connects to ldap-server-2 with > Ldap-Group from "g21' till g50. If the user is part of Ldap-group "g50" > it takes more time to return success, before itself the request times > out, and received eap start again from wireless client. Yes. The LDAP query results aren't cached. > If the "number of DEFAULT entry for ldap-server-1" is less than 10, then > it works fine. If the default entry increases, the server takes more > time to process. Yes, the solution is to not configure so many queries that the server slows down. > I think redundant ldap server configuration is not correct or in some > otherway we can fix it. Is it possible to configure the radius server in > such a way that, try ldap-server-1 for the first policy, if its > reachable then check it against the next policy. For LDAP-Group checking, no. > If its not reachable mark this server as dead or whatever and ignore > processing the next coming DEFAULT entries which matches with > ldap-server-1 and try to process ldap-server-2 entries. That may be possible with source code patches. i.e. If an LDAP server is marked "dead", don't try to contact it for a few seconds. That would help your configuration a lot. But your configuration is an artificial one that highlights a problem. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
