Meru Smoothwall Radius accounting and load balancing

[mjk]

Does anyone know if this Is this possible before i spend too much time on it?

 

We have Radius authentication so that students log into the WiFi with their active directory username/password. This then puts them onto the correct student VLAN and also sends an accounting packet to Smoothwall that authenticates them so they can use transparent proxy mode but also be identified.

 

We now have two smoothwall servers that are load balanced.

 

I can add a secondary accounting server (the IP of the secondary smoothwall) to the Meru controller, but I'm not sure if it is secondary because it is fail-over or because it is used for load balancing. Does anyone know ? On the smoothwall side, does anyone know if the master server will send the secondary server the Radius auth info?

[mjk]

So it turns out that the transparent proxy load-balances perfectly across two servers, but only one picks up the username and the other has to do ident by location.

[RobFuller]

How have you found managing two smoothwall servers? It has crossed my mind more for redundancy than load.

[mjk]

Seems ok so far. We've only just put the second one in so I'll tell you when term starts!

The 'slave' system just replicates all the settings from the primary. We've load balanced using pac files and wccp. In theory the pac files and wccp will failover if one goes down but not tried that!.

 

I looked into redundancy as per smoothwall documentation and got the impression that it was load balancing OR redundancy because the redundant machine takes over the ip address of the master system, hence didn't think load balancing would work or be very easy using that method. If anyone knows different please enlighten me! For some reason our UTM-1000 is licensed for redundancy but the S8 is not so don't know how that works!.

[mjk]

We've been able to remove the smoothwall as the accounting server from the wireless controller config, replace it with windows NPS and have the NPS forward the accounting information to BOTH smoothwall servers. transparent proxy is now identified on both smoothwalls.

 

 

Failover using pac file using method : if isInNet(myIpAddress(), "ip","subnet")) {return PROXY A ; PROXY B;} is a bit hit and miss. doesn't seem to fail over very well.

Any ideas ?

[skell]

Hi @mjk

 

I'm trying to achieve something similar with our Meru and SmoothWall, without the complication of a second SmoothWall, but failing to get my head round it. Have you got any pointers?

[mjk]

Hi @mjk

 

I'm trying to achieve something similar with our Meru and SmoothWall, without the complication of a second SmoothWall, but failing to get my head round it. Have you got any pointers?

 

Yes happy to help.

I wrote some more details on this thread: http://www.edugeek.net/forums/wireless-networks/152208-new-wireless-authentication-methods.html