Hello, I have a gateway pair in dmz with radius auth and I am offloading this radius traffic to internal lb pair. My understanding is I need to have radius clients setup in rsa for the 2 dmz vpx nsips and the internal lb snip. This is working but ideally I would like to be able to only allow the traffic to the internal lbvip and not from the dmz nsips to rsa. It seems counter intuitive to offload to the internal lb but still have to open up the dmz firewalls fir the nsip traffic. Does this sound right or is there a better way to do this?

You only need the SNIP of the internal pair as radius client if you use the lb vip in the radius action/server in dmz. NSIP will only be used if no lb is in place.

I am pointing the radius server in dmz to the internal lbvip, this is what I want to do, i.e do the load balancing internally.. It is only working when I have the nsips of dmz vpx setup as radius clients aswell as the internal lb pair snip.

The RADIUS load balancing on NetScaler "keeps on giving", I think I saw somewhere that creating a PBR could solve the issue, but can't say for sure. It's a struggle.

To fix this on the DMZ pair I would create a fake radius lb VIP ON the DMZ pair. This could be a non-routable address like 3.3.3.3, then the member of the service group should be the IP of the LB radius VIP on the internal pair. PBR would also do the job though.

Either way, if you end up with PBR or the solution Dave presented above, it's important to document it somewhere. If a problem arises it'll be a tricky one to solve 😄

Thanks guys, i dont have much experience with PBR. Anything else you can share to give me a head start here? I presume i want to have a policy to send all Radius traffic from the SNIP or something similar?

@Cormac Long, I think this is what Dale described -> https://www.ferroquesystems.com/resource/dude-wheres-my-auth-request-adventures-in-radius-load-balancing/

The VIP will still not source the traffic on the internal - it will be the SNIP that needs to be the RADIUS client

I traced this yesterday and confirmed that traffic does in fact only originate from the SNIP of the internal LB VPX pair. However the RADIUS packet that gets sent to the RADIUS appliance includes a field called "NAS-IP-Address" which contains the NSIP of the external VPX. This seems to explain why i need these as RADIUS clients. I am ok with this as the traffic is going how i expect it to and i dont have to open up the firewalls for the NSIPs. Thanks folks.

thanks for that explanation because I generally have added the snip and nsips before and not understood why I needed to add all three if I was using balancing, but that explained that

not tested but maybe possible to change using rewrite

add rewrite action rwAct_RadiusNASIP replace RADIUS.REQ.NAS_IP_ADDRESS q/RADIUS.NEW_AVP(4,"Subnet IP")/
add rewrite policy rwPol_RadiusNASIP true rwAct_RadiusNASIP