<br><font size=2 face="sans-serif">Wayne,</font>
<br>
<br><font size=2 face="sans-serif">You might want to check out the AAA
throttling feature if its available on your IOS. This and the load-balance
method least-outstanding feature should work well. You may want to
start by throttling accounting records and then auth requests.</font>
<br>
<br><font size=2 face="sans-serif">Dan</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Tassos Chatzithomaoglou
<achatz@forthnet.gr></b> </font>
<br><font size=1 face="sans-serif">Sent by: cisco-bba-bounces@puck.nether.net</font>
<p><font size=1 face="sans-serif">10/06/2008 03:27 PM</font>
<td width=59%>
<table width=100%>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td valign=top><font size=1 face="sans-serif">cisco-bba@puck.nether.net</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td valign=top>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td valign=top><font size=1 face="sans-serif">Re: [cisco-bba] trouble when
a lot of users try and log on</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><tt><font size=2>Wayne,<br>
<br>
We use CAC for incoming vpdn sessions (it works for PPPoX too), which limits
the number of <br>
vpdn sessions being established simultaneously, based on either CPU or
session charges.<br>
<br>
call admission limit 320<br>
call admission vpdn 10 1<br>
<br>
The above numbers work ok with us, taking into account that they are from
a 10k platform <br>
(we don't use CAC on our 7200s, because they have very few sessions), the
LAC uses its own <br>
CAC method too, and our radius servers cannot handle too many requests
at the same time. <br>
Probably you'll have to experiment and find you own values.<br>
<br>
You can find more info below:<br>
</font></tt><a href="http://www.cisco.com/en/US/docs/routers/10000/10008/feature/guides/122_31sb13/cac-enha.html"><tt><font size=2>http://www.cisco.com/en/US/docs/routers/10000/10008/feature/guides/122_31sb13/cac-enha.html</font></tt></a><tt><font size=2><br>
<br>
We also use the following under the radius groups in order to split the
load on our radius <br>
servers according the auth/acct requests waiting in line:<br>
<br>
aaa group server radius XXX<br>
load-balance method least-outstanding<br>
<br>
More info can be found below:<br>
</font></tt><a href=http://www.cisco.com/en/US/docs/ios/12_2sb/feature/guide/sbrdldbl.html><tt><font size=2>http://www.cisco.com/en/US/docs/ios/12_2sb/feature/guide/sbrdldbl.html</font></tt></a><tt><font size=2><br>
<br>
Regarding the precloning thing, according to our experience with the 12.2(31)SB
series, <br>
precloning doesn't help much and we prefer using va subinterfaces (with
all their <br>
advantages/disadvantages). Here is the relevant output:<br>
<br>
<br>
7200#sh vtemplate<br>
Virtual access subinterface creation is globally enabled<br>
<br>
Active Active Subint
Pre-clone Pre-clone<br>
Interface Subinterface Capable Available
Limit<br>
--------- ------------ ------- --------- ---------<br>
Vt1 0
1370 Yes<br>
Vt2 0
235 Yes<br>
<br>
<br>
-- <br>
Tassos<br>
<br>
Wayne Lee wrote on 06/10/2008 15:07:<br>
> HI<br>
> <br>
> Whenever our L2TP provider has any problems and they drop our link
and<br>
> the 1500 or so L2TP / ADSL connections we have trouble when they all<br>
> try and log on again, so far the only way we have managed to get<br>
> through this is to restart the radius daemon on rad 1 after 200 logins<br>
> or so.<br>
> <br>
> We are running a 7206vxr (g1) with 1gig of mem, pre-clone is set for<br>
> 1500 sessions and we get the below error in the radius logs on rad
2<br>
> <br>
> Error: Dropping duplicate authentication packet from client Cisco-LNS<br>
> <br>
> We are currently running a old version of ICradius (on both) but we<br>
> are in the process of migrating to Freeradius, both radius servers
are<br>
> using a MySQL backend. We don't see any load on the sql DB or radius<br>
> servers but the CPU is high on the router. Would this be a radius<br>
> problem or a LNS problem?.<br>
> <br>
> The setup looks like this<br>
> <br>
> Provider ------> Rad1 -----------> Provider --------> LNS
---------> Rad2<br>
> <br>
> Rad 1 allows all users and only sends back Tunnel Server endpoint
IP<br>
> Rad 2 does final auth and any other attributes like static IP and
accounting<br>
> <br>
> <br>
> Thanks in advance for any help or pointers in debugging this.<br>
> <br>
> Wayne<br>
> _______________________________________________<br>
> cisco-bba mailing list<br>
> cisco-bba@puck.nether.net<br>
> </font></tt><a href="https://puck.nether.net/mailman/listinfo/cisco-bba"><tt><font size=2>https://puck.nether.net/mailman/listinfo/cisco-bba</font></tt></a><tt><font size=2><br>
> <br>
<br>
_______________________________________________<br>
cisco-bba mailing list<br>
cisco-bba@puck.nether.net<br>
</font></tt><a href="https://puck.nether.net/mailman/listinfo/cisco-bba"><tt><font size=2>https://puck.nether.net/mailman/listinfo/cisco-bba</font></tt></a><tt><font size=2><br>
</font></tt>
<br>