u/Alepo_Technologies
-
1points
-
1points
-
1points
-
0points
Accounting packets are 95% of your AAA traffic and 100% of your billing disputes. Here’s how to stop both. (i.redd.it) [🌐 Internet Services]
-
1points
-
1points
-
4points
If you’ve never actually pulled the plug on your primary AAA server, you don’t have HA. You have hope. (i.redd.it) [🌐 Internet Services]
-
3points
-
2points
-
0points
-
0points
-
2points
-
2points
-
4points
-
3points
-
0points
Multi-market operators: what’s been your biggest headache with legacy AAA? (i.redd.it) [Link]
-
1points
Multi-market operators: what’s been your biggest headache with legacy AAA? (i.redd.it) [❓ Question ]
-
3points
-
3points
-
2points
-
3points
Alepo_Technologies
Alepo_Technologies
What are you running on it, FreeRADIUS or NPS?
Alepo_Technologies
NPS is out. Pick cloud RADIUS if you don’t want to own infrastructure and want compliance checks. FreeRADIUS is solid if you have the skills and monitor CRL refreshes and server cert renewals.
Alepo_Technologies
realistically, no RFC anytime soon, and we wouldn’t guess a date.
That said, we don’t think the timeline changes much in practice:
- The BlastRADIUS mitigations it describes (require Message-Authenticator, put it first in responses, limit Proxy-State) are what vendors already shipped as patches in 2024. You don’t need an RFC to turn those on.
- RadSec isn’t new. RFC 6614 and RFC 7360 have been around as experimental specs for over a decade, and eduroam and OpenRoaming run on it today.
- The direction is pretty settled: the draft’s own position is that RADIUS/UDP should be secured, not fixed, and that new crypto work on RADIUS itself is off the table.
So I’d treat it less as “a deadline is coming” and more as “this is where the consensus is, and the cheap mitigations are available now.” I’ve edited the post to say “moving toward deprecation” rather than implying it’s done.
Ha, fair. "Pull the plug" was doing a lot of heavy lifting there. I meant the network plug, or kill -9 the process, or a hard power-off of the VM from the hypervisor. Anything that's an ungraceful failure instead of a polite shutdown. Nobody needs to cut power on prod hardware to prove a point.
Honestly, what you described is exactly what the post is arguing for: multiple boxes, different buildings, different states, 15s to detect, offline copies of the data. You're not the guy I was writing about. The guy I was writing about has a "secondary" that half his NAS boxes don't even know exists.
As for the 5ESS/DMS: point taken, nobody yanks power on a class 5 for fun. But those switches are kind of my argument. Duplicated processors, and the switch guys exercised the standby side on a schedule instead of just trusting it. That's all I'm asking people to do with AAA.