Peering

Connecting the institution’s RADIUS servers with the REANNZ RADIUS servers.

This involves firewall and config changes on both sides so that eduroam traffic from onsite gets forwarded to the REANNZ servers, and that the REANNZ servers can monitor the institution’s servers in reply. This communication will be protected by a PSK (Pre-Shared Key).

We are looking at RADSec (Secure RADIUS) for the future, but that is not an option yet.

Institution needs to allow bidirectional UDP traffic ports 1812-1813 for these servers.

210.7.42.30 (nzflr1.reannz.co.nz): Send SP traffic here

210.7.42.31 (nzflr2.reannz.co.nz): Send SP traffic here

210.7.46.30 (eduroam1.reannz.co.nz): Accept IdP and monitoring queries from here

210.7.47.30 (eduroam2.reannz.co.nz): Accept IdP and monitoring queries from here

The nzflr addresses are resilient. Best practice is to load balance your SP traffic across the servers using an EAP (Extensible Authentication Protocol) aware load balancing technology.

Where possible enable processing of RADIUS Server-Status packets for monitoring of the system