topic Re: UNKNOWN Domain radius server dead in Network Access Control

UNKNOWN Domain radius server dead

x00008037 — Mon, 02 Dec 2019 03:27:47 GMT

Currently have an issue when our edge switch reboots the authentication sessions on the switch come back with "UNKNOWN" domain.

The AAA server is marked as "alive" but these auth session stay in an "UNKNOWN" Domain and failed Authentication .

Shouldn't these port "reinitialize" when the AAA server become reachable again?

Re: UNKNOWN Domain radius server dead

howon — Thu, 05 Dec 2019 23:33:11 GMT

It may be possible that since this is due to switch reload rather than AAA down scenario, the reinitialization is not being triggered. It has been a while, but I recall suggesting to recycle the interface (shut/no shut) after such incident to get the authentication working, which can be scripted via management tool.

Re: UNKNOWN Domain radius server dead

x00008037 — Thu, 05 Dec 2019 23:53:46 GMT

Hi,

thanks for the reply, but even when the radius server is marked down the session on the switch ports fail into an authorized state with DOMAIN UNKNOWN. When the server becomes reachable again the Domain stays in UNKNOWN state,

Is there a mechanism to re-initilise the ports without a shut no shut? I would of though the switch port config "alive action re-initilize" as enough?

Re: UNKNOWN Domain radius server dead

howon — Fri, 06 Dec 2019 00:31:03 GMT

Try the following:

authentication event server dead action reinitialize {ACCESS_VLAN}

authentication event server dead action authorize voice

https://community.cisco.com/t5/security-documents/top-ten-mis-configured-cisco-ios-switch-settings-for-ise/ta-p/3643912#toc-hId--651964017

Re: UNKNOWN Domain radius server dead

x00008037 — Thu, 06 Feb 2020 06:46:18 GMT

Still an issue,

Ports are being marked in an UNKNOWN state when the radius server is marked DEAD. Then when radius server comes back online the DOMAIN remains in UNKNOWN state

Re: UNKNOWN Domain radius server dead

Captain82 — Thu, 19 Sep 2024 19:53:45 GMT

Did you find a resolution for the UNKNOWN state after RAIDUS servers were down?