topic Re: Radius Token Server or External Radius Server Down in Network Access Control https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436283#M511226 <HTML><HEAD></HEAD><BODY><P style="font-size: 13.3333px;">I think AuthC policy should be able to accomodate this.</P><P style="font-size: 13.3333px;"></P><P style="font-size: 13.3333px;">If Process failed then "Drop"</P></BODY></HTML> Wed, 28 Mar 2018 20:24:37 GMT umahar 2018-03-28T20:24:37Z Radius Token Server or External Radius Server Down https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436282#M511225 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>In the event that a radius token server or proxy radius server goes down will ISE send an access-reject back to the NADs or will ISE not send any response back and the NADs will mark ISE server down sending the endpoints into critical auth vlan ?</P></BODY></HTML> Wed, 28 Mar 2018 20:08:32 GMT https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436282#M511225 umahar 2018-03-28T20:08:32Z Re: Radius Token Server or External Radius Server Down https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436283#M511226 <HTML><HEAD></HEAD><BODY><P style="font-size: 13.3333px;">I think AuthC policy should be able to accomodate this.</P><P style="font-size: 13.3333px;"></P><P style="font-size: 13.3333px;">If Process failed then "Drop"</P></BODY></HTML> Wed, 28 Mar 2018 20:24:37 GMT https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436283#M511226 umahar 2018-03-28T20:24:37Z Re: Radius Token Server or External Radius Server Down https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436284#M511227 <HTML><HEAD></HEAD><BODY><P>The options do not seem applicable to external RADIUS server sequence. I did a quick test in my lab and got below so it looks like always drop.</P><P></P><TABLE border="0" class="content_table"><TBODY><TR><TD width="31%"> Event</TD><TD style="color: red;" width="69%"> 5405 RADIUS Request dropped </TD></TR><TR><TD width="31%"> Failure Reason </TD><TD style="color: red;" width="69%"> 11353 No more external RADIUS servers; can't perform failover </TD></TR><TR><TD width="31%"> Resolution </TD><TD width="69%"> Verify the following: At least one of the remote RADIUS servers in the ISE proxy service is up and configured properly ; Shared secret specified in the ISE proxy service for every remote RADIUS server is same as the shared secret specified for the ISE server ; Port of every remote RADIUS server is properly specified in the ISE proxy service. </TD></TR><TR><TD width="31%"> Root cause </TD><TD width="69%"> Failover is not possible because no more external RADIUS servers are configured. Dropping the request. </TD></TR></TBODY></TABLE><P></P><P></P><P>In case of RADIUS token server, you are correct that the server timeouts are treated as process failures.</P><P></P><TABLE border="0" cellpadding="3" class="content_table_steps"><TBODY><TR><TD></TD></TR><TR><TD> </TD><TD> 24616 </TD><TD> RADIUS token identity store received timeout error </TD></TR><TR><TD> </TD><TD> 22059 </TD><TD> The advanced option that is configured for process failure is used </TD></TR><TR><TD> </TD><TD> 22062 </TD><TD> The 'Drop' advanced option is configured in case of a failed authentication request </TD></TR></TBODY></TABLE></BODY></HTML> Thu, 29 Mar 2018 05:09:36 GMT https://community.cisco.com/t5/network-access-control/radius-token-server-or-external-radius-server-down/m-p/3436284#M511227 hslai 2018-03-29T05:09:36Z