Radius Server load balancing

miles.m.simpson.ctr1 — Mon, 11 Mar 2019 05:42:22 GMT

I'm trying to setup my switches to authenticate to 4 different radius servers. I have two of them added and entered into the config, but it looks like it is only sending authentication requests to the first one listed. I'm guessing the standard config uses the primary unless it is marked dead. Is this true? Is there a way to force it to load balance the requests evenly?

sho run | i radius
aaa authentication dot1x default group radius
aaa authorization network default group radius if-authenticated
ip radius source-interface VlanX
radius-server host x.x.x.x auth-port 1812 acct-port 1813 key 7
radius-server host x.x.x.x auth-port 1812 acct-port 1813 key 7
radius-server deadtime 1

Without using a load balancer

Marvin Rhoads — Mon, 04 May 2015 15:37:43 GMT

Without using a load balancer in front of the RADIUS servers, the only way is to put one server first for some network access devices (NADs) and another server first for others.

As long as the first one in the list is marked up, the NAD will use it.

A few devices (e.g., Meraki) do allow you to specify round-robin RADIUS selection. Reference.

A true load balancer (or "application delivery controller") allows much more intelligent server selection - using least connections, server weighting, etc. in the selection process.

topic Radius Server load balancing in Network Access Control

Radius Server load balancing

Without using a load balancer