AAA_DOT1X radius DEAD

getaway51 — Thu, 06 May 2021 03:18:05 GMT

hI,

It seems the Radius DEAD and ALIVE logs were occuring every few minutes. User complains it affect their access. However I thought when AAA down, all hosts will be AZ (authorised)? It seems AAA servers intermittent reachability frm the switch affects host access. How is this possible espeecially when script says AAA-down, all Authorised?

Also both AAA servers are fine, however switch logs says otherwise. It cant be 2 AAA down at same time. there wasnt any ping timeout but switch keeps logging AAA unreachable every few mins.

Below are my script. Any idea guys?

May 6 13:24:11.350: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.1.1.1:1812,1813 is not responding.
May 6 13:24:26.920: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.1.1.2:1812,1813 is not responding.
May 6 13:24:26.920: %RADIUS-3-ALLDEADSERVER: Group AAA_DOT1X: No active radius servers found. Id 110.

class-map type control subscriber match-any AAA-DOWN-AUTH
match result-type aaa-timeout

match authorization-status authorized
!
class-map type control subscriber match-all AAA-DOWN-UNAUTHD
match result-type aaa-timeout
match authorization-status unauthorized
!
class-map type control subscriber match-all DOT1X_FAILED
match method dot1x
match result-type method dot1x authoritative
!
class-map type control subscriber match-all DOT1X_NO_RESP
match method dot1x
match result-type method dot1x agent-not-found

20 class AAA-DOWN-UNAUTHD do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 authorize
40 pause reauthentication

30 class AAA-DOWN-AUTH do-until-failure
10 pause reauthentication
20 authorize

Re: AAA_DOT1X radius DEAD

Francesco Molino — Mon, 10 May 2021 02:52:57 GMT

Affected users are the one already authorized or new people connecting?

The class-map AAA-DOWN-AUTH is in match-any instead of match-all.

Then, have you ran a debug radius to see why your AAA servers are flapping between alive and not alive?

topic Re: AAA_DOT1X radius DEAD in Network Access Control

AAA_DOT1X radius DEAD

Re: AAA_DOT1X radius DEAD