topic Re: 802.1X - multi server radius ?? in Network Access Control

802.1X - multi server radius ??

m.humbert — Tue, 19 Oct 2021 13:36:23 GMT

Hi everyone,

i'm working on project to deploy 802.1X security on all my L2 switches on our HQ. this part is the first step but we plan to deploy this security on all L2 switches of remote site (Branch office, shop, warehouse..)

- we are using NPS from Win2016 Std

i would like to know if it possible to setup two Radius server for dot1x authentication on switches? (redondancy purpose) like you can setup two dhcp server.

So if the first radius down, the switch try to reach the second one....

Re: 802.1X - multi server radius ??

Rob Ingram — Tue, 19 Oct 2021 13:51:30 GMT

@m.humbert yes you can, setup 2 radius servers and add them to a aaa group, reference the group in the aaa authentication command.

radius server ISE-1 
address ipv4 192.168.10.10 auth-port 1812 acct-port 1813 
automate-tester username switch-probe ignore-acct-port probe-on 
key XXXXXXXX 
! 
radius server ISE-2 
address ipv4 192.168.10.11 auth-port 1812 acct-port 1813 
automate-tester username switch-probe ignore-acct-port probe-on 
key XXXXXXXX 
! 
aaa group server radius ISE-RADIUS 
server name ISE-1 
server name ISE-2
!
aaa authentication dot1x default group ISE-RADIUS

Re: 802.1X - multi server radius ??

Pat Pouna — Tue, 19 Oct 2021 17:15:12 GMT

@m.humbert - Yes. Like @Rob Ingram said, you can list those in a group and used the group name in your aaa statements. The first in the list is the active one; if down, the switch try the next and so on.

On some platforms, it could look like this:

service password-encryption

aaa group server radius "ISE_Group_Name"
server-private "IP_ISE1" auth-port 1812 acct-port 1813 key "Radius_Key"
server-private "IP_ISE2" auth-port 1812 acct-port 1813 key "Radius_Key"

aaa authentication dot1x default group "ISE_Group_Name"
aaa authorization network default group "ISE_Group_Name"
aaa accounting dot1x default start-stop group "ISE_Group_Name"

Re: 802.1X - multi server radius ??

m.humbert — Wed, 20 Oct 2021 08:51:24 GMT

Hi Rob,

many thanks for your help !

i had some trouble with other option but i finished to make it works 🙂

have nice day !