topic Re: How to configure CTS Server RADIUS Load balancing in CSR1000v in Network Access Control

How to configure CTS Server RADIUS Load Balancing in CSR1000v

rezaalikhani — Tue, 10 Sep 2024 05:55:41 GMT

Hi all;

Consider the following output from a CSR1000v with IOS XE 17.03.05 or Catalyst 8000v:

My problem is that, I could not find a way in this platform to configure the CTS Server RADIUS Load Balancing feature.

Any ideas?

Thanks

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

MHM Cisco World — Thu, 05 Sep 2024 16:42:32 GMT

load-balance method least-outstanding [batch-size number] [ignore-preferred-server] <<- this command under radius group

MHM

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

rezaalikhani — Thu, 05 Sep 2024 17:14:26 GMT

Thanks for your reply;

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

MHM Cisco World — Thu, 05 Sep 2024 17:18:16 GMT

Add at least two server under group and check

Thanks

MHM

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

Rob Ingram — Thu, 05 Sep 2024 18:25:12 GMT

@rezaalikhani I've not tried it myself yet, but TrustSec server list can be randomised.

Server and IP Address Selection Process

The order of server-selection is the private server-list (received as part of server-list download), followed by the public server-list (configured servers). Within these server lists, the order can either be random selection or in-order selection based on whether the cts policy-server order random command is enabled or not.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/17-13/configuration_guide/cts/b_1713_cts_9200_cg/sgacl_and_environment_data_download_over_rest.html#con_policy_server_selection_criteria

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

rezaalikhani — Thu, 05 Sep 2024 18:35:54 GMT

Look at the following figure:

Any ideas?

Thanks

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

rezaalikhani — Thu, 05 Sep 2024 18:39:19 GMT

I already know this feature but based on the following screenshot, apparently it is another feature than CTS server load balancing...

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

Rob Ingram — Thu, 05 Sep 2024 18:48:11 GMT

@rezaalikhani try the command cts server load-balance command:-

https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/command_sum.html#10301

The previous example was if using Rest API method.

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

rezaalikhani — Fri, 06 Sep 2024 03:27:45 GMT

Thanks for your reply; I already tried your mentioned solution:

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

Rob Ingram — Fri, 06 Sep 2024 06:10:37 GMT

@rezaalikhani I checked in my lab, it looks like that command is not available on CSR1000v 17.3

However it does work on IOL image

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

balaji.bandi — Fri, 06 Sep 2024 06:14:30 GMT

Looks for me this may be limitation of v image, what is the version of CSR1000v you trying ? - have you tried latest version ?

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

Damien Miller — Fri, 06 Sep 2024 06:19:40 GMT

I've done a lot of trustsec deployments and never needed this. Is there a specific use of the case here or reason you want this enabled?

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

rezaalikhani — Tue, 10 Sep 2024 05:53:57 GMT

Thanks for your reply;

The same behavior is observed in Catalyst 8000v with IOS XE version 17.12. Agreed with you, I think this is the limitation of "v" images...

Re: How to configure CTS Server RADIUS Load balancing in CSR1000v

rezaalikhani — Tue, 10 Sep 2024 05:54:47 GMT

Just for my understanding and research...