topic Radius server fall back for 802.1X SSID in Network Access Control

Radius server fall back for 802.1X SSID

Mateen Ahmad — Mon, 13 Oct 2025 09:52:29 GMT

Hi,

I have only 2 ISE nodes configured as PAN and PSN's, and both are running only Wired and wireless Dot1x with PEAP-MSCHAPv2.

I have C9800 controller and AP's in Flex mode, also Meraki MR Access points both are integrated with ISE for user authentications.

My question is how can i ensure services to continue incase my both ISE servers are down.

Both Platforms are enabled with Do1x on SSID's.

Thanks

Re: Radius server fall back for 802.1X SSID

balaji.bandi — Mon, 13 Oct 2025 12:18:17 GMT

You need to configure your ISE deployment for high availability.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/install_guide/b_ise_installationGuide32/b_ise_InstallationGuide32_chapter_1.html

Re: Radius server fall back for 802.1X SSID

Arne Bier — Mon, 13 Oct 2025 21:22:03 GMT

I agree with @balaji.bandi - you need to ensure that at least one ISE is always alive, and that the wireless NAD devices (Meraki, C9800 etc.) have both ISE IPs configured. If you have total ISE failure, then wireless 802.1X will fail - I am not aware of a "fail open" mechanism for wireless 802.1X.

On the wired side, you can implement clever critical auth mechanisms on Cisco Catalysts switches using IBNS 1.0 and IBNS 2.0