topic Re: The command is used to in Network Access Control

authentication event server dead action for radius group

tomi.sirait — Mon, 11 Mar 2019 05:01:13 GMT

Hi,

Need help to understand "authentication event server dead " on interface configuration of the IOS.

I found this applies globally, I mean this condition is triggered if all radius servers are dead.

How if we want to make this condition for only one group of radius?

Tomi

The command is used to

nspasov — Tue, 16 Sep 2014 00:36:32 GMT

The command is used to configure action(s) that will be taken for ports configured for authentication in the event when all Radius servers become unavailable. For instance:

authentication event server dead action authorize vlan 55

authentication event server alive action reinitialize

With the above syntax, the configured port will be authorized/fail-open to VLAN 55 if/when the globally configured Radius servers become unavailable. Once the server(s) become available again all of the configured ports will be re-initialized, thus forcing them to perform regular dot1x/mab authentication.

The command is configured per-port and cannot be tied to a set of Radius servers. The radius servers used are configured under your global aaa commands.

Hope this helps

Thank you for rating helpful posts!

http://www.cisco.com/c/en/us

Venkatesh Attuluri — Tue, 16 Sep 2014 11:24:47 GMT

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/sw8021x.html#wp1274284

link explains the following command

authentication event server dead action {authorize | reinitialize} vlan vlan-id

this is interface level command

hi Neno,

niketan sutar — Sun, 15 May 2016 08:23:04 GMT

hi Neno,

one small query here.

now the command also gives <cr> on

authentication event server dead action authorize ?

so if i do not specify any VLAN what happens then???

thanks,

Nick

Re: The command is used to

Stuart C — Fri, 27 Apr 2018 09:08:29 GMT

HI,

What would happen in this scenario.

Access port configured into VLAN50 "switchport access vlan 50" but the radius server dead configuration "authentication event server dead action vlan 10. Vlan 10 does not exist on the switch however, only vlan 50.

I've come across this config and it seemed to cause a problem, i'm just trying to find out why. This was the issue. ISE went unreachable from local switch. Only phones on the switch stayed authenticated. The PCs dropped off the network.

When ISE came back up the PCs still didn't authenticate correctly. On ISE we saw the users as authenticated. But on the switchport, they were showing in an unknown state "show authentication sessions". Bouncing the port caused the users to re-authenticate, but still the port stayed in unknown state. The only work around was to remove the authentication event server dead action vlan 10 and then bounce the port.

So I am trying to work out why this config may have caused this issue? Any ideas?

Thanks

Re: authentication event server dead action for radius group

Octavian Szolga — Thu, 15 Jul 2021 22:06:23 GMT

Hi,

This is critical auth for multi-domain:

switchport mode access

switchport access vlan <X>

authentication host-mode multi-domain

authentication event server dead action authorize

authentication event server dead action authorize voice

authentication event server alive action reinitialize

No need to specify the VLAN. It is the access port VLAN.

This is critical auth for multi-auth:

switchport access vlan <X>

switchport mode access

authentication host-mode multi-auth

authentication event server dead action reinitialize vlan <X>

authentication event server dead action authorize voice

authentication event server alive action reinitialize

Please check you switchport config.

BR,

Octavian

Re: authentication event server dead action for radius group

bogdan.sileanu — Tue, 21 Oct 2025 10:33:37 GMT

Hi Octavian,

Actually, at least on newer IOS versions(17.12+), in case of multi-domain, you might want to stay away from authorizing also the voice:

switchport mode access

switchport access vlan <X>

authentication host-mode multi-domain

authentication event server dead action authorize

authentication event server alive action reinitialize

If you also add 'authentication event server dead action authorize voice' your data vlan users will get authorized on both data and voice VLANs and their MAC addresses will show up in both VLANs. Works for end user, but very messy.

For this setup suggest using also:

radius server ISE1
automate-tester username Test_User ignore-acct-port probe-on

This way your switch stops assuming radius server is back up after the deadtime expires, which will not cause the reinitialize from alive action that would have caused few seconds of downtime on the endpoint.

KR,

Bogdan