topic Server status: FAILED in Network Security

Server status: FAILED

Ibrahim Jamil — Mon, 11 Mar 2019 20:24:48 GMT

Hello Folks

when i issue the command the sh aaa-server MYACS,I Noted the below msg for server status,how to troubleshoot and fix this issue?

Server Group:    MYACS
Server Protocol: radius
Server Address: 192.168.100.100
Server port:     1645(authentication), 1646(accounting)
Server status:   FAILED, Server disabled at

Re: Server status: FAILED

mvsheik123 — Fri, 22 Apr 2011 01:26:33 GMT

Hi,

PIX/ASA lost connectivity to radius server. Make sure network path is available and the ASA IP/name and node key correctly configured on Radius server.

You can test the server authentication from ASA using command - test aaa-server authentication . Also, you can try enabling debug aaa-server see where the issue is.

hth

Re: Server status: FAILED

Jennifer Halim — Fri, 22 Apr 2011 01:30:18 GMT

When the AAA server is in FAILED state, you can check to ensure that you have connectivity to the AAA server by trying to ping it.

Once confirm that connectivity between the ASA and the AAA server is up, you can re-activate the server with the following command:

aaa-server active host 192.168.100.100

If you check the status again:

show aaa-server MYACS host 192.168.100.100

it should say it's ACTIVE now.

Hope this helps.

Re: Server status: FAILED

Ibrahim Jamil — Fri, 22 Apr 2011 08:44:08 GMT

i have 3 acs in the group MYACS,both r okay but the third one gave the failed status so when you use this command aaa-server active host 192.168.100.100 ,r u sure this dosnt affect the first acs(192.168.100.101) who is active and serve the vpn users

thanks

Re: Server status: FAILED

brquinn — Fri, 22 Apr 2011 14:52:57 GMT

The default aaa-server reactivation mechanism is depletion. This means that failed servers only reactivate after all of the servers in the group are inactive. The command given to you will manually reactivate the sever, but it will not affect existing servers.

Command Reference link:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/a1.html#wp1558160

Thanks,

Brendan

Re: Server status: FAILED

mvsheik123 — Fri, 22 Apr 2011 15:03:16 GMT

With reference to postring about 3 servers in the group.. just a note , on ASA you do not need to add all the 3 servers if they are Master/replica. The master is enough and ASA will get all the info from the master and will look for replica/backup incase Master is not available.

Thx

PS: I mentioned this as I added all the servers on my prod ASA and later realised that was not required. Everything works great with all the servers status 'OK'.