topic Re: WLC and AAA server TTL time in Wireless

WLC and AAA server TTL time

abinaya.2.r — Mon, 05 Jul 2021 19:53:51 GMT

Hi,

I am installing a 3504 WLC . The WLC is located at Brazil and the RADIUS servers are at Australia.

Can some one tell what should be the maximum TTL between the WLC and the RADIUS server as part of cisco's best practice?

Also is there is any guide/link to refer, please share with me,

Re: WLC and AAA server TTL time

MHM Cisco World — Thu, 10 Dec 2020 13:54:52 GMT

depend if there is VPN or not from site to site.

Re: WLC and AAA server TTL time

Mark Elsen — Thu, 10 Dec 2020 16:42:28 GMT

- Presumably if the TTL falls within the spec mentioned below - you will be safe :

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-6/b_Cisco_Wireless_LAN_Controller_Configuration_Best_Practices.html#concept_42BA20535D2D4B3D815720133BC6AEFC

Re: WLC and AAA server TTL time

Scott Fella — Thu, 10 Dec 2020 17:04:02 GMT

Well I would first check what the latency is so everyone has an idea. You also should look at the default timers that are set and possibly if that would need to be increased. Then you also need to check with the vendor of the radius server and see what is their best practice and also what the timeout setting is.

Re: WLC and AAA server TTL time

abinaya.2.r — Thu, 10 Dec 2020 17:12:21 GMT

Below is the ping response of the two RADIUS servers. I tried to ping the RADIUS servers from the switch where wlc is connected. Is this a 300ms roundtrip would cause any delay? What is recommended round trip as per best practices

switch#ping x.x.x.x
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to x.x.x.x, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 330/336/340 ms
switch#
switch#ping y.y.y.y
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to y.y.y.y, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 330/334/340 ms

Re: WLC and AAA server TTL time

MHM Cisco World — Thu, 10 Dec 2020 17:18:39 GMT

are you use any DMVPN WAN ?

Re: WLC and AAA server TTL time

Scott Fella — Thu, 10 Dec 2020 17:32:02 GMT

What is the recommendations from the radius server manufacturer? That might be pushing the limits.

Re: WLC and AAA server TTL time

Scott Fella — Thu, 10 Dec 2020 17:42:02 GMT

Here is a thread for Cisco WLC and Cisco ISE suggests no more than 200ms. Now what you can and can’t get away with is up to you testing.

https://community.cisco.com/t5/network-access-control/maximum-value-for-the-round-trip-latency-between-ise-and-wlc/m-p/2943740/highlight/true

Re: WLC and AAA server TTL time

abinaya.2.r — Thu, 10 Dec 2020 17:42:46 GMT

NO. DMVPN is not used.. It is MPLS here.

Re: WLC and AAA server TTL time

Scott Fella — Thu, 10 Dec 2020 17:57:53 GMT

What radius server are you using?

Re: WLC and AAA server TTL time

abinaya.2.r — Thu, 10 Dec 2020 18:02:18 GMT

RADIUS server is hosted on Azure cloud.

Re: WLC and AAA server TTL time

Scott Fella — Thu, 10 Dec 2020 20:27:32 GMT

What radius server is it? You can host different radius servers like ISE, ClearPass, etc. You should reach out the to manufacture of the radius or hit up the forum for that radius server to get some suggestions.