topic Re: WLC 9800 RADIUS failover failure in Wireless

WLC 9800 RADIUS failover failure

lawrence.allhands — Mon, 23 May 2022 18:23:24 GMT

So we were upgrading our RADIUS servers and when we did we noticed that the RADIUS failover did not happen as expected. I'm thinking my predecessor has the AAA Advanced settings set up incorrectly but I am not familiar with this model controller. Can someone verify the correct settings/behavior for the "AAA Advanced" for proper RADIUS failover on a WLC 9800-80 running 17.3.5a?

What I have now is

Retransmit Count = 3

Timeout Interval (seconds) = 5

Dead Time (Minutes) = Not configured - so I assume it is default of 5 minutes.

When digging in I read here (https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_aaa_dead_server_detection.html) that you can set up dead server detection criteria. So my question is, if you don't have any dead server detection criteria set up, will you ever get a failover?

Re: WLC 9800 RADIUS failover failure

Flavio Miranda — Mon, 23 May 2022 18:31:21 GMT

It must use a default value. I dont believe that exist correct value for this. It will depend on your environment. Basically, if you are starting fresh, you should use Cisco recommendation.

What is the output of :

show run | s dead-criteria

sh aaa dead-criteria radius <server>

Re: WLC 9800 RADIUS failover failure

Arshad Safrulla — Mon, 23 May 2022 23:36:26 GMT

For me Dead server detection works. My config is as below

aaa group server radius ISE-Corp
server name psn-002
server name psn-001
deadtime 5

radius server psn-001
address ipv4 X.X.X.X auth-port 1812 acct-port 1813
timeout 5
retransmit 3
automate-tester username wlc-keepalive
key 12345

radius server psn-002
address ipv4 X.X.X.X auth-port 1812 acct-port 1813
timeout 5
retransmit 3
automate-tester username wlc-keepalive
key 12345

radius-server dead-criteria time 5 tries 3
radius-server deadtime 5

More on this https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#:~:text=following%20GUI%20settings%3A-,RADIUS%20server%20timeout,-RADIUS%20authentication%20and

Re: WLC 9800 RADIUS failover failure

Mark Elsen — Tue, 24 May 2022 07:13:38 GMT

- Informational : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtl06706

Re: WLC 9800 RADIUS failover failure

lawrence.allhands — Tue, 24 May 2022 12:59:28 GMT

So when I #sho run | s dead-criteria shows nothing as it is not configured. The question I have is do I need to have that configured in order for RADIUS fail over to occur properly?

Re: WLC 9800 RADIUS failover failure

lawrence.allhands — Tue, 24 May 2022 12:51:07 GMT

Thanks for sharing! That is helpful. The question I have is, do we need to set the dead-time criteria for a fail over to work? Does not setting this prevent a RADIUS fail over?

Re: WLC 9800 RADIUS failover failure

lawrence.allhands — Tue, 24 May 2022 13:00:45 GMT

Thanks M8!

Re: WLC 9800 RADIUS failover failure

Arshad Safrulla — Tue, 24 May 2022 13:34:31 GMT

I am not sure tbh, as I consider this to be mandatory for my deployments just because of what it does.

radius-server dead-criteria is used to define the number of time a device sends a request to the RADIUS server when no response from the RADIUS server is received and breach the configured parameters it marks the server down, which allows the device to send the request to another server.

Re: WLC 9800 RADIUS failover failure

lawrence.allhands — Tue, 24 May 2022 14:45:19 GMT

It is required FYI - https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtl06706