RADIUSE and TACACS Fallback to Secondary AAA-Server

[Augustine Okojie]

Hello,

Can someone help me understand how RADIUS/TACACS determine the primary AAA-Server is unreachable before fallback to secondary AAA-Server, is this based on a RADIUS or TACACS session or IP-reachability. If based on IP, how exatcly does that work?

Thanks.

[marce1000]

 - Have a look at the radius dead timer and or timeout settings from the document link below; which will dictate the failover or transit behavior for the switch. How exactly it works, -> is how you set certain parameters (well how excatly it works is then left over to the inner IOS-implemenation).

         https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfrad.html

M.

[hslai]

See also Demystifying RADIUS Server Configurations - Cisco and ISE Secure Wired Access Prescriptive Deployment Guide

[bern81 · Accepted solution]

Hi Augustine.

It is all based on the Deadtime timers you configure.

radius-server dead-criteria time 5 tries 3  ( will wait 5x3 seconds before declaring the Radius server as Dead)
radius-server deadtime 15 (once it is Dead, the switch will check after 15 minutes to see if the server is now reachable, and it will put it Alive for few moment before declaring it Dead again).

The check are based on the radius udp port 1812 0r 1645.

As an advise you the automate-tester user in the radius config with Probe-on to avoid having outage loops when the server is considered alive but it is in reality Dead.

I hope this helped.

Please rate if answer is helpful.

[Augustine Okojie]

Does the same apply for TACACS+?

[bern81 · Accepted solution]

For TACACS+ it is different (it runs over TCP port 49)


you can configure in the global config:

(config)# tacacs-server timeout 10 (seconds)

The switch/router will try to TCP 49 the ISE server, if no reply within 10 sec, it will consider the tacacs server dead and try the secondary.
if both are down you can configure an alternative method like check the local user database.

(config )# aaa authentication login VTY group tacacs+ local-case

I hope this helps.
Please rate if solution is helpful