802.1X - multi server radius ??

[m.humbert]

Hi everyone,

i'm working on project to deploy 802.1X security on all my L2 switches on our HQ. this part is the first step but we plan to deploy this security on all L2 switches of remote site (Branch office, shop, warehouse..)

- we are using NPS from Win2016 Std

i would like to know if it possible to setup two Radius server for dot1x authentication on switches? (redondancy purpose) like you can setup two dhcp server.

So if the first radius down, the switch try to reach the second one....

[Rob Ingram · Accepted solution]

@m.humbert yes you can, setup 2 radius servers and add them to a aaa group, reference the group in the aaa authentication command.

radius server ISE-1 
address ipv4 192.168.10.10 auth-port 1812 acct-port 1813 
automate-tester username switch-probe ignore-acct-port probe-on 
key XXXXXXXX 
! 
radius server ISE-2 
address ipv4 192.168.10.11 auth-port 1812 acct-port 1813 
automate-tester username switch-probe ignore-acct-port probe-on 
key XXXXXXXX 
! 
aaa group server radius ISE-RADIUS 
server name ISE-1 
server name ISE-2
!
aaa authentication dot1x default group ISE-RADIUS

[m.humbert]

Hi Rob,

many thanks for your help !

i had some trouble with other option but i finished to make it works

have nice day !

[Pat Pouna]

@m.humbert - Yes. Like @Rob Ingram said, you can list those in a group and used the group name in your aaa statements. The first in the list is the active one; if down,  the switch try the next and so on.

On some platforms, it could  look like this:

service password-encryption

aaa group server radius "ISE_Group_Name"
server-private "IP_ISE1" auth-port 1812 acct-port 1813 key "Radius_Key"
server-private "IP_ISE2" auth-port 1812 acct-port 1813 key "Radius_Key"

aaa authentication dot1x default group "ISE_Group_Name"
aaa authorization network default group "ISE_Group_Name"
aaa accounting dot1x default start-stop group "ISE_Group_Name"