Cisco ASA AAA server status is suspended

[gwccnetops]

Why does the ASA place the aaa-server status to suspended for RSA authentication. After I reset the ASA server configuration for the aaa-server my status returns to ok but when a VPN request comes in the status immediately goes suspended. Any suggestions?

ASA1# show aaa-server rsapri host 10.1.1.51
Server Group:    rsapri
Server Protocol: sdi
Server Address:  10.1.1.51
Server port:     5500
Server status:   ACTIVE, Last transaction at unknown
Number of pending requests              0
Average round trip time                 10000ms
Number of authentication requests       3
Number of authorization requests        0
Number of accounting requests           0
Number of retransmissions               0
Number of accepts                       0
Number of rejects                       0
Number of challenges                    0
Number of malformed responses           0
Number of bad authenticators            0
Number of timeouts                      3
Number of unrecognized responses        0

SDI Server List:
        Active Address:          10.1.1.51
        Server Address:          10.1.1.51
        Server port:             5500
        Priority:                0
        Proximity:               0
        Status:                  SUSPENDED
        Number of accepts                       0
        Number of rejects                       0
        Number of bad next token codes          0
        Number of bad new pins sent             0
        Number of retries                       4
        Number of timeouts                      4

[jan.nielsen]

Looks to me like your RSA server is just not responding to the ASA's requests. Maybe check the RSA logs to see whats going on.

[Ganesh Hariharan]

Hi,

In suspended mode, ASA does not try to send any packets to that server. In such scenario it is best to remove and add the AAA-server configuration for that group in order to trigger that server in to active mode.

But you can try using re-activation command as well.

Re-activation command ref.

Hope it Helps..

-GI

Rate if it Helps..