Secondary ACS server not authenticating users via 3850 WLC

[scottbreslin]

HI - I have an issue whereby my secondary ACS server will not authenticate users when the Primary goes offline.  My setup is as follows:

3850 WLC using code version 03.07.00E

ACS Version 5.6 (Primary/Secondary)

Both ACS servers added to WLC (NLBP-ACS-01 (Primary)  / HEN-ACS-01 (Secondary) ), defined in Server Group (ACS_AUTH) and also Method List (ACS_AUTH).  Method list ACS_AUTH is then applied to SSID.

Performing a 'test aaa server group ACS_AUTH' command to both ACS server results in access response.  So IP/Radius communication is operational between WLC and both ACS servers.

3850 configuration also attached for reference.

Any help would be appreciated.

Thanks

Scott

[Javier Henderson]

Does the secondary ACS show any activity at all coming from the switch?

I'd start troubleshooting by enabling "debug radius" and "debug aaa authentication" on the switch, and see what happens when the primary ACS is unreachable.

Javier Henderson

Cisco Systems

[scottbreslin]

Thanks for the reply.

The secondary server shows no authentication attempts from users hitting it.  When I perform the aaa test from the switch cli and get authentication response form the secondary server, when I check the logs it states there was an attempt from the switch but is does not say which ACS it was coming from - The secondary ACs is also the log collector.

The environment is production so I am unable to make any changes such as disable primary ACS and as such limited to what I can do.  Can only make changes once reason behind the issue has been discovered.  I am connecting a new site on Thursday so will take this opportunity to initially configure it with the secondary sever and perform some authentication requests to see if I can see the issue whilst also performing the debugs you mention above.

Thanks

[Jatin Katyal · Accepted solution]

Please add the below listed commands and test again when you can.

#radius-server deadtime $min$
#radius-server retransmit 1
#radius-server dead-criteria time 5 tries 1

Configuring Settings for All RADIUS Servers

HTH

~ Jatin

[scottbreslin]

Thanks I will try as soon as possible

[Jatin Katyal]

Sounds Good :)