- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2023 09:03 PM
Hi all;
As far as I know, the "idle-timeout" keyword when used with "RADIUS automate-tester" functionality forces the switch to probe configured RADIUS servers unconditionally (the servers are in “DEAD” or “ALIVE” state or not). Is my understanding correct?
Thanks
Solved! Go to Solution.
- Labels:
-
AAA
-
Identity Services Engine (ISE)
Accepted Solutions

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2023 09:17 PM
AFAIK the idle-timeout means that it will fire off a probe to the RADIUS server if (and only if) the idle-timer has expired. This means you don't waste time sending probes to a RADIUS server that is actively being used and is healthy. You only want to check the RADIUS server if you have not spoken to it for X number of minutes. If the response is negative, then in theory the dead holddown timer should hold that server down as "dead" - this should make the user experience better because the timeout is being proactively dealt with, as opposed to the user having to suffer the timeout/retry.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2023 09:17 PM
AFAIK the idle-timeout means that it will fire off a probe to the RADIUS server if (and only if) the idle-timer has expired. This means you don't waste time sending probes to a RADIUS server that is actively being used and is healthy. You only want to check the RADIUS server if you have not spoken to it for X number of minutes. If the response is negative, then in theory the dead holddown timer should hold that server down as "dead" - this should make the user experience better because the timeout is being proactively dealt with, as opposed to the user having to suffer the timeout/retry.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-19-2023 10:02 PM
automate tester name | retransmit value | timeout seconds
sorry but I dont see idle-timeout in command reference
what is platform and IOS ver.
thanks
MHM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-20-2023 12:01 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-20-2023 12:53 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-20-2023 08:05 AM
As the IOS of the switch based on 15.0(2)SE11, it chooses UDP 1645 and 1646, by default.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-20-2023 01:35 PM
Yes. Shame on Cisco for perpetuating that legacy. Which, it turns out was a mistake made in the early days of RADIUS.
I am a RADIUS pedant - Check out this useful comment dating back as far as 1997 !!! RFC 2138 - Remote Authentication Dial In User Service (RADIUS) (ietf.org)
Implementation Note
This memo documents the RADIUS protocol. There has been some
confusion in the assignment of port numbers for this protocol. The
early deployment of RADIUS was done using the erroneously chosen port
number 1645, which conflicts with the "datametrics" service. The
officially assigned port number for RADIUS is 1812.
