FTD Failed RADIUS question

[brettp]

Hello,

I am setting up a RADIUS server group for remote access VPN users. Everything is working fine, mostly, however I had question. What is the default behavior of the FTD for a failed RADIUS server? I can not find any information online. Basically, we have a primary and secondary RADIUS server... so that's two servers in the group. In my testing, I stopped the service on the primary server (on the actual Windows server) and the FTD started using the secondary as planned. However, when I re-enabled the primary server (by starting the service on the Windows server,) it continued using the secondary. I assume this is because the primary was marked "failed" on the FTD... though I didn't run any commands to check as the FTD is completely new to me, I hadn't thought of it. I checked all sorts of places on the FTD (via FMC) for how to configure the behavior but couldn't find anything. Is there no way for the FTD to automatically attempt to reconnect to the primary RADIUS server after some point in time or at least with some kind of manual intervention? Is there some kind of default timer the server is marked failed before it tries again? Any info is appreciated.

Thanks

Chris

[balaji.bandi]

There may be something wrong, when the first server in the order come online and working, FTD should able to use that server.

as you mentioned it show still Failed, then it was not meet the requirement (until FTD see as live it will not send any request to taht server).

[brettp]

I did not confirm the first server was failed... I just assumed it was since I manually disabled the service. I assumed once the first server in the list came back online, the FTD would start using it, but that was not the case even though nothing was wrong per se. Is that for sure the default behavior of the FTD, because I know earlier ASA code, that was not the default behavior. In testing, when the FTD was not using the first server, I removed the second server from the AAA group, deployed the change, and then the FTD started using the first server without issue. Can this be a bug?

[brettp]

I assumed once the first server in the list came back online, the FTD would start using it, but that was not the case even though nothing was wrong. Is that for sure the default behavior of the FTD, because I know earlier ASA code, that was not the default behavior. In testing, when the FTD was not using the first server, I removed the second server from the AAA group, deployed the change, and then the FTD started using the first server without issue. Can this be a bug?

[brettp]

I assumed once the first server in the list came back online, the FTD would start using it, but that was not the case even though nothing was wrong. Is that for sure the default behavior of the FTD, because I know earlier ASA code, that was not the default behavior. In testing, when the FTD was not using the first server, I removed the second server from the AAA group, deployed the change, and then the FTD started using the first server without issue. Can this be a bug?

[Rob Ingram · Accepted solution]

@brettp although I've found no confirmation in the documentation, my understanding is there is no preemption.

If the first AAA is marked as down/dead for any reason, the next AAA server is used as the active server. If the first AAA server comes back online, this is not used until the current active is marked down/dead.

[brettp]

@Rob Ingram This is the indeed the behavior I was asking about. Is there no way to configure the FTD to automatically start using the first server when it becomes available again? Or is there a manual way of doing it (other than removing the second server?) 

[MHM Cisco World · Accepted solution]

""Dead Time—Failed servers are reactivated only after all servers have failed. The dead time is how long to wait, from 0 - 1440 minutes, after the last server fails before reactivating all servers. The default is 10 minutes.""

""If external authentication has been working, but has stopped working, consider the possibility that all servers are in the dead time. When all the RADIUS servers within a group have failed, the dead time is the number of minutes the system waits before trying the first server again. The default is 10 minutes, but you can configure as long as 1440 minutes.""

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/fdm/fptd-fdm-config-guide-630/fptd-fdm-identity-sources.html

[Peter Koltl]

Depletion mode and timed mode are not available in FMC GUI but you can try setting it from FlexConfig.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/general/asa-98-general-config/aaa-radius.html#ID-2113-00000920

[brettp]

Thank you for the information. Just an FYI, I can't confirm if this is available or not on the FTD as I haven't tried but I'm just going to go with the default behavior. My issue is only temporary at the moment but when the hardware is put into production it really shouldn't matter.