Server status: FAILED

[Ibrahim Jamil]

Hello Folks

when i issue the command the sh aaa-server MYACS,I Noted the below msg for server status,how to troubleshoot and fix this issue?

Server Group:    MYACS
Server Protocol: radius
Server Address:  192.168.100.100
Server port:     1645(authentication), 1646(accounting)
Server status:   FAILED, Server disabled at

[mvsheik123]

Hi,

PIX/ASA lost connectivity to radius server. Make sure network path is available and the ASA IP/name and node key correctly configured on Radius server.

You can test the server authentication from ASA using command - test aaa-server authentication . Also, you can try enabling debug aaa-server see where the issue is.

hth

MS

[Jennifer Halim]

When the AAA server is in FAILED state, you can check to ensure that you have connectivity to the AAA server by trying to ping it.

Once confirm that connectivity between the ASA and the AAA server is up, you can re-activate the server with the following command:

aaa-server active host 192.168.100.100

If you check the status again:

show aaa-server MYACS host 192.168.100.100

it should say it's ACTIVE now.

Hope this helps.

[Ibrahim Jamil]

Hi

i have 3 acs in the group MYACS,both r okay but the third one gave the failed status so when you use this command aaa-server active host 192.168.100.100 ,r u sure this dosnt affect the first acs(192.168.100.101) who is active and serve the vpn users

thanks

[brquinn]

The default aaa-server reactivation mechanism is depletion. This means that failed servers only reactivate after all of the servers in the group are inactive. The command given to you will manually reactivate the sever, but it will not affect existing servers.

Command Reference link:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/a1.html#wp1558160

Thanks,

Brendan

[mvsheik123]

With reference to postring about 3 servers in the group.. just a note , on ASA you do not need to add all the 3 servers if they are Master/replica. The master is enough and ASA will get all the info from the master and will look for replica/backup incase Master is not available.

Thx

MS

PS: I mentioned this as I added all the servers on my prod ASA and later realised that was not required. Everything works great with all the servers status 'OK'.