802.1x authentication behaviour ?

[tedauction]

Hello, we have 802.1x configured on numerous 2960 switches. We have a primary and secondary RADIUS server configured. My question is, what happens if:

i) the primary RADIUS server is reachable but the shared secret fails i.e. will it fail over to authenticating against the secondary RADIUS server ?

ii) both primary and secondary RADIUS servers are reachable but the shared secrets fail.

iii) neither primary or secondary RADIUS is reachable. Thank you kindly.

[kubn2]

Hi,

Without checking (so you can't be 100% sure)

i) not sure

ii) and iii) if you doesn't have fallback like mac-based authentication then clients won't be able to authenticate

[balaji.bandi]

To form a relation between ISE  and End device like your case Switch -  basic requirement is shared secret. If that fails you no longer able to get further for the user to get 802.1X  authentication.

until you have configured fail-open ( that is the reason identity design is very important and required to have high availability and reachability in the network) to achieve strict authentication.

[Georg Pauwen · Accepted solution]

Hello,

I tested this with two RADIUS servers:

i) the primary RADIUS server is reachable but the shared secret fails i.e. will it fail over to authenticating against the secondary RADIUS server ?

--> the secondary RADIUS server will automatically be contacted, and authenticate

ii) both primary and secondary RADIUS servers are reachable but the shared secrets fail.

--> both primary and secondary RADIUS server will be contacted in order, and both fail to authenticate

iii) neither primary or secondary RADIUS is reachable. Thank you kindly.

--> no authentication will happen, if local authentication is configured, it will fail over to that