If we terminate on the radius servers, does Aruba allow failover of radius servers for dot1x?
Under the server group > AAA settings, we have two radius servers but it appears that it only ever talks to the first one even if it's down it doesn't attempt to talk to the second one. The failthrough check mark is there but is only availble if we're terminating on the controller.
If the first server listed in the group is not available, it should go to the second in that scenario. fail through is not needed for that. If you wanted fail through to work (go to the second even if the first is up and responding) then you need to terminate on the controller.
run the following from the CLI to see if it gives you any insight into whether it is trying to use the other server; and if it sees the other one as down.
show aaa authentication-server radius statistics