AOS Switch RADIUS Failover behaviour
01-16-2019 12:18 AM
We have a weird issue. We mostly have two clearpasses as radius server. We thought the switch failovers if one is not reachable. But for example we configured an unreachable IP address as radius server (primary & secondary) but the switch still marked both hosts as reachable. So how could that happen? How is the AOS Switch checking the reachability? I already did a packet capture to see if there are any icmp or generic radius requests.
According to the Access Security Guide when you have at least two radius server configured the switch goes to the secondary server insofar the the primary is dead. What about the secondary?
We also know there's a feature for tracking the servers by radius request that is sent from the switch in a specific interval. This feature works great and the minimum interval is 60s. Is this the way to go? Best practice? Because the default feature of failovering is unusable so far.
Unfortunately I didn't get an answer from techhub and our local HPE team so far.
Thanks and Greets
Re: AOS Switch RADIUS Failover behaviour
3 weeks ago - last edited 3 weeks ago
I prefer the radius server tracking, because it actually tests to see if the radius server responses (radius-reject). The default failover mechanism is not very acurate and i have seen it forward traffic even when the radius service isn't started yet.
Do you use the ClearPass VIP adress as radius server IP from your NAD devices?
Feel free to give kudos or accept as a solution!