Changing new Radius server IP address in Template group

[Iamyour_Joy33]

Hello All Meraki Expertise,

Currently we are using Cisco ISE Radius on Cisco Meraki template group. As we are having migration Cisco ISE from Appliance to VM, we use new IP address of ISE VM.

Currently we got an issue after changing Radius server IP from the old one to the new one on template group, which is we don't see our client device not try to re-authenticate with new Radius IP address.

I would like to know that is there any solution for force client to authenticate to new ISE IP address?

As we have tried is disable and enable port in Dashboard template but the problem is that our client is always up.

Thanks,

Joy

[Iamyour_Joy33]

Kindly informed that we told the user that it is not impact to the operation but if we give them solution to unplug and plug network port, they will still have concerns.

I think Meraki solution should has force client to authenticate to new server, also could you please guide me how to check authenticate retry time in Meraki dashboard.

[PhilipDAth]

Are you talking about using the Org-wide RADIUS feature?

https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Organization_Menu...

[Iamyour_Joy33]

Hi Philip,

Thanks for your document, we just face the issue after changing new Radius server on MX, Client does not authenticate to new server unless unplug and plug port again or disable and enable port back.

Thanks,

Joy

[RaphaelL]

Where are you configuring the RADIUS settings ?  On a MX ? MS ? MR ?

We had the same deployement couple weeks ago and found some strange behavior on all 3.

[RaphaelL · Accepted solution]

Just looked at my notes. On a MX , changing the RADIUS server breaks the re-auth process. We had to disable / enable the ports on a MX. 

Once that is done , the original re-auth hourly restarts.  No idea if it is a bug or a feature but 802.1X on MX is pretty basic / poopy.

[Iamyour_Joy33]

Hello Raphael,

We have inform Business that there is no interrupt to operation, our client connected to MX are offsite ATM. 

As per picture i shared to you, we can only use disable and enable on that interface so that client can re-auth to server.

I would like to know if there is any force client to re-auth without downtime?

Thanks,

Joy

[Iamyour_Joy33]

As I know, there should be an re-auth time for client to Radius server.

[RaphaelL]

Hi , we also did migrate the RADIUS server of 800 offsite ATMs. The downtime is the time that you flap the port which is around 10-15 seconds.

The re-auth timer is not customizable and is hardcoded in the MX for 1hour.

[Iamyour_Joy33]

Hi, seem downtime is the same from our site. By the way, thank you for your information.

[Iamyour_Joy33]

Hello Raphael,

Thanks for your solution. it worked now by disable and enable port on MX but it take affect around 10 second to push from cloud. By the way, could you tell me where to change original re-auth hour?

[Iamyour_Joy33]

Hello Raphael,

Actually, We configure Radius on template, where we can configure Radius on MX port.

our organization only have MX.