RADIUS servers and Meraki

[RaphaelL]

Hi , 

I have a simple question. 

Let's say you have .1X enabled on your switch with 2 Radius servers ( RAD 1 and RAD 2 ). 

RAD 1 goes down , how will the switch notice that RAD 1 is down. 

From what I have heard , the ''keep-alive'' timer is from 0-24 hours. 

Since there is no reauth timer on the MS series, how will the stack notice that RAD 1 is down and forward the requests to RAD 2 ? 

Thanks 

[NolanHerring]

Here is the process for the radius requests:

https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS_Issue_Resolution_Guide

This is specifically saying for MR, but I have a feeling it also applies for MS:

https://documentation.meraki.com/MR/MR_Splash_Page/RADIUS_Failover_and_Retry_Details

[RaphaelL]

Ahhhh ! I was searching for MS ! This might be indeed the same thing. I will read that ! Thanks !

[RaphaelL]

This is also enabled : 

Radius testing

If enabled, Meraki devices will periodically send Access-Request messages to these RADIUS servers using identity 'meraki_8021x_test' to ensure that the RADIUS servers are reachable.

How often those packets are sent ?

[RaphaelL]

Found the ''answer'' 

With RADIUS testing enabled, all RADIUS servers will be tested by every node at least once per 24 hours regardless of test result. If a RADIUS test fails for a given node it will be tested again every hour until a passing result occurs. A subsequent pass will mark the server reachable and clear the alert, returning to the 24 hour testing cycle.

24 hours , pretty long time to find that a radius server is down

[NolanHerring]

Well that depends, are you relying on the auto radius testing to be a monitoring tool for your radius server? Then I would agree 😃

[RaphaelL]

Let's say we have a failover test with our Radius during the night and I'm not on-site ( to provoke a reauth or a new radius auth ) 

I want my switches to realise quickly that RAD 1 is down , but I'm not sure how. I was relaying on the auto radius testing , but the timeout is too long ( 24 hours ). 

What would you guys suggest ?  Change the order of the radius servers ? Use the ''test'' button ( which I had a hard time in the past ) ?

Thanks 

[PhilipDAth]

My understanding is the MS will try the first RADIUS server.  If there is no response it will retry after 2s.  I believe it tries three times.  If no response after that it marks that RADIUS server as dead for a while, and then moves onto the next RADIUS server.

I'm not 100% percent on this.

This document for splash pages has a similar description.

https://documentation.meraki.com/MR/MR_Splash_Page/RADIUS_Failover_and_Retry_Details#Retry_Attempts