Latency - Authenticator and Authentication Server

[pfillips]

Hi, We are designing a wireless network with EAP-TLS and centralized RADIUS. Given that we have sites across the globe, are there any defined latency guidelines between the Meraki AP and the RADIUS server?

Thank you.

[alemabrahao]

Have you tried increasing the values of EAP timers?

[pfillips]

Hi, Thank you for the response. This is not in production yet. We are in design stage and are trying to find if we can work with a central RADIUS server across the globe or need to put region specific RADIUS servers. If there are any defined latency guidelines then accordingly we can define our solution. We plan to use EAP-TLS.

[alemabrahao]

You can use a centralized server without problems, but keep in mind that if for some reason you have some kind of problem in the place where the server will be installed, the other locations will be unable to authenticate on the network.

[PhilipDAth]

The initial authentication will be fine sub 2s.

The next thing to consider is roaming between APs.  You'll want to make sure you have fast roaming enabled (802.11r), so a full re-auth is not required each time a client moves between APs.  Otherwise if auth takes 2s, the user will stop passing traffic for 2s each time they roam.

This might also be of interest:

https://documentation.meraki.com/MR/Encryption_and_Authentication/Meraki_Local_Authentication_-_MR_8...