Contents

AAA Dead-Server Detection

The AAA Dead-Server Detection feature allows you to configure the criteria to be used to mark a RADIUS server as dead. If no criteria are explicitly configured, the criteria are computed dynamically on the basis of the number of outstanding transactions. Using this feature will result in less deadtime and quicker packet processing.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for AAA Dead-Server Detection

  • You must have access to a RADIUS server.

  • You should be familiar with configuring a RADIUS server.

  • You should be familiar with configuring authentication, authorization, and accounting (AAA).

  • Before a server can be marked as dead, you must first configure the radius-server deadtime command. If this command is not configured, even if the criteria are met for the server to be marked as dead, the server state will be the “up” state.

Restrictions for AAA Dead-Server Detection

  • Original transmissions are not counted in the number of consecutive timeouts that must occur on the router before the server is marked as dead--only the number of retransmissions are counted.

Information About AAA Dead-Server Detection

Criteria for Marking a RADIUS Server As Dead

The AAA Dead-Server Detection feature allows you to determine the criteria that are used to mark a RADIUS server as dead. That is, you can configure the minimum amount of time, in seconds, that must elapse from the time that the router last received a valid packet from the RADIUS server to the time the server is marked as dead. If a packet has not been received since the router booted, and there is a timeout, the time criterion will be treated as though it has been met.

In addition, you can configure the number of consecutive timeouts that must occur on the router before the RADIUS server is marked as dead. If the server performs both authentication and accounting, both types of packets are included in the number. Improperly constructed packets are counted as though they are timeouts. Only retransmissions are counted, not the initial transmission. (Each timeout causes one retransmission to be sent.)


Note

Both the time criterion and the tries criterion must be met for the server to be marked as dead.

The RADIUS dead-server detection configuration will result in the prompt detection of RADIUS servers that have stopped responding. This configuration will also result in the avoidance of servers being improperly marked as dead when they are “swamped” (responding slowly) and the avoidance of the state of servers being rapidly changed from dead to live to dead again. This prompt detection of nonresponding RADIUS servers and the avoidance of swamped and dead-to-live-to-dead-again servers will result in less deadtime and quicker packet processing.

How to Configure AAA Dead-Server Detection

Configuring AAA Dead-Server Detection

To configure AAA Dead-Server Detection, perform the following steps.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    aaa new-model

    4.    radius-server deadtime minutes

    5.    radius-server dead-criteria [time seconds] [tries number-of-tries]


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 aaa new-model


    Example:
    Router (config)# aaa new-model
     

    Enables the AAA access control model.

     
    Step 4 radius-server deadtime minutes


    Example:
    Router (config)# radius-server deadtime 5
     

    Improves RADIUS response times when some servers might be unavailable and causes the unavailable servers to be skipped immediately.

     
    Step 5 radius-server dead-criteria [time seconds] [tries number-of-tries]


    Example:
    Router (config)# radius-server dead-criteria time 5 tries 4
     

    Forces one or both of the criteria--used to mark a RADIUS server as dead--to be the indicated constant.

     

    Troubleshooting Tips

    After you have configured AAA Dead-Server Detection, you should verify your configuration using the show running-config command. This verification is especially important if you have used the no form of the radius-server dead-criteria command. The output of the show running-config command must show the same values in the “Dead Criteria Details” field that you configured using the radius-server dead-criteria command.

    Verifying AAA Dead-Server Detection

    To verify your AAA Dead-Server Detection configuration, perform the following steps. The show and debug commands may be used in any order.

    SUMMARY STEPS

      1.    enable

      2.    debug aaa dead-criteria transactions

      3.    show aaa dead-criteria

      4.    show aaa servers [private | public]


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Router> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 debug aaa dead-criteria transactions


      Example:
      Router# debug aaa dead-criteria transactions
       

      Displays AAA dead-criteria transaction values.

       
      Step 3 show aaa dead-criteria


      Example:
      Router# show aaa dead-criteria
       

      Displays dead-criteria information for a AAA server.

       
      Step 4 show aaa servers [private | public]


      Example:
      Router# show aaa server private
       

      Displays the status and number of packets that are sent to and received from all public and private authentication, authorization, and accounting (AAA) RADIUS servers.

      • The private keyword optionally displays the AAA servers only.

      • The public keyword optionally displays the AAA servers only.

       

      Configuration Examples for AAA Dead-Server Detection

      Configuring AAA Dead-Server Detection Example

      The following example shows that the router will be considered dead after 5 seconds and four tries:

      Router (config)# aaa new-model
Router (config)# radius-server deadtime 5
Router (config)# radius-server dead-criteria time 5 tries 4

      debug aaa dead-criteria transactions Command Example

      The following output example shows dead-criteria transaction information for a particular server group:

      Router# debug aaa dead-criteria transactions
AAA Transaction debugs debugging is on
*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Computed Retransmit Tries: 22, Current Max Tries: 22
*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Computed Dead Detect Interval: 25s, Current Max Interval: 25s
*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Estimated Outstanding Transactions: 6, Current Max Transactions: 6

      show aaa dead-criteria Command Example

      The following output example shows that dead-server-detection information has been requested for a RADIUS server at the IP address 172.19.192.80:

      Router# show aaa dead-criteria radius 172.19.192.80 radius
RADIUS Server Dead Criteria:
=============================
Server Details: 
    Address : 172.19.192.80
    Auth Port : 1645
    Acct Port : 1646
Server Group : radius
Dead Criteria Details:
    Configured Retransmits : 62
    Configured Timeout : 27
    Estimated Outstanding Transactions: 5
    Dead Detect Time : 25s
    Computed Retransmit Tries: 22
    Statistics Gathered Since Last Successful Transaction
=====================================================
Max Computed Outstanding Transactions: 5
Max Computed Dead Detect Time: 25s
Max Computed Retransmits : 22

      Additional References

      The following sections provide references related to the AAA Dead-Server Detection feature.

      Related Documents

      Related Topic

      Document Title

      Configuring RADIUS

      Configuring RADIUS feature module.

      Configuring AAA

      Configuring Authentication

      Configuring Authorization

      Configuring Accounting

      Security commands

      Cisco IOS Security Command Reference

      Standards

      Standards

      Title

      No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

      --

      MIBs

      MIBs

      MIBs Link

      No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

      To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

      http:/​/​www.cisco.com/​go/​mibs

      RFCs

      RFCs

      Title

      RFC 2865

      Remote Authentication Dial In User Service (RADIUS)

      Technical Assistance

      Description

      Link

      The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

      To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

      Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

      http:/​/​www.cisco.com/​techsupport

      Feature Information for AAA Dead-Server Detection

      The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Table 1 Feature Information for AAA Dead-Server Detection

      Feature Name

      Releases

      Feature Information

      AAA Dead-Server Detection

      Cisco IOS XE Release 3.9S

      Allows you to configure the criteria to be used to mark a RADIUS server as dead.

      The following commands were introduced or modified: debug aaa dead-criteria transactions, radius-server dead-criteria, show aaa dead-criteria, show aaa servers.

      AAA Dead-Server Detection

      AAA Dead-Server Detection

      The AAA Dead-Server Detection feature allows you to configure the criteria to be used to mark a RADIUS server as dead. If no criteria are explicitly configured, the criteria are computed dynamically on the basis of the number of outstanding transactions. Using this feature will result in less deadtime and quicker packet processing.

      Finding Feature Information

      Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Prerequisites for AAA Dead-Server Detection

      • You must have access to a RADIUS server.

      • You should be familiar with configuring a RADIUS server.

      • You should be familiar with configuring authentication, authorization, and accounting (AAA).

      • Before a server can be marked as dead, you must first configure the radius-server deadtime command. If this command is not configured, even if the criteria are met for the server to be marked as dead, the server state will be the “up” state.

      Restrictions for AAA Dead-Server Detection

      • Original transmissions are not counted in the number of consecutive timeouts that must occur on the router before the server is marked as dead--only the number of retransmissions are counted.

      Information About AAA Dead-Server Detection

      Criteria for Marking a RADIUS Server As Dead

      The AAA Dead-Server Detection feature allows you to determine the criteria that are used to mark a RADIUS server as dead. That is, you can configure the minimum amount of time, in seconds, that must elapse from the time that the router last received a valid packet from the RADIUS server to the time the server is marked as dead. If a packet has not been received since the router booted, and there is a timeout, the time criterion will be treated as though it has been met.

      In addition, you can configure the number of consecutive timeouts that must occur on the router before the RADIUS server is marked as dead. If the server performs both authentication and accounting, both types of packets are included in the number. Improperly constructed packets are counted as though they are timeouts. Only retransmissions are counted, not the initial transmission. (Each timeout causes one retransmission to be sent.)


      Note

      Both the time criterion and the tries criterion must be met for the server to be marked as dead.

      The RADIUS dead-server detection configuration will result in the prompt detection of RADIUS servers that have stopped responding. This configuration will also result in the avoidance of servers being improperly marked as dead when they are “swamped” (responding slowly) and the avoidance of the state of servers being rapidly changed from dead to live to dead again. This prompt detection of nonresponding RADIUS servers and the avoidance of swamped and dead-to-live-to-dead-again servers will result in less deadtime and quicker packet processing.

      How to Configure AAA Dead-Server Detection

      Configuring AAA Dead-Server Detection

      To configure AAA Dead-Server Detection, perform the following steps.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    aaa new-model

        4.    radius-server deadtime minutes

        5.    radius-server dead-criteria [time seconds] [tries number-of-tries]


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Router> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.

         
        Step 2 configure terminal


        Example:
        Router# configure terminal
         

        Enters global configuration mode.

         
        Step 3 aaa new-model


        Example:
        Router (config)# aaa new-model
         

        Enables the AAA access control model.

         
        Step 4 radius-server deadtime minutes


        Example:
        Router (config)# radius-server deadtime 5
         

        Improves RADIUS response times when some servers might be unavailable and causes the unavailable servers to be skipped immediately.

         
        Step 5 radius-server dead-criteria [time seconds] [tries number-of-tries]


        Example:
        Router (config)# radius-server dead-criteria time 5 tries 4
         

        Forces one or both of the criteria--used to mark a RADIUS server as dead--to be the indicated constant.

         

        Troubleshooting Tips

        After you have configured AAA Dead-Server Detection, you should verify your configuration using the show running-config command. This verification is especially important if you have used the no form of the radius-server dead-criteria command. The output of the show running-config command must show the same values in the “Dead Criteria Details” field that you configured using the radius-server dead-criteria command.

        Verifying AAA Dead-Server Detection

        To verify your AAA Dead-Server Detection configuration, perform the following steps. The show and debug commands may be used in any order.

        SUMMARY STEPS

          1.    enable

          2.    debug aaa dead-criteria transactions

          3.    show aaa dead-criteria

          4.    show aaa servers [private | public]


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 enable


          Example:
          Router> enable
           

          Enables privileged EXEC mode.

          • Enter your password if prompted.

           
          Step 2 debug aaa dead-criteria transactions


          Example:
          Router# debug aaa dead-criteria transactions
           

          Displays AAA dead-criteria transaction values.

           
          Step 3 show aaa dead-criteria


          Example:
          Router# show aaa dead-criteria
           

          Displays dead-criteria information for a AAA server.

           
          Step 4 show aaa servers [private | public]


          Example:
          Router# show aaa server private
           

          Displays the status and number of packets that are sent to and received from all public and private authentication, authorization, and accounting (AAA) RADIUS servers.

          • The private keyword optionally displays the AAA servers only.

          • The public keyword optionally displays the AAA servers only.

           

          Configuration Examples for AAA Dead-Server Detection

          Configuring AAA Dead-Server Detection Example

          The following example shows that the router will be considered dead after 5 seconds and four tries:

          Router (config)# aaa new-model
Router (config)# radius-server deadtime 5
Router (config)# radius-server dead-criteria time 5 tries 4

          debug aaa dead-criteria transactions Command Example

          The following output example shows dead-criteria transaction information for a particular server group:

          Router# debug aaa dead-criteria transactions
AAA Transaction debugs debugging is on
*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Computed Retransmit Tries: 22, Current Max Tries: 22
*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Computed Dead Detect Interval: 25s, Current Max Interval: 25s
*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Estimated Outstanding Transactions: 6, Current Max Transactions: 6

          show aaa dead-criteria Command Example

          The following output example shows that dead-server-detection information has been requested for a RADIUS server at the IP address 172.19.192.80:

          Router# show aaa dead-criteria radius 172.19.192.80 radius
RADIUS Server Dead Criteria:
=============================
Server Details: 
    Address : 172.19.192.80
    Auth Port : 1645
    Acct Port : 1646
Server Group : radius
Dead Criteria Details:
    Configured Retransmits : 62
    Configured Timeout : 27
    Estimated Outstanding Transactions: 5
    Dead Detect Time : 25s
    Computed Retransmit Tries: 22
    Statistics Gathered Since Last Successful Transaction
=====================================================
Max Computed Outstanding Transactions: 5
Max Computed Dead Detect Time: 25s
Max Computed Retransmits : 22

          Additional References

          The following sections provide references related to the AAA Dead-Server Detection feature.

          Related Documents

          Related Topic

          Document Title

          Configuring RADIUS

          Configuring RADIUS feature module.

          Configuring AAA

          Configuring Authentication

          Configuring Authorization

          Configuring Accounting

          Security commands

          Cisco IOS Security Command Reference

          Standards

          Standards

          Title

          No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

          --

          MIBs

          MIBs

          MIBs Link

          No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

          To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

          http:/​/​www.cisco.com/​go/​mibs

          RFCs

          RFCs

          Title

          RFC 2865

          Remote Authentication Dial In User Service (RADIUS)

          Technical Assistance

          Description

          Link

          The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

          To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

          Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

          http:/​/​www.cisco.com/​techsupport

          Feature Information for AAA Dead-Server Detection

          The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

          Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

          Table 1 Feature Information for AAA Dead-Server Detection

          Feature Name

          Releases

          Feature Information

          AAA Dead-Server Detection

          Cisco IOS XE Release 3.9S

          Allows you to configure the criteria to be used to mark a RADIUS server as dead.

          The following commands were introduced or modified: debug aaa dead-criteria transactions, radius-server dead-criteria, show aaa dead-criteria, show aaa servers.