AAA Dead-Server Detection

The AAA Dead-Server Detection feature allows you to determine the criteria that are used to mark a RADIUS server as dead. That is, you can configure the minimum amount of time, in seconds, that must elapse from the time that the router last received a valid packet from the RADIUS server to the time the server is marked as dead. If a packet has not been received since the router booted, and there is a timeout, the time criterion will be treated as though it has been met.

In addition, you can configure the number of consecutive timeouts that must occur on the router before the RADIUS server is marked as dead. If the server performs both authentication and accounting, both types of packets are included in the number. Improperly constructed packets are counted as though they are timeouts. Only retransmissions are counted, not the initial transmission. (Each timeout causes one retransmission to be sent.)

Note	Both the time criterion and the tries criterion must be met for the server to be marked as dead.

The RADIUS dead-server detection configuration will result in the prompt detection of RADIUS servers that have stopped responding. This configuration will also result in the avoidance of servers being improperly marked as dead when they are "swamped" (responding slowly) and the avoidance of the state of servers being rapidly changed from dead to live to dead again. This prompt detection of nonresponding RADIUS servers and the avoidance of swamped and dead-to-live-to-dead-again servers will result in less deadtime and quicker packet processing.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    aaa new-model

4.    radius-server deadtime minutes

5.    radius-server dead-criteria [time seconds] [tries number-of-tries]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	aaa new-model Example: Router (config)# aaa new-model	Enables the AAA access control model.
Step 4	radius-server deadtime minutes Example: Router (config)# radius-server deadtime 5	Improves RADIUS response times when some servers might be unavailable and causes the unavailable servers to be skipped immediately.
Step 5	radius-server dead-criteria [time seconds] [tries number-of-tries] Example: Router (config)# radius-server dead-criteria time 5 tries 4	Forces one or both of the criteria--used to mark a RADIUS server as dead--to be the indicated constant.

• Troubleshooting Tips

SUMMARY STEPS

1.    enable

2.    debug aaa dead-criteria transactions

3.    show aaa dead-criteria

4.    show aaa servers [private | public]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	debug aaa dead-criteria transactions Example: Router# debug aaa dead-criteria transactions	Displays AAA dead-criteria transaction values.
Step 3	show aaa dead-criteria Example: Router# show aaa dead-criteria	Displays dead-criteria information for a AAA server.
Step 4	show aaa servers [private | public] Example: Router# show aaa server private	Displays the status and number of packets that are sent to and received from all public and private authentication, authorization, and accounting (AAA) RADIUS servers. The private keyword optionally displays the AAA servers only. The public keyword optionally displays the AAA servers only.