AAA Dead-Server Detection

Information About AAA Dead-Server Detection

The AAA Dead-Server Detection feature allows you to configure the criteria to be used to mark a RADIUS server as dead.

If you have more than one RADIUS server, the following concepts come into picture:

  • Deadtime—Defines the time in minutes a server marked as DEAD is held in that state. Once the deadtime expires, the controller marks the server as UP (ALIVE) and notifies the registered clients about the state change. If the server is still unreachable after the state is marked as UP and if the DEAD criteria is met, then server is marked as DEAD again for the deadtime interval.


    Note

    You can configure deadtime for each server group or on a global level.

  • Dead-criteria—To declare a server as DEAD, you need to configure dead-criteria and configure the conditions that determine when a RADIUS server is considered unavailable or dead.

Using this feature will result in less deadtime and quicker packet processing.

Criteria for Marking a RADIUS Server As Dead

The AAA Dead-Server Detection feature allows you to determine the criteria that are used to mark a RADIUS server as dead. That is, you can configure the minimum amount of time, in seconds, that must elapse from the time that the controller last received a valid packet from the RADIUS server to the time the server is marked as dead. If a packet has not been received since the controller booted, and there is a timeout, the time criterion will be treated as though it has been met.

In addition, you can configure the number of consecutive timeouts that must occur on the controller before the RADIUS server is marked as dead. If the server performs both authentication and accounting, both types of packets are included in the number. Improperly constructed packets are counted as though they are timeouts. Both initial packet transmission and retransmissions are counted. (Each timeout causes one retransmission to be sent.)


Note

Both the time criterion and tries criterion must be met for the server to be marked as dead.

The RADIUS dead-server detection configuration will result in the prompt detection of RADIUS servers that have stopped responding. This configuration will also result in the avoidance of servers being improperly marked as dead when they are “swamped” (responding slowly) and the avoidance of the state of servers being rapidly changed from dead to live to dead again. This prompt detection of non-responding RADIUS servers and the avoidance of swamped and dead-to-live-to-dead-again servers will result in less deadtime and quicker packet processing.

Prerequisites for AAA Dead-Server Detection

  • You must have access to a RADIUS server.

  • You should be familiar with configuring a RADIUS server.

  • You should be familiar with configuring Authentication, Authorization, and Accounting (AAA).

  • Before a server can be marked as dead, you must configure radius-server dead-criteria time time-in-seconds tries number-of-tries to mark the server as DOWN.

    Also, you must configure the radius-server deadtime time-in-mins to retain the server in DEAD status.

Restrictions for AAA Dead-Server Detection

  • Original transmissions are not counted in the number of consecutive timeouts that must occur on the controller before the server is marked as dead--only the number of retransmissions are counted.

Configuring AAA Dead-Server Detection (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

aaa new-model

Example:

Device(config)# aaa new-model

Enables the AAA access control model.

Step 3

radius-server deadtime time-in-mins

Example:

Device(config)# radius-server deadtime 5

Defines the time in minutes when a server marked as DEAD is held in that state. Once the deadtime expires, the controller marks the server as UP (ALIVE) and notifies the registered clients about the state change. If the server is still unreachable after the state is marked as UP and if the DEAD criteria is met, then server is marked as DEAD again for the deadtime interval.

time-in-mins —Valid values range from 1 to 1440 minutes. Default value is zero. To return to the default value, use the no radius-server deadtime command.

The radius-server deadtime command can be configured globally or per aaa group server level.

You can use the show aaa dead-criteria or show aaa servers command to check for dead-server detection. If the default value is zero, deadtime is not configured.

Step 4

radius-server dead-criteria [time time-in-seconds][tries number-of-tries]

Example:

Device(config)# radius-server dead-criteria time 5 tries 4

Declares a server as DEAD and configures the conditions that determine when a RADIUS server is considered unavailable or dead.

time-in-seconds —Time in seconds during which no response is received from the RADIUS server to consider it as dead. Valid values range from 1 to 120 seconds.

number-of-tries —Number of transmits to RADIUS server without responses before marking the server as dead. Valid values range from 1 to 100.

Step 5

end

Example:

Device(config)# end

Exits configuration mode and enters privileged EXEC mode.

Verifying AAA Dead-Server Detection

To verify dead-criteria, use the following command:

Device# show run | s dead-criteria

radius-server dead-criteria time 20 tries 20

To verify the dead-criteria details, use the following command:

Device# sh aaa dead-criteria radius <server>

sh aaa dead-criteria radius 8.109.0.55
RADIUS Server Dead Criteria:
Server Details:
Address : 8.109.0.55
Auth Port : 1645
Acct Port : 1646
Server Group : radius
Dead Criteria Details:
Configured Retransmits : 3
Configured Timeout : 5
Estimated Outstanding Access Transactions: 2
Estimated Outstanding Accounting Transactions: 0
Dead Detect Time : 30s
Computed Retransmit Tries: 6
Statistics Gathered Since Last Successful Transaction
Max Computed Outstanding Transactions: 3
Max Computed Dead Detect Time: 90s
Max Computed Retransmits : 18

To verify the state of servers, number of requests being processed, and so on, use the following command:

Device# show aaa servers | s WNCD

Platform State from WNCD (1) : current UP
Platform State from WNCD (2) : current UP
Platform State from WNCD (3) : current UP
Platform State from WNCD (4) : current UP
Platform State from WNCD (5) : current UP, duration 773s, previous duration 0s
Platform Dead: total time 0s, count 0
Quarantined: No