Radius authentication failover behavior
search cancel

Radius authentication failover behavior


Article ID: 172999


Updated On:


ProxySG Software - SGOS


You have a Radius realm defined on the ProxySG with a Primary and Secondary server.

Health check of the Radius realm is "OK on alt server".


The policy in Visual Policy Manager (VPM) or Common Policy Language (CPL) is configured to use Admin Authentication and Admin Access via Radius server and protocol.

For the Radius configuration steps please refer to this KB TECH241135



The default failover is as following:

  •  Use the Primary Radius service if the health check is "OK"
  •  When the Primary server is unreachable, the ProxySG will start sending the "Access Request" Radius packets to both the Primary and Secondary server and the health check changes to "OK on alt server". During this time it is the secondary server that replies with the "Access Reject" or "Access-Accept".
  • Once the Primary server becomes reachable again ( as the ProxySG uses both) the health check changes to "OK" and only the Primary server replies.