Radius authentication failover behavior

Products

• ProxySG Software - SGOS

Issue/Introduction

You have a Radius realm defined on the ProxySG with a Primary and Secondary server.

Health check of the Radius realm is "OK on alt server".

Environment

The policy in Visual Policy Manager (VPM) or Common Policy Language (CPL) is configured to use Admin Authentication and Admin Access via Radius server and protocol.

For the Radius configuration steps please refer to this KB TECH241135

 

Resolution

The default failover is as following:

•  Use the Primary Radius service if the health check is "OK"
•  When the Primary server is unreachable, the ProxySG will start sending the "Access Request" Radius packets to both the Primary and Secondary server and the health check changes to "OK on alt server". During this time it is the secondary server that replies with the "Access Reject" or "Access-Accept".
• Once the Primary server becomes reachable again ( as the ProxySG uses both) the health check changes to "OK" and only the Primary server replies.