You have a Radius realm defined on the ProxySG with a Primary and Secondary server.
Health check of the Radius realm is "
OK on alt server".
The policy in Visual Policy Manager (VPM) or Common Policy Language (CPL) is configured to use Admin Authentication and Admin Access via Radius server and protocol.
For the Radius configuration steps please refer to this KB TECH241135
The default failover is as following:
Access Request" Radius packets to both the Primary and Secondary server and the health check changes to "
OK on alt server". During this time it is the secondary server that replies with the "
Access Reject" or "
OK" and only the Primary server replies.