Radius authentication requests sent simultaneously to both radius servers
Article ID: 246963
Updated On:
Products
Issue/Introduction
You have two radius servers in a healthy state. You noticed that Proxy sends requests simultaneously requests to both of them even though should only contact the primary one.
That can cause issues where secondary server replies quicker than the primary one and rejects the request.
Environment
In example below you can see the timings, when proxy contacted primary and secondary radius server. In our pcap we can see that after exactly 2.5s the proxy sends a request to the alternate radius server.
The response from primary server was longer than 2.5 seconds, hence proxy reached out to the alternate radius server and sent additional request to the primary.
Cause
The reason why proxy sends request to the alternate radius server is the timeout request value which by default is set to 5 seconds.
Where in previous version the default value was 10 seconds.
Based on SGOS admin guide:
"The Timeout Request field, enter the total number of seconds the appliance will attempt to connect to RADIUS servers; the contact to the other server occurs when half of the timeout period has lapsed."
Resolution
You can change/increase the default value of timeout via Management Console GUI by going to Configuration -> Authentication -> RADIUS -> Radius Servers
Feedback
