40-40
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 40 Configuring 802.1X Authentication
Configuring 802.1X Authentication on the Switch
Configuring a RADIUS Server Failover
Before software release 8.4(1), when the active RADIUS server went down or was unreachable, the
802.1X authentication timed out before the backup RADIUS server could become active. With software
release 8.4(1) and later releases, some RADIUS server timer values are now configurable and the
show
radius
command has been enhanced to show the active RADIUS server.
Enter the following commands to prevent a RADIUS server failover:
•
set dot1x max-req
—Specifies the maximum number of times that the state machine retransmits an
EAP-Request frame to the supplicant before it times out the authentication session; the valid values
are from 1 to 10. The default is 2. An example is as follows:
Console> (enable)
set dot1x max-req 8
dot1x max-req set to 8.
Console> (enable)
•
set dot1x server-timeout—
Specifies the time constant for the retransmission of packets by the
back-end authenticator to the authentication server; the valid values are from 1 to 65535 seconds.
When the authentication server does not notify the back-end authenticator that it received specific
packets, the back-end authenticator waits a period of time (set by entering the
server-timeout
seconds
parameter), and then retransmits the packets. The default is 30. An example is as follows:
Console> (enable)
set dot1x server-timeout 100
dot1x server-timeout set to 100 seconds.
Console> (enable)
Ener the
show radius
command to display the RADIUS server configuration and to show which
RADIUS server is active as follows:
Console> (enable)
show radius
Active RADIUS Server: 81.81.81.20
RADIUS Deadtime: 1 minutes
RADIUS Key: cisco
RADIUS Retransmit: 2
RADIUS Timeout: 5 seconds
Framed-Ip Address Transmit: Disabled
RADIUS-Server Status Auth-port Acct-port Resolved IP Address
-------------------------------- ------- --------- --------- -------------------
81.81.81.20 primary 1812 1813
10.6.89.200 1812 1813
10.6.98.35 1812 1813
Console> (enable)
