This document describes the configuration and working of RADIUS dead detection feature and deadtime on Cisco Switches.
The information in this document is based on these software and hardware versions:
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
The AAA Dead Server Detection feature enables you to define the criteria used to determine when a RADIUS server is considered unavailable. You can configure the minimum time interval, in seconds, that must elapse since the device last received a valid packet from the RADIUS server before it is marked as dead. If no valid packets have been received since the device was last booted and a timeout occurs, the time-based condition is considered satisfied.
Additionally, you can configure the number of consecutive timeouts that must occur before the RADIUS server is declared dead. If the server handles both authentication and accounting, timeouts for both types of traffic are included in this count. Malformed or improperly constructed packets are treated as timeouts. Only retransmissions are counted toward the timeout threshold.
Once a RADIUS server is marked as dead, the configured deadtime value ensures that the server remains in the dead state for the specified duration (in minutes) before it is mark as alive. During this period, the switch does not sends any further RADIUS requests to the dead server.
If both time and tries are configured in dead-criteria, both conditions need to be satisfied before the server is marked as dead.
To configure deadtime and dead-criteria in Cisco cat 9K switch.
Switch#config terminal
Switch(config)#radius-server deadtime 2
Switch(config)#radius-server dead-criteria time 3 tries 3
With the deadtime configuration defined in previous steps, switch marks the server as dead for the amount of time specified which is 2 minutes in the preceding example. When the deadtime expires, the switch marks the server as alive again and begin sending RADIUS traffic to the server.
If the RADIUS deadtime is not specified, it defaults to a value of 0, which brings the server back to the UP state right away. Because of this behavior, the RADIUS server state could flap, causing additional authentication issues. To revert the server state back to the UP state before the specified deadtime expires, configure a RADIUS probe. This periodically tests the RADIUS server to see if it is responding to RADIUS requests. Upon receiving a response to a probe, the switch marks the RADIUS server as alive.
Switch(config)#radius server RAD1
Switch(config-radius-server)#address ipv4 10.127.197.164 auth-port 1812 acct-port 1813
Switch(config-radius-server)#automate-tester username test-user ignore-acct-port probe-on
Switch(config-radius-server)#key Iselab@123
Switch(config)#radius server RAD2
Switch(config-radius-server)#address ipv4 10.127.197.165 auth-port 1812 acct-port 1813
Switch(config-radius-server)#automate-tester username test-user ignore-acct-port probe-on
Switch(config-radius-server)#key Iselab@123
As mentioned earlier, test-user is a test user ID Username. The ignore-acct-port keyword indicates that the switch must not validate the accounting port number that the server to be used. The probe-on keyword indicates that the switch must send test probes only when the server is marked as dead.
In the case of an actual probe user account on the ISE’s internal or external database, a password is required. In the example below, test-user is the username and test-password is the password stored in the identity store that the RADIUS server refers to authenticate. Additinally, a “User rejected” message indicates that the RADIUS server is alive (unless a timeout occurs).
Two RADIUS servers RAD1 and RAD2 are configured in the RADGRP group. RADIUS service is not running on RAD1 but, running on RAD2.
radius server RAD1
address ipv4 10.127.197.164 auth-port 1812 acct-port 1813
key Iselab@123
radius server RAD2
address ipv4 10.127.197.165 auth-port 1812 acct-port 1813
key Iselab@123
aaa group server radius RADGRP
server name RAD1
server name RAD2
To view the detailed logs, radius and aaa-trans debugs have been enabled on the switch.
Switch#set platform software trace smd switch active R0 radius debug
Switch#set platform software trace smd switch active R0 aaa-trans debug
Once the switch initiates the MAB session, it sends the first RADIUS Access-Request to the primary server at 10.127.197.164. Since this server does not have an active RADIUS service, it does not respond.
2026/04/06 18:19:17.503353862 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Send Access-Request to 10.127.197.164:1812 id 1812/49, len 3132026/04/06 18:19:17.503363389 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:17.503370267 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:17.503374078 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:17.503383207 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:17.503386667 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:17.503391259 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:17.503396265 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:17.503399148 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:17.503425477 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:17.503431520 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:17.503435444 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:17.503438273 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:17.503442022 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:17.503444833 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:17.503448442 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:17.503451224 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:17.503454678 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:17.503466727 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:17.503470183 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:17.503475118 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:17.503479167 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:17.503482732 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:17.503486454 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:17.503543835 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
After waiting for the default retransmission timer of 5 seconds, the switch sends the Access-Request at 18:19:22 but receives no response, this increase the tries counter to 2.
2026/04/06 18:19:22.503540209 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Retransmit to (10.127.197.164:1812,1813) for id 1812/49
2026/04/06 18:19:22.503550512 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS(00000000): Route radius Pkt on vrf:1 for:Access-Request to 10.127.197.164:1812
2026/04/06 18:19:22.503586730 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:22.503593713 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:22.503597724 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:22.503606908 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:22.503610291 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:22.503614797 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:22.503620000 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:22.503636893 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:22.503663803 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:22.503669779 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:22.503673708 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:22.503676661 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:22.503680361 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:22.503683177 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:22.503686781 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:22.503689608 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:22.503693037 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:22.503698541 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:22.503701959 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:22.503706717 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:22.503710913 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:22.503714471 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:22.503718191 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:22.503791197 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
After another 5 seconds wait, the switch sends a third Access-Request at 18:19:27, again without a response, raising the tries counter to 3.
2026/04/06 18:19:27.504409044 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Retransmit to (10.127.197.164:1812,1813) for id 1812/49
2026/04/06 18:19:27.504419704 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS(00000000): Route radius Pkt on vrf:1 for:Access-Request to 10.127.197.164:1812
2026/04/06 18:19:27.504458569 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:27.504465641 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:27.504469296 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:27.504478672 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:27.504482096 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:27.504486708 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:27.504491837 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:27.504494772 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:27.504521457 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:27.504527464 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:27.504531333 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:27.504534211 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:27.504538053 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:27.504540913 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:27.504544569 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:27.504547453 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:27.504556776 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:27.504562674 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:27.504566176 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:27.504571069 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:27.504575163 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:27.504578703 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:27.504582370 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:27.504650322 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
At this point, both the time and tries criteria have been satisfied, so the switch marks the first server as dead for configured 120 seconds and fails over to the next server.
2026/04/06 18:19:32.503887087 {smd_R0-0}{1}: [aaa-trans] [27946]: (info): AAA/SG/TRANSAC: Server (10.127.197.164:1812,1813) marked dead - Initializing deadtime timer for 120 secs.
2026/04/06 18:19:32.504202918 {smd_R0-0}{1}: [errmsg] [27946]: (info): %RADIUS_AUDIT_MESSAGE-6-RADIUS_DEAD: R0/0: sessmgrd: RADIUS server 10.127.197.164:1812,1813 is not responding.
2026/04/06 18:19:32.504301242 {smd_R0-0}{1}: [errmsg] [27946]: (info): %AAA_AUDIT_MESSAGE-6-METHOD_LIST_STATE: R0/0: sessmgrd: mlist default of 8021X service is marked for notifying state and its current state is : ALIVE
2026/04/06 18:19:32.504323189 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Fail-over to (10.127.197.165:1812,1813) for id 1812/49
2026/04/06 18:19:32.504378935 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS(00000000): Route radius Pkt on vrf:1 for:Access-Request to 10.127.197.165:1812
2026/04/06 18:19:32.504403273 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:32.504410062 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:32.504413896 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:32.504422951 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:32.504426323 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:32.504430907 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:32.504435998 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:32.504438858 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:32.504465819 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:32.504471839 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:32.504475779 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:32.504478746 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:32.504482466 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:32.504485282 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:32.504489653 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:32.504493997 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:32.504499349 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:32.504509376 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:32.504522118 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:32.504527127 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:32.504531412 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:32.504534916 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:32.504538572 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:32.504597929 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
2026/04/06 18:19:32.803141632 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Received from id 1812/49 10.127.197.165:0, Access-Accept, len 142
Tip: The default retransmission timer of 5 seconds can be reconfigured using radius-server retransmit for faster failover.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
11-May-2026
|
Initial Release |