Verify Radius Server Connectivity with Test AAA Radius Command

Available Languages

Download Options

  • PDF     (93.6 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (147.2 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (111.7 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:July 23, 2026
Document ID:212473

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes how the test aaa radius command identifies radius server connectivity and client authentication issues.

Prerequisites

Requirements

Cisco recommends that you have knowledge of AireOS Wireless LAN Controller (WLC) code 8.2 and higher.

Components Used

This document and the commands mentioned are specific to Cisco AireOS WLCs.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Wireless client authentication issues can be an area where wireless network engineers face some difficulties. To troubleshoot, it often requires working with end users to collect additional information such as debugging logs and captures. In an increasingly critical wireless network, this can cause significant downtime.

Until now, to identify if an authentication failure was caused by the radius server which rejects the client, or if it was just simply a reachability issue was no easy task. The test aaa radius command allows you to do just that. You can now remotely verify if the WLC-Radius server communication fails or if the credentials for the client results in a pass or fail authentication.

How The Feature Works

This is a basic workflow when running the command test aaa radius:

Basic Workflow

1. The WLC sends an access request message to the radius server along with the parameters mentioned in the test aaa radius command:

(Cisco Controller) > test aaa radius username <user name> password <password> wlan-id <wlan-id> apgroup <apgroup-name> server-index <server-index> 

Example

test aaa radius username admin password cisco123 wlan-id 1 apgroup default-group server-index 2

2. The radius server validates the credentials and provides the results of the authentication request.

Command Syntax

These parameters must be provided to execute the command:

(Cisco Controller) > test aaa radius username <user name> password <password> wlan-id <wlan-id> apgroup <apgroup-name> server-index <server-index> 

<username>                    ---> Username that you are testing.
<password>                    ---> Password that you are testing
<wlan-id>                     ---> WLAN ID of the SSID that you are testing.
<apgroup-name>  (optional)    ---> AP group name. This will be default-group if there is no AP group configured.
<server-index>  (optional)    ---> The server index configured for the radius server that you are trying to test. This can be found under Security > Authentication tab.

Scenario 1: Passed Authentication Attempt

When the test aaa radius command results in a passed authentication. When the command is executed, WLC displays the parameters it sends out with the access request:

(Cisco Controller) >test aaa radius username admin password cisco123 wlan-id 1 apgroup default-group server-index 2
Radius Test Request
  Wlan-id........................................ 1
  ApGroup Name................................... default-group
  Attributes                      Values   
  ----------                      ------   
  User-Name                       admin    
  Called-Station-Id               00:00:00:00:00:00:WLC5508
  Calling-Station-Id              00:11:22:33:44:55
  Nas-Port                        0x0000000d (13)
  Nas-Ip-Address                  10.20.227.39
  NAS-Identifier                  WLC_5508
  Airespace / WLAN-Identifier     0x00000001 (1)
  User-Password                   cisco123
  Service-Type                    0x00000008 (8)
  Framed-MTU                      0x00000514 (1300)
  Nas-Port-Type                   0x00000013 (19)
  Tunnel-Type                     0x0000000d (13)
  Tunnel-Medium-Type              0x00000006 (6)
  Tunnel-Group-Id                 0x00000051 (81)
  Cisco / Audit-Session-Id        ad14e327000000c466191e23
  Acct-Session-Id                 56131b33/00:11:22:33:44:55/210
test radius auth request successfully sent. Execute 'test aaa show radius' for response

To view the results of the authentication request, run the command test aaa show radius. This command can take a few minutes to display the output if a radius server is unreachable and the WLC must retry or fallback to a different radius server:

(Cisco Controller) >test aaa show radius
Radius Test Request
  Wlan-id........................................ 1
  ApGroup Name................................... default-group
  Server Index................................... 2
Radius Test Response
Radius Server         Retry Status
-------------         ----- ------
10.20.227.52            1   Success
Authentication Response:
  Result Code: Success
  Attributes                      Values   
  ----------                      ------   
  User-Name                       admin    
  Class                           CACS:rs-acs5-6-0-22/230677882/20313
  Session-Timeout                 0x0000001e (30)
  Termination-Action              0x00000000 (0)
  Tunnel-Type                     0x0000000d (13)
  Tunnel-Medium-Type              0x00000006 (6)
  Tunnel-Group-Id                 0x00000051 (81)

This command shows the attributes are returned by the radius server, this can be a redirect URL and Access Control List (ACL). For example, in the case of Central Web Authentication (CWA) or VLAN info when you use VLAN override.

Caution: The username/password in the access request are sent in clear text to the radius server, so you must use it with caution if traffic flows over an unsecured network.

Scenario 2: Failed Authentication Attempt

In this example, this is how an output appears when a username/password entry results in a failed authentication:

(Cisco Controller) >test aaa show radius                                                                          
Radius Test Request
  Wlan-id........................................ 1
  ApGroup Name................................... default-group
  Server Index................................... 2
Radius Test Response
Radius Server            Retry Status
-------------            ----- ------
10.20.227.52            1     Success
Authentication Response:
  Result Code: Authentication failed     ------> This result indicates that the user authentication will fail.
  No AVPs in Response

In this case, the connectivity test results in a Success, however, the radius server sent an access-reject for the username/password combination used.

Scenario 3: Communication Failed Between WLC and Radius Server

(Cisco Controller) >test aaa show radius                                                                      
 previous test command still not completed, try after some time

Wait for the WLC to finish all retries before it displays the output. The time can vary based on the retry thresholds configured:

(Cisco Controller) >test aaa show radius
Radius Test Request
  Wlan-id........................................ 1
  ApGroup Name................................... default-group
  Server Index................................... 3
Radius Test Response
Radius Server            Retry Status
-------------            ----- ------
10.20.227.72            6     No response received from server
Authentication Response:
  Result Code: No response received from server
  No AVPs in Response

In this output, the WLC tried to contact the radius server 6 times and when there was no response, it marked the radius server as unreachable.

Scenario 4: Radius Fallback

When you have multiple radius servers configured under the Service Set Identifier (SSID) and the primary radius server does not respond, the WLC tries with the secondary radius server configured. This is shown in the output where the first radius server does not respond and the WLC tries the second radius server which responds immediately.

(Cisco Controller) >test aaa show radius
Radius Test Request
  Wlan-id........................................ 1
  ApGroup Name................................... default-group
Radius Test Response
Radius Server            Retry Status
-------------            ----- ------
10.20.227.62            6     No response received from server
10.20.227.52            1     Success
Authentication Response:
  Result Code: Success
  Attributes                      Values   
  ----------                      ------   
  User-Name                       admin

Caveats

  • There is currently no GUI support. It is only a command that can be executed from the WLC.
  • The verification is only for radius. It cannot be used for TACACS authentication.
  • Flexconnect local authentication cannot be tested with this method.

Related Information

Revision History

Revision Publish Date Comments
4.0
23-Jul-2026
Updated Introduction, spelling, grammar, inserted horizonal lines to separate sections/readability.
3.0
28-Aug-2023
Recertification
2.0
20-Jul-2022
Updates for formatting, machine translation, gerunds, etc. to comply with Cisco guidelines.
1.0
21-Nov-2017
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Cisco Engineers
  • Cisco TAC Engineers

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products