Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4

AAA Dead-Server Detection

The AAA Dead-Server Detection feature allows you to configure the criteria to be used to mark a RADIUS server as dead. If no criteria are explicitly configured, the criteria are computed dynamically on the basis of the number of outstanding transactions. Using this feature will result in less deadtime and quicker packet processing.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for AAA Dead-Server Detection" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Contents

•Prerequisites for AAA Dead-Server Detection

•Restrictions for AAA Dead-Server Detection

•Information About AAA Dead-Server Detection

•How to Configure AAA Dead-Server Detection

•Configuration Examples for AAA Dead-Server Detection

•Additional References

•Feature Information for AAA Dead-Server Detection

Prerequisites for AAA Dead-Server Detection

•You must have access to a RADIUS server.

•You should be familiar with configuring a RADIUS server.

•You should be familiar with configuring authentication, authorization, and accounting (AAA).

•Before a server can be marked as dead, you must first configure the radius-server deadtime command. If this command is not configured, even if the criteria are met for the server to be marked as dead, the server state will be the "up" state.

Restrictions for AAA Dead-Server Detection

•Original transmissions are not counted in the number of consecutive timeouts that must occur on the router before the server is marked as dead—only the number of retransmissions are counted.

Information About AAA Dead-Server Detection

To configure the AAA Dead-Server Detection feature, you should understand the following concept:

•Criteria for Marking a RADIUS Server As Dead

Criteria for Marking a RADIUS Server As Dead

The AAA Dead-Server Detection feature allows you to determine the criteria that are used to mark a RADIUS server as dead. That is, you can configure the minimum amount of time, in seconds, that must elapse from the time that the router last received a valid packet from the RADIUS server to the time the server is marked as dead. If a packet has not been received since the router booted, and there is a timeout, the time criterion will be treated as though it has been met.

In addition, you can configure the number of consecutive timeouts that must occur on the router before the RADIUS server is marked as dead. If the server performs both authentication and accounting, both types of packets are included in the number. Improperly constructed packets are counted as though they are timeouts. Only retransmissions are counted, not the initial transmission. (Each timeout causes one retransmission to be sent.)

Note Both the time criterion and the tries criterion must be met for the server to be marked as dead.

The RADIUS dead-server detection configuration will result in the prompt detection of RADIUS servers that have stopped responding. This configuration will also result in the avoidance of servers being improperly marked as dead when they are "swamped" (responding slowly) and the avoidance of the state of servers being rapidly changed from dead to live to dead again. This prompt detection of nonresponding RADIUS servers and the avoidance of swamped and dead-to-live-to-dead-again servers will result in less deadtime and quicker packet processing.

How to Configure AAA Dead-Server Detection

This section contains the following procedures:

•Configuring AAA Dead-Server Detection (required)

•Verifying AAA Dead-Server Detection (optional)

Configuring AAA Dead-Server Detection

To configure AAA Dead-Server Detection, perform the following steps.

SUMMARY STEPS

1. enable

2. configure terminal

3. aaa new-model

4. radius-server deadtime minutes

5. radius-server dead-criteria [time seconds] [tries number-of-tries]

DETAILED STEPS

Troubleshooting Tips

After you have configured AAA Dead-Server Detection, you should verify your configuration using the show running-config command. This verification is especially important if you have used the no form of the radius-server dead-criteria command. The output of the show running-config command must show the same values in the "Dead Criteria Details" field that you configured using the radius-server dead-criteria command.

Verifying AAA Dead-Server Detection

To verify your AAA Dead-Server Detection configuration, perform the following steps. The show and debug commands may be used in any order.

SUMMARY STEPS

1. enable

2. debug aaa dead-criteria transactions

3. show aaa dead-criteria

4. show aaa servers

DETAILED STEPS

Configuration Examples for AAA Dead-Server Detection

This section provides the following configuration examples:

•Configuring AAA Dead-Server Detection: Example

•debug aaa dead-criteria transactions Command: Example

•show aaa dead-criteria Command: Example

Configuring AAA Dead-Server Detection: Example

The following example shows that the router will be considered dead after 5 seconds and four tries:

Router (config)# aaa new-model

Router (config)# radius-server deadtime 5

Router (config)# radius-server dead-criteria time 5 tries 4

debug aaa dead-criteria transactions Command: Example

The following output example shows dead-criteria transaction information for a particular server group:

Router# debug aaa dead-criteria transactions

AAA Transaction debugs debugging is on

*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Computed Retransmit Tries: 22, Current Max Tries: 22

*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Computed Dead Detect Interval: 25s, Current Max 
Interval: 25s

*Nov 14 23:44:17.403: AAA/SG/TRANSAC: Estimated Outstanding Transactions: 6, Current Max 
Transactions: 6

show aaa dead-criteria Command: Example

The following output example shows that dead-server-detection information has been requested for a RADIUS server at the IP address 172.19.192.80:

Router# show aaa dead-criteria radius 172.19.192.80 radius

RADIUS Server Dead Criteria:

=============================

Server Details: 

    Address : 172.19.192.80

    Auth Port : 1645

    Acct Port : 1646

Server Group : radius

Dead Criteria Details:

    Configured Retransmits : 62

    Configured Timeout : 27

    Estimated Outstanding Transactions: 5

    Dead Detect Time : 25s

    Computed Retransmit Tries: 22

    Statistics Gathered Since Last Successful Transaction

=====================================================

Max Computed Outstanding Transactions: 5

Max Computed Dead Detect Time: 25s

Max Computed Retransmits : 22

Additional References

The following sections provide references related to the AAA Dead-Server Detection feature.

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for AAA Dead-Server Detection

Table 1 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS, Catalyst OS, and Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2004-2009 Cisco Systems, Inc. All rights reserved.