System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

RADIUS dead-server detection features

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains the time and tries criteria that Cisco IOS XR uses to mark a nonresponsive RADIUS server as dead and improve availability.

A RADIUS dead-server detection feature is a RADIUS availability feature that

  • marks a RADIUS server as dead when configured or dynamically computed time and tries criteria are met

  • computes criteria dynamically when no explicit criteria are configured, and

  • reduces deadtime and improves packet processing by promptly detecting nonresponding servers.

Additional reference information

The RADIUS dead-server detection feature lets you configure and determine the criteria used to mark a RADIUS server as dead. If no criteria are explicitly configured, the system computes the criteria dynamically based on the number of outstanding transactions.

You can configure two main criteria:

  • Time criterion: The minimum elapsed time in seconds from when the router last received a valid packet from the RADIUS server to when the server is marked as dead. If no packet has been received since the router booted and a timeout occurs, the time criterion is treated as met.

  • Tries criterion: The number of consecutive timeouts on the router before the server is considered dead. If the server performs both authentication and accounting, both types of packets count. Improperly constructed packets count as timeouts. Only retransmissions are counted (each timeout causes one retransmission).

Both the time criterion and tries criterion must be met before a server is marked as dead.

The radius-server deadtime command specifies the duration, in minutes, for which a server remains marked as dead. After this period, the server is automatically marked alive even if no responses were received. Servers are not monitored for deadtime unless this command is configured.

For example, if you configure a deadtime interval and set criteria for timeouts and elapsed time, the feature will mark a RADIUS server as dead only when both conditions are satisfied. This ensures that brief connectivity issues do not incorrectly mark servers as dead.

Configure RADIUS dead-server detection

Set the conditions that Cisco IOS XR uses to mark a RADIUS server as dead and ensure prompt detection of nonresponsive servers.

The RADIUS Dead-Server Detection feature allows you to configure criteria to determine when a RADIUS server is considered "dead." If criteria are not explicitly configured, Cisco IOS XR computes them dynamically based on the number of outstanding transactions. Prompt detection avoids delays caused by swamped or failed servers, resulting in fast packet processing. You can set a minimum interval (in seconds) between receiving packets and marking a server as dead, and configure the number of consecutive timeouts required before a server is marked as dead. If the server handles both authentication and accounting, both packet types are counted. Incorrect packets also count as timeouts, and only retransmissions are considered. Both the time and tries criteria must be met for the server to be marked as dead. The radius-server deadtime command specifies how long (in minutes) a server remains dead before being marked alive again. Servers are not monitored unless this command is configured.

Before you begin

Configure the RADIUS server host before configuring dead-server detection.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Configure the RADIUS server deadtime.

    Example:

    Router(config)# radius-server deadtime 5

    Improves RADIUS response times when some servers might be unavailable and causes the unavailable servers to be skipped immediately.

  3. Configure the RADIUS dead-server time criterion.

    Example:

    Router(config)# radius-server dead-criteria time 5

    Establishes the time for the dead-criteria conditions for a RADIUS server to be marked as dead.

  4. Configure the RADIUS dead-server tries criterion.

    Example:

    Router(config)# radius-server dead-criteria tries 4

    Establishes the number of tries for the dead-criteria conditions for a RADIUS server to be marked as dead.

  5. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • commit: Saves the configuration changes and remains within the configuration session.

    • end: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

  6. Display RADIUS dead-server detection information.

    Example:

    Router# show radius dead-criteria host 172.19.192.80

    (Optional) Displays dead-server-detection information that has been requested for a RADIUS server at the specified IP address.

Cisco IOS XR uses the configured time and tries criteria to mark nonresponsive RADIUS servers as dead, ensuring responsive RADIUS operation and reliable packet processing.