本文档介绍思科交换机上的RADIUS死机检测功能和死机时间的配置和工作。
本文档中的信息基于以下软件和硬件版本:
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
AAA Dead Server Detection(AAA失效服务器检测)功能允许您定义用于确定RADIUS服务器何时被视为不可用的标准。您可以配置最小时间间隔(以秒为单位),从设备上次收到来自RADIUS服务器的有效数据包后到将其标记为失效之前必须经过该时间间隔。如果自设备上次启动以来未收到有效数据包,并且发生超时,则认为满足基于时间的条件。
此外,您可以配置在RADIUS服务器声明失效之前必须发生的连续超时次数。如果服务器同时处理身份验证和记帐,则这两种类型的流量的超时都包含在此计数中。格式错误或构造不当的数据包被视为超时。只有重新传输才会计入超时阈值。
一旦RADIUS服务器被标记为停机,所配置的停机时间值可确保服务器在标记为活动状态之前的指定持续时间(以分钟为单位)内保持停机。在此期间,交换机不会向失效服务器发送任何进一步的RADIUS请求。
如果在dead-criteria中配置了time和tries,则需要在服务器标记为失效之前满足这两个条件。
在Cisco cat 9K交换机中配置dead time和dead-criteria。
Switch#config terminal
Switch(config)#radius-server deadtime 2
Switch(config)#radius-server dead-criteria time 3 tries 3
使用前面步骤中定义的deadtime配置,交换机在上例中指定的一段时间(2分钟)内将服务器标记为停机。当死区时间到期时,交换机将服务器重新标记为活动状态,并开始向服务器发送RADIUS流量。
如果未指定RADIUS死时间,则默认值为0,这会使服务器立即恢复到UP状态。由于此行为,RADIUS服务器状态可能摆动,导致其他身份验证问题。要在指定的死区时间到期之前将服务器状态恢复为UP状态,请配置RADIUS探测。这将定期测试RADIUS服务器以查看它是否响应RADIUS请求。收到对探测的响应后,交换机将RADIUS服务器标记为活动状态。
Switch(config)#radius server RAD1
Switch(config-radius-server)#address ipv4 10.127.197.164 auth-port 1812 acct-port 1813
Switch(config-radius-server)#automate-tester username test-user ignore-acct-port probe-on
Switch(config-radius-server)#key Iselab@123
Switch(config)#radius server RAD2
Switch(config-radius-server)#address ipv4 10.127.197.165 auth-port 1812 acct-port 1813
Switch(config-radius-server)#automate-tester username test-user ignore-acct-port probe-on
Switch(config-radius-server)#key Iselab@123
如前所述,test-user是测试用户ID用户名。ignore-acct-port关键字指示交换机不得验证要使用的服务器的记帐端口号。probe-on关键字指示交换机只有在服务器标记为失效时才能发送测试探测。
对于ISE的内部或外部数据库上的实际探测用户帐户,需要密码。在以下示例中,test-user是用户名,test-password是RADIUS服务器引用的身份验证身份存储中存储的密码。此外,“User rejected”消息表示RADIUS服务器处于活动状态(除非发生超时)。
两个RADIUS服务器RAD1和RAD2配置在RADGRP组中。RADIUS服务未在RAD1上运行,但在RAD2上运行。
radius server RAD1
address ipv4 10.127.197.164 auth-port 1812 acct-port 1813
key Iselab@123
radius server RAD2
address ipv4 10.127.197.165 auth-port 1812 acct-port 1813
key Iselab@123
aaa group server radius RADGRP
server name RAD1
server name RAD2
要查看详细日志,radius和aaa-trans debugs已在交换机上启用。
Switch#set platform software trace smd switch active R0 radius debug
Switch#set platform software trace smd switch active R0 aaa-trans debug
一旦交换机启动MAB会话,它就会将第一个RADIUS访问请求发送到位于10.127.197.164的主服务器。由于此服务器没有活动的RADIUS服务,因此它不会响应。
2026/04/06 18:19:17.503353862 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Send Access-Request to 10.127.197.164:1812 id 1812/49, len 3132026/04/06 18:19:17.503363389 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:17.503370267 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:17.503374078 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:17.503383207 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:17.503386667 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:17.503391259 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:17.503396265 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:17.503399148 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:17.503425477 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:17.503431520 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:17.503435444 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:17.503438273 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:17.503442022 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:17.503444833 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:17.503448442 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:17.503451224 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:17.503454678 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:17.503466727 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:17.503470183 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:17.503475118 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:17.503479167 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:17.503482732 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:17.503486454 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:17.503543835 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
在等待默认重新传输计时器5秒后,交换机在18:19:22发送访问请求,但是没有收到响应,这会将尝试计数器增加到2。
2026/04/06 18:19:22.503540209 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Retransmit to (10.127.197.164:1812,1813) for id 1812/49
2026/04/06 18:19:22.503550512 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS(00000000): Route radius Pkt on vrf:1 for:Access-Request to 10.127.197.164:1812
2026/04/06 18:19:22.503586730 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:22.503593713 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:22.503597724 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:22.503606908 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:22.503610291 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:22.503614797 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:22.503620000 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:22.503636893 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:22.503663803 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:22.503669779 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:22.503673708 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:22.503676661 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:22.503680361 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:22.503683177 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:22.503686781 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:22.503689608 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:22.503693037 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:22.503698541 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:22.503701959 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:22.503706717 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:22.503710913 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:22.503714471 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:22.503718191 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:22.503791197 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
再等待5秒后,交换机在18:19:27发送第三个Access-Request ,再次无响应,将tries计数器调高到3。
2026/04/06 18:19:27.504409044 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Retransmit to (10.127.197.164:1812,1813) for id 1812/49
2026/04/06 18:19:27.504419704 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS(00000000): Route radius Pkt on vrf:1 for:Access-Request to 10.127.197.164:1812
2026/04/06 18:19:27.504458569 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:27.504465641 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:27.504469296 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:27.504478672 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:27.504482096 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:27.504486708 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:27.504491837 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:27.504494772 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:27.504521457 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:27.504527464 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:27.504531333 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:27.504534211 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:27.504538053 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:27.504540913 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:27.504544569 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:27.504547453 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:27.504556776 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:27.504562674 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:27.504566176 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:27.504571069 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:27.504575163 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:27.504578703 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:27.504582370 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:27.504650322 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
此时,时间和尝试条件都已满足,因此交换机将第一台服务器标记为停机,并配置了120秒,然后故障切换到下一台服务器。
2026/04/06 18:19:32.503887087 {smd_R0-0}{1}: [aaa-trans] [27946]: (info): AAA/SG/TRANSAC: Server (10.127.197.164:1812,1813) marked dead - Initializing deadtime timer for 120 secs.
2026/04/06 18:19:32.504202918 {smd_R0-0}{1}: [errmsg] [27946]: (info): %RADIUS_AUDIT_MESSAGE-6-RADIUS_DEAD: R0/0: sessmgrd: RADIUS server 10.127.197.164:1812,1813 is not responding.
2026/04/06 18:19:32.504301242 {smd_R0-0}{1}: [errmsg] [27946]: (info): %AAA_AUDIT_MESSAGE-6-METHOD_LIST_STATE: R0/0: sessmgrd: mlist default of 8021X service is marked for notifying state and its current state is : ALIVE
2026/04/06 18:19:32.504323189 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Fail-over to (10.127.197.165:1812,1813) for id 1812/49
2026/04/06 18:19:32.504378935 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS(00000000): Route radius Pkt on vrf:1 for:Access-Request to 10.127.197.165:1812
2026/04/06 18:19:32.504403273 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: authenticator c0 1f c0 30 8d 3d bc f9 - d2 67 e5 fe 09 3f 74 af
2026/04/06 18:19:32.504410062 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Name [1] 14 "b496912267d1"
2026/04/06 18:19:32.504413896 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: User-Password [2] 18 *
2026/04/06 18:19:32.504422951 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
2026/04/06 18:19:32.504426323 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:32.504430907 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "service-type=Call Check"
2026/04/06 18:19:32.504435998 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Framed-MTU [12] 6 1464
2026/04/06 18:19:32.504438858 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Message-Authenticator[80] 18 ...
2026/04/06 18:19:32.504465819 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: EAP-Key-Name [102] 2 *
2026/04/06 18:19:32.504471839 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 49
2026/04/06 18:19:32.504475779 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 43 "audit-session-id=C4436B0A0000003B62BAA3AE"
2026/04/06 18:19:32.504478746 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:32.504482466 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "method=mab"
2026/04/06 18:19:32.504485282 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 31
2026/04/06 18:19:32.504489653 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 25 "client-iif-id=506217142"
2026/04/06 18:19:32.504493997 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Vendor, Cisco [26] 18
2026/04/06 18:19:32.504499349 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Cisco AVpair [1] 12 "vlan-id=97"
2026/04/06 18:19:32.504509376 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.67.196
2026/04/06 18:19:32.504522118 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Id [87] 26 "TenGigabitEthernet1/0/46"
2026/04/06 18:19:32.504527127 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
2026/04/06 18:19:32.504531412 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: NAS-Port [5] 6 50146
2026/04/06 18:19:32.504534916 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Calling-Station-Id [31] 19 "B4-96-91-22-67-D1"
2026/04/06 18:19:32.504538572 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Called-Station-Id [30] 19 "90-77-EE-EC-78-AE"
2026/04/06 18:19:32.504597929 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Started 5 sec timeout
2026/04/06 18:19:32.803141632 {smd_R0-0}{1}: [radius] [27946]: (info): RADIUS: Received from id 1812/49 10.127.197.165:0, Access-Accept, len 142
提示:可以使用radius-server retransmit重新配置默认重新传输计时器(5秒),以实现更快的故障切换。
| 版本 | 发布日期 | 备注 |
|---|---|---|
1.0 |
11-May-2026
|
初始版本 |