Example: Configuring The Preferred Server With Authentication Servers As A Subset Of Authorization Servers - Cisco Catalyst 2960 series Configuration Manual

Additional References for RADIUS Server Load Balancing
Example: Configuring the Preferred Server with Authentication Servers As a Subset of
Authorization Servers
The following example shows an authentication server group that uses servers 209.165.200.225 and
209.165.200.226 and an authorization server group that uses servers 209.165.200.225, 209.165.200.226, and
209.165.201.1. Both server groups have the preferred server flag enabled.
aaa group server radius authentication-group
server 209.165.200.225 key radkey1
server 209.165.200.226 key radkey2
aaa group server radius accounting-group
server 209.165.200.225 key radkey1
server 209.165.200.226 key radkey2
server 209.165.201.1 key radkey3
One-half of all authentication transactions are sent to the server 209.165.200.225 and the other half to the
server 209.165.200.226. Servers 209.165.200.225 and 209.165.200.226 are preferred servers for authentication
and accounting transaction. Therefore, there is an equal distribution of authentication and accounting transactions
across servers 209.165.200.225 and 209.165.200.226. The server 209.165.201.1 is relatively unused.
Example: Configuring the Preferred Server with Authentication Servers As a Superset of
Authorization Servers
The following example shows an authentication server group that uses servers 209.165.200.225,
209.165.200.226, and 209.165.201.1 and an authorization server group that uses servers 209.165.200.225 and
209.165.200.226. Both server groups have the preferred server flag enabled.
aaa group server radius authentication-group
server 209.165.200.225 key radkey1
server 209.165.200.226 key radkey2
server 209.165.201.1 key radkey3
aaa group server radius accounting-group
server 209.165.200.225 key radkey1
server 209.165.200.226 key radkey2
Initially, one-third of authentication transactions are assigned to each server in the authorization server group.
As accounting transactions are generated for more sessions, accounting transactions are sent to servers
209.165.200.225 and 209.165.200.226 because the preferred server flag is on. As servers 209.165.200.225
and 209.165.200.226 begin to process more transactions, authentication transactions will start to be sent to
server 209.165.201.1. Transaction requests authenticated by server 209.165.201.1 do not have any preferred
server setting and are split between servers 209.165.200.225 and 209.165.200.226, which negates the use of
the preferred server flag. This configuration should be used cautiously.
Additional References for RADIUS Server Load Balancing
Related Documents
Related Topic
Cisco IOS commands
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
958
Document Title
Cisco IOS Master Command List, All Releases