Nortel 2360 Configuration Manual page 479

Authentication proceeds as follows:
1
When user Jose@example.com attempts authentication, the WSS sends an authentication request to the
first AAA method, which is server-group-1.
Because server-group-1 contains two servers, the first RADIUS server, server-1, is contacted. If this
server responds, the authentication proceeds using server-1.
2
If server-1 fails to respond, the WSS retries the authentication using server-2. If server-2 responds, the
authentication proceeds using server-2.
3
If server-2 does not respond, because the WSS has no more servers to try in server-group-1, the WSS
attempts to authenticate using the next AAA method, which is the local method.
4
The WSS consults its local database for an entry that matches Jose@example.com.
5
If a suitable local database entry exists, the authentication proceeds. If not, authentication fails and
Jose@example.com is not allowed to access the network.
Note.
If one of the RADIUS servers in the group does respond, but it indicates that the
user does not exist on the RADIUS server, or that the user is not permitted on the network,
then authentication for the user fails, regardless of any additional methods. Only if all the
RADIUS servers in the server group do not respond does the WSS attempt to authenticate
using the next method in the list.
Also note that if the primary authentication method is local and the secondary method is
RADIUS, but the user does not exist in the local database, then the WSS does attempt to
authenticate using RADIUS. See
Note.
Using pass-through authentication as the primary authentication method and the
local database as the secondary authentication method is not supported.
"Local override exception" (page
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Configuring AAA for network users 479
477).