Performance Of Unknown User Authentication; Added Latency; Authentication Timeout Value On Aaa Clients - Cisco 2509 - Router - EN User Manual

Chapter 12 Administering External User Databases

Performance of Unknown User Authentication

Added Latency

Authentication Timeout Value on AAA clients

78-14696-01, Version 3.1
most reliable method of supporting multiple instances of a username across
domains is to require users to supply their domain memberships as part of the
authentication request.
Processing authentication requests for unknown users requires slightly more time
than processing authentication requests for known users. This small delay may
require additional configuration on the AAA clients through which unknown
users may attempt to access your network.
Adding external databases against which to process unknown users can
significantly increase the time needed for each individual authentication. At best,
the time needed for each authentication is the time taken by the external database
to authenticate, plus some latency for Cisco Secure ACS processing. In some
circumstances (for example, when using a Windows NT/2000 user database), the
extra latency introduced by an external database can be as much as tens of
seconds. If you have configured multiple databases, this number is multiplied by
the time taken for each one to complete.
You can account for added latency by setting the order of databases. If you are
using an authentication protocol that is particularly time sensitive, such as PEAP,
we recommend configuring unknown user processing to attempt authentication
first with the database most likely to contain unknown users using the
time-sensitive protocol. For more information, see
page 12-9.
Be sure to increase the AAA client timeout to accommodate the longer
authentication time required for Cisco Secure ACS to pass the authentication
request to the external databases. If the AAA client timeout value is not set high
enough to account for the delay required by unknown user authentication, the
AAA client times out the request and every unknown user authentication fails.
User Guide for Cisco Secure ACS for Windows Server
Unknown User Processing
Database Search Order,
12-7