AP1142N dual RADIUS

Question

Hi.
I apologize for my english.
I installed a set of AP1142N that should interview two RADIUS servers (some users on the first server and others on the second).
It seems that the AP interrogate only the first.
The NPS are on Windows 2008 (not r2).
Here's the setup:
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname XXXXXXXXXXXXX
aaa new-model
aaa group server radius rad_eap
server xxx.yyy.zzz.mmm auth-port 1645 acct-port 1646
server xxx.yyy.zzz.kkk auth-port 1645 acct-port 1646
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
server xxx.yyy.zzz.mmm auth-port 1645 acct-port 1646
server xxx.yyy.zzz.kkk auth-port 1645 acct-port 1646
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa group server radius rad_eap1
server xxx.yyy.zzz.mmm auth-port 1645 acct-port 1646
server xxx.yyy.zzz.kkk auth-port 1645 acct-port 1646
aaa authentication login default local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication login eap_methods1 group rad_eap1
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
clock timezone +0100 1
ip domain name my.domain.local
ip name-server xxx.yyy.zzz.mmm
dot11 syslog
dot11 ssid TEST
   authentication open eap eap_methods1
   authentication network-eap eap_methods1
   guest-mode
   infrastructure-ssid
dot11 arp-cache
username Cisco privilege 15 password 7 *************************
username admin privilege 15 password 7 *************************
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode wep mandatory
ssid TEST
antenna gain 0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
encryption mode wep mandatory
ssid TEST
antenna gain 0
no dfs band block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address vvv.ccc.bbb.nnn 255.255.0.0
no ip route-cache
ip default-gateway vvv.ccc.bbb.nnj
ip http server
ip http authentication aaa
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server attribute 32 include-in-access-req format %h
radius-server host xxx.yyy.zzz.mmm auth-port 1645 acct-port 1646 key 7 ******************************
radius-server host xxx.yyy.zzz.kkk auth-port 1645 acct-port 1646 key 7 ******************************
radius-server vsa send accounting
bridge 1 route ip
line con 0
line vty 0 4
sntp server xxx.yyy.zzz.mmm
sntp broadcast client
end
What's wrong?
Tks
siland

Answer 1

It will use the first one as the primary and the second one as the secondary. It will not round robin. Even when using a WLC, it will use the one you set as primary until the primary cant be reached then it will try the secondary and so on.
Sent from Cisco Technical Support iPhone App