Fine tuning the logging to cisco device

Question

Dear Netpro Community,
I am trying to fine tune the AAA portion on the cisco device
Here is my current configuration:
aaa new-model
aaa authentication login default group radius local
aaa authentication enable default group radius enable
If the radius server is offline, the first level is not a problem. However, the issue occurs if I want to go to enable mode. It will not use the enable password defined locally, but instead it will go to and search for radius server for authentication.
Debug:
test_switch>en
Password:
01:05:15: RADIUS: Authenticating using $enab15$
01:05:15: RADIUS: ustruct sharecount=1
01:05:15: RADIUS: Initial Transmit tty0 id 44 x.x.x.x:1812, Access-Request,
len 72
01:05:15: Attribute 4 6 AC10E10F
01:05:15: Attribute 5 6 00000000
01:05:15: Attribute 61 6 00000000
01:05:15: Attribute 1 10 24656E61
01:05:15: Attribute 2 18 69ABFDF8
01:05:15: Attribute 6 6 00000006
01:05:20: RADIUS: Retransmit id 44
01:05:25: RADIUS: Retransmit id 44
01:05:30: RADIUS: Retransmit id 44
Password:
01:05:35: RADIUS: Marking server x.x.x.x:1812,1813 dead
01:05:35: RADIUS: Tried all servers.
01:05:35: RADIUS: No valid server found. Trying any viable server
01:05:35: RADIUS: Tried all servers.
01:05:35: RADIUS: No response for id 44
01:05:35: RADIUS: No response from server
% Password: timeout expired!
% Error in authentication.
How do I ensure that i can access the switch in privilege mode if there is no path to the radius server?

Answer 1

Jagdeep:
With the default "radius-server retransmit" value, there are (potentially) three retransmissions that may occur if the RADIUS server doesn't respond to the first request. With a 1 sec. "radius-server timeout", this provides a four second window of opportunity for a successful response.
If he doesn't want to use a "radius-server timeout" as low as 1 sec. (per your concern), he can use the "radius-server retransmit" command to constrain (to a reasonable period) the time required to mark an MIA RADIUS Server as dead.
e.g.:
radius-server host aaa.bbb.ccc.ddd auth-port 1812 acct-port 1813 timeout 2 retransmit 1 key xxxxxxxxxx
Contrary to your statement, your approach and mine are trying to facilitate the same thing, i.e.: accommodating fall back to the enable method prior to login timeout.
However, your recommendation only results in a successful login after 20+ sec., due to postponement of fall back, resulting from the 20 sec. spent determining that the MIA RADIUS Server is dead.
I don't ever want to wait 20+ sec. for a login, and don't find it necessary to wait that long to conclude that an AAA server is MIA.