Radius on AP load

[bnolen1]

Recently deployed 60 Extreme AP510C. Over 1000 users throughout the campus.

We’re running Radius at the AP level which phones home to on premise AD.

What is a reasonable amount of devices the AP running Radius can support? We’re seeing high latency on Radius and wonder if this is just too much for the AP to handle.

[bnolen1]

Thanks so much Sam. We’re going to dig in to this and see if it works for us. I really appreciate the detailed and quick answers!

[SamPirok · Accepted solution]

Thank you for that screen shot. The way you have this set up now is that there is a primary Radius server, and several backups in case the primary Radius server goes down. But until the primary AP stops responding, all requests go to the primary AP only.

To set up more of a ‘load balancing’ situation, you’ll want to go in to XIQ> Configure> Network Policy> Open the network policy in use> Open the Radius SSID> In the Authentication Settings section of the SSID, below the Radius Server Group you have configured, there is a check box for the option to “Apply Radius server groups to devices via classification”. I would recommend using classification rules to determine which clients reach out to which Radius AP for authentication. This page goes in to more detail on the Radius Server Group settings. 

Hope that helps!

[bnolen1]

Thank you for the reply!

We have several APs set up for Radius. It seems like everything still hammers the first one. Is there somewhere else to go to set it up for load balancing?

[SamPirok]

I would add a second AP to your Radius set up to help even out the load. Just to give you an idea, if you were using the AP as your user DB, it could handle a little over 500 concurrent Radius connections at a time, and 256 simultaneous authentication requests. Those limits don’t apply to your set up since you’re using an AD and an external user DB, but that might give you an idea of what the APs limits could be.