Extreme Networks AP Caches Radius Clients

[FranzNeubauer]

Hello Community,

we have a problem that our Extreme AP410C Access Points (managed by extreme Cloud IQ) caches the authenticated RADIUS Clients.

Our Test LAB:

Cisco ISE as RADIUS Server, SSID with WPA2 Personal PSK AND Mac Authentication (Cisco ISE as External RADIUS Server).

The Problem is that the AP reqest only the first time of authentication the Cisco ISE. Than i switched the Client in a "Black List" and Reauthenticate the Client in the WLAN. The next authentication retry doesnt get to the Cisco ISE (no logging in our Fortigate Forti Analyzer AND no Request in the RADIUS logging in the Cisco ISE), but the Wireless Client get entry in the Wireless network.

Conclusion:

There might be a cache- function configured local at the AP, or cloud based in the XIQ, so that the RADUIS requests answered local and not send to the RADIUS server itself.

I already had a look via ssh on the AP410c:

"show auth"

Output:

"Local-cache-timeout=86400" => 24h

But i dont find a setting to change this Time Range...

Is there anybody out there, who might have the same Problem or a solution to this 🙂

Thank you and best regards

[Andre_Jordaan]

Hi There,

Im no expert but have a look at:

security-object <your ssid> security roaming cache update-interval 10 ageout 600 

and / or

ssid <your ssid> client-age-out 15

Good luck!

[FranzNeubauer]

Hello Andre,

i dont have any of both in my running config. Is that a good or a bad point :-)?

Thank you!

[Andre_Jordaan]

My guess is that its using defaults then.

I set these using EIQ Cloud and looked at the config to find these and its also the AP410C. Not sure if you are using EIQ Cloud...

[James_A]

Where do you set these in XIQ? Ah, found it https://extremeportal.force.com/ExtrArticleDetail?an=000104782