Practical Deployment of Cisco Identity Services Engine (ISE)

WIRELESS 99

going into or recovering from a critical authorization isn’t exactly instantaneous. If you’re on

a production network and utilizing critical authorization, we can be pretty well assured that

you’re not having a good day.

To start, for critical authorization to work, all RADIUS servers need to be declared dead.

In the conguration I have described above, the dead criteria have to be met for each one of

your ISE PSN nodes. That is, a RADIUS server is tried three times with a 5-s timeout on each

of them. If an ISE PSN does not respond in 15 s, it is declared dead. That declaration of a dead

RADIUS server stays for the length of time ...