Customers may observe intermittent authentication failures for individual users even though:

• Other users authenticate successfully at the same time

• The same RADIUS servers appear operational

• No global RADIUS server down condition is reported

This leads to questions about how Junos evaluates RADIUS server reachability and performs failover when authentication failures occur for a single user.

• • One or more users fail RADIUS authentication due to timeouts

  • RADIUS servers remain reachable for other users

  • No persistent “RADIUS server dead” condition is observed

  • Authentication retries and failover behaviour appear inconsistent across users

RADIUS Server Selection and Retry Logic

For each individual authentication request, Junos processes RADIUS servers in the configured order:

1. The first configured RADIUS server is selected.

2. If no response is received:

   • The switch retries the same server until the configured retry count is exhausted.

3. If all retries fail:

   • The next configured RADIUS server is tried.

4. This process continues until:

   • A response is received (Access-Accept or Access-Reject), or

   • All servers and retries are exhausted, resulting in a timeout.

Failover is therefore per user, not global.

RADIUS Server Reachability State Updates

• RADIUS server status (UP / UNREACHABLE) is updated only after the authentication request completes.

• Status updates apply only to the servers that were attempted for that specific user.

• A server marked UNREACHABLE due to one user may be marked UP again as soon as another user successfully authenticates using that server.

Example Scenario

Two users (User A, User B) authenticate against two RADIUS servers (R1, R2):

User A authentication

• R1 does not respond (all retries exhausted)

• R2 responds successfully

• Authentication completes

• Server status updates:

  • R1 → UNREACHABLE

  • R2 → UP

User B authentication

• R1 responds successfully

• Authentication completes

• Server status updates:

  • R1 → UP

  • R2 → No update (not used)

If no RADIUS server responds for a user, all servers attempted during that authentication request will have their status updated accordingly.

Impact

• A single user’s authentication failure:

  • Does not immediately mark a RADIUS server globally down

  • Does not affect other users’ authentication flows

• Server reachability status may appear to “flap” during transient packet loss or selective upstream drops (e.g., firewall behaviour)

This is expected behavior and does not indicate a defect.

No configuration change is required.

Modified on Jan 22, 2026

The documentation for RADIUS configuration is available in the Broadband Subscriber Sessions User Guide and the same is applicable to EX products.

The server status changes are documented in detail under
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-network-access-aaa-radius-servers.html

Once a server is marked DOWN/UNREACHABLE, the status will revert to UP after a while (so that future requests may be attempted to those servers). This duration too is configurable.
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/revert-interval-edit-access.html