Troubleshooting: RADIUS Server Stops Responding After an Unscheduled Reboot

Version Affected: RADIUS Server 2.0.x and newer
 
 

Overview

After an unscheduled reboot, the RADIUS server stops responding to incoming RADIUS requests from any source. Restarting the RADIUS service, or replacing its configuration file, doesn't resolve it.

Cause

An unscheduled reboot can corrupt the libraries RADIUS depends on. With ALL logging enabled, the RADIUS logs show a parse error caused by an oversized incoming packet:

ERROR UDPListener: Radius server error
java.lang.RuntimeException: Radius package parse error
 at com.secureauth.idp.radius.RadiusLibFacade.getAttributeContainer
Caused by: org.tinyradius.util.RadiusException: bad packet: packet too long (26209 bytes)

Testing locally on the RADIUS server with NTRadPing gets no response at all, even with RADIUS service, firewall settings, and local machine key permissions all ruled out.

Resolution:

A clean reinstall is required -- restarting the service or replacing the configuration file alone isn't enough to clear the corruption:

1. Back up the RADIUS configuration files first. If the RADIUS Server Admin Console is unavailable, go to the folder RADIUS is installed in and manually copy the appliance.radius.properties file to a safe location -- it's needed to restore the configuration after reinstalling.
2. Uninstall the RADIUS server completely, and delete the folder it was installed in.
3. Reinstall the RADIUS server cleanly, then restore the configuration from the backed-up appliance.radius.properties file.

Special Considerations

To enable ALL logging in RADIUS in order to confirm this cause, contact SecureAuth Support for the correct log4j2.xml to place in the RADIUS /bin/conf folder.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.