RADIUS Timeout

RADIUS Timeout – When It Can Happen and How to Interpret It

High‑level meaning: A “RADIUS timeout” usually means the RADIUS server did not receive a response from the client and could not complete the full authentication flow in time.

Common Scenarios

• Intermittent timeouts on random devices

  • What it likely means: The client is not completing the transaction after our response (e.g., user moves out of range, Wi‑Fi roaming, client drops the session, transient network issues).
  • What to do:
    • If rare and sporadic, this can typically be ignored.
    • Monitor; only investigate further if the frequency increases or impacts many users.

• Consistent timeouts on one specific device

  • What it likely means: That device does not fully trust the RADIUS server’s CA or certificate, so it stops the EAP-TLS handshake.
  • What to do:
    • Check if the server CA is installed and marked as trusted on that device.
    • Re‑install or update the server CA / Wi‑Fi profile specifically on the affected device.

• Timeouts across many or all devices

  • What it likely means: A systemic trust or configuration issue, usually:
    • The server CA is not trusted by clients (wrong CA, missing CA, or new CA not pushed).
    • A recent change in certificates or CA was not rolled out via MDM.
  • What to do:
    • Verify that the correct server CA is installed on the RADIUS side.
    • Ensure the MDM profile marks the correct server CA as trusted and is successfully pushed to all devices.
    • If the CA was recently rotated, verify all devices have received the updated profile.

Other Possible Causes to Consider

• Certificate CA issues

  • Expired server CA.
  • Mismatch between expected server name and the certificate CN/SAN (clients may silently drop) (We have seen this issue with Android devices).

• Network path issues

  • Firewalls or ACLs intermittently dropping UDP/1812 or 1813 traffic.
  • Load balancer or VPN path introducing packet loss or latency that exceeds the client’s RADIUS timeout.

• RADIUS configuration mismatches

  • Incorrect shared secret between NAS/AP and RADIUS server (device may drop or not accept responses).
  • Wrong RADIUS server IP configured on the NAS/AP (requests go out, but responses never come back).

• Performance / load on the NAS/AP

  • High loads on the NAS/AP, leading to timeouts on the client side or higher response times.

• Client/device‑specific behavior

  • Very aggressive client‑side timeout values.

How to Triage Quickly

• Intermittent, scattered → Likely client/network flakiness; monitor and only escalate if frequency grows.
• One device, repeatable → Check server CA trust / Wi‑Fi profile on that device.
• Many/all devices, sudden onset → Check CA trust + MDM profile + certificate/chain and any recent infra changes (cert rotation, firewall, load balancer).