Skip to main contentSkip to search
Skip to main content

RADIUS Caching & Failover

Key Takeaways
  • RADIUS caching stores authentication results locally on access points or controllers, reducing reauthentication latency by up to 90% and enabling continued WiFi access during RADIUS server outages.
  • Four cache types serve different purposes: PMK caching (fast roaming within an AP), credential caching (offline authentication), 802.11r Fast Transition caching (sub-50ms roaming across APs), and session caching (accounting continuity).
  • Cache lifetime should be tuned to the environment: 4-8 hours for corporate, 2-4 hours for education, 1-2 hours for healthcare (HIPAA), and 15-30 minutes for high-security/government networks.
  • Always configure both primary and backup RADIUS servers alongside caching -- caching is a complement to server redundancy, not a replacement for it.
  • Enable RADIUS Change of Authorization (CoA) on port 3799 to ensure that password changes and account revocations invalidate cached credentials in real time.

RADIUS caching is a network optimization technique that stores authentication credentials and session data locally on access points or wireless controllers, allowing previously authenticated users to reconnect without querying the remote RADIUS server. This reduces authentication latency by up to 90%, lowers RADIUS server load, and enables continued WiFi access during server outages or internet disruptions.

IronWiFi RADIUS infrastructure supports comprehensive caching strategies with intelligent failover mechanisms, ensuring uninterrupted WiFi access even when cloud connectivity is temporarily lost.

When to Enable RADIUS Caching​

Enable RADIUS caching when​

  • High availability is critical -- Any environment where WiFi downtime has a direct business or safety impact (hospitals, manufacturing floors, logistics centers) benefits from cached authentication as a failover mechanism.
  • Branch offices have unreliable WAN links -- Remote sites with intermittent internet connectivity can maintain WiFi access for previously authenticated users even when the connection to IronWiFi's cloud RADIUS servers is temporarily lost.
  • Users frequently roam between access points -- Environments with high mobility (warehouses, campuses, hospitals) benefit from PMK caching and 802.11r Fast Transition to achieve sub-50ms roaming without RADIUS round-trips.
  • Authentication bursts are common -- Event venues, shift-change environments, and educational institutions experience hundreds of simultaneous authentication requests. Caching reduces peak RADIUS server load by 70-90%.
  • You need to meet 99.9%+ uptime SLAs -- RADIUS caching eliminates the cloud RADIUS server as a single point of failure for returning users.

Be cautious with caching when​

  • Rapid credential revocation is required -- In high-security environments, a cached credential remains valid until the cache expires or a CoA message invalidates it. If your security policy requires immediate revocation, use short cache lifetimes (15-30 minutes) and enable CoA.
  • User population changes frequently -- Guest WiFi networks with many one-time visitors have low cache hit rates, making caching less effective. For guest/public WiFi, consider disabling credential caching and relying on RADIUS server redundancy instead.
  • Compliance mandates real-time authentication -- Some regulatory frameworks require every connection to be authenticated against the authoritative source. In these cases, use PMK caching (for roaming performance) but disable full credential caching.

Key Benefits​

Performance Optimization

  • Reduced authentication time (50-90% faster)
  • Lower network latency
  • Decreased RADIUS server load
  • Improved roaming performance
  • Better user experience

High Availability

  • Continued operation during RADIUS outages
  • Local failover without connectivity loss
  • Automatic recovery when service restored
  • Zero-downtime authentication
  • Business continuity assurance

Scalability

  • Handle authentication bursts (event starts, shift changes)
  • Reduce peak load on RADIUS servers
  • Support remote/branch offices with limited connectivity
  • Enable large-scale deployments
  • Cost-effective infrastructure

Reliability

  • Eliminate single point of failure
  • Survive internet outages
  • Maintain WiFi during WAN failures
  • Support disaster recovery
  • Meet uptime SLAs (99.9%+)

How RADIUS Caching Works​

Authentication Flow with Caching​

Cache Types​

PMK Caching (Opportunistic Key Caching)

Credential Caching

802.11r Fast Transition (FT) Cache

Session Caching (RADIUS Accounting)

Configuration​

IronWiFi RADIUS Configuration​

Enable Caching Support

RADIUS Server Redundancy

Access Point Configuration​

Cisco Meraki​

Caching Configuration

Cisco Catalyst WLC​

RADIUS and Caching

Ubiquiti UniFi​

RADIUS Caching

Aruba​

Advanced Caching Features

Ruckus​

SmartZone Caching

Controller vs AP-Based Caching​

Controller-Based Architecture

AP-Based Architecture

Performance Optimization​

Cache Hit Rates​

Measuring Cache Effectiveness

Improving Cache Hit Rate

Network Design Considerations​

High-Availability Architecture

Branch Office Design

Security Considerations​

Cache Security​

Data Protection

Cache Poisoning Prevention

Stale Data Management​

Cache Invalidation

Audit and Compliance

Troubleshooting​

Common Issues​

Cache Not Working

High Cache Miss Rate

RADIUS Failover Not Working

Stale Cache Data

Best Practices​

Cache Configuration​

Optimal Settings by Environment

Monitoring and Maintenance​

Key Performance Indicators

Alerting Configuration

Advanced Topics​

Dynamic Cache Optimization​

Adaptive Cache Sizing

Multi-Site Cache Synchronization​

Distributed Cache Architecture

Certificate Caching for EAP-TLS​

Certificate Validation Caching

Support and Resources​

IronWiFi Support​

Contact Information

Caching Support

  • Configuration assistance
  • Performance tuning
  • Failover testing
  • Troubleshooting
  • Best practices consultation

Vendor Resources​

AP/Controller Documentation

Need Help with RADIUS Caching?

Contact IronWiFi support for assistance with cache configuration, performance optimization, or high-availability design for your deployment.

Was this page helpful?