Slow or distant authentication server

Why it happens

An 802.1X join is a conversation with a server the radio never sees. The access point carries each EAP message to the RADIUS server inside an Access-Request and waits for the Access-Challenge that answers it. EAP is a lock step protocol: a new request cannot go out until the last response is back. Every exchange pays the full round trip to the server, so that path sets the pace of the whole join.

Certificates add exchanges. A TLS message can run past the 4,096-octet maximum RADIUS packet¹, so EAP-TLS splits it into fragments, and each fragment waits to be acknowledged before the next one is sent. A long certificate chain means more round trips. A server across a WAN or in a distant data center makes each one longer. One vendor’s roaming note lists the round-trip time with the authentication server among the things that stretch a roam.

RADIUS was not built around control timeouts. The IETF’s notes on common RADIUS problems start from a user willing to wait several seconds for authentication, and recommend an initial retransmission time of 2 seconds². The open-source hostapd access point waits 3 seconds before its first retry³, doubles the wait each time, and switches to a backup server only after 4 failed attempts. One lost packet on the way to the server costs seconds. A dead primary server costs every device that tries to join while it is down.

Fast roaming takes the server out of most roams. With key caching, a roaming client does not need to reauthenticate through EAP. The first join still runs the full exchange. After a site-wide outage, every device makes that first join together, and the same IETF notes describe 3,000 network access devices retrying every second after a power failure, enough to overwhelm most RADIUS servers. Session resumption helps a repeat join: Microsoft describes fast reconnect as refreshing a security association with a smaller number of round-trips. A validated industrial design keeps the RADIUS server in the plant’s industrial zone, at Level 3⁴. Count the server’s round trip in your timing budget once for every exchange, not once per join.

How to confirm it

1. Measure the round trip from the access point or controller to the RADIUS server, under normal load, and list every link in between, such as a WAN, VPN, firewall, or cloud connection.
2. Capture one full authentication and count the Access-Request and Access-Challenge pairs. Each pair is a full round trip to the server, so multiply the count by the round trip.
3. Check the server's log for its processing time per request and for duplicate or retransmitted requests.
4. Record the RADIUS timeout, retry count, and dead-server settings on the access points or controller. Then make the primary server unreachable in a test window and time a device rejoining.
5. Check the size of the certificate chain the server sends, since every EAP-TLS fragment costs another round trip.
6. Check whether fast transition, OKC, or PMK caching is in use, and which joins still run the full exchange.

Ben Rutter. "Slow or distant authentication server." OT Wireless, published October 5, 2026. https://otwireless.com/causes/authentication-server-latency/

Rutter, B. (2026, October 5). Slow or distant authentication server. OT Wireless. https://otwireless.com/causes/authentication-server-latency/

@misc{rutter2026authenticationserverlatency,
  author = {Rutter, Ben},
  title = {{Slow or distant authentication server}},
  year = {2026},
  howpublished = {\url{https://otwireless.com/causes/authentication-server-latency/}},
  organization = {OT Wireless},
}