Zero Trust security assumes that trust is never permanent. When unusual behavior is detected, access must be dynamically adjusted by reducing privileges or quarantining the device to prevent potential threats while the activity is investigated.

Client devices (supplicants) have their own internal RADIUS timers, often defaulting to 5-10 seconds. If ClearPass is configured with a long 20-second timeout for its primary AD source, and that server is unresponsive, ClearPass will wait the full 20 seconds before failing over to a backup source. By that time, the client device has likely already timed out and given up on the connection, resulting in an authentication failure for the user. Standard practice is to keep AD timeouts short (e.g., 3-5 seconds).