City WLAN must stay available if one RADIUS server fails, but must not admit users without authentication. Which AAA design best fits?

City WLAN that must remain available if one RADIUS server fails, yet must not admit users without authentication, fits a redundant RADIUS pair for availability without configuring fail-open unrestricted access. High availability for AAA means a second authenticated path, not an emergency open door when the primary becomes unreachable. Civic designs prioritize continuity of authenticated service over convenience bypasses that attackers can force by disrupting reachability to AAA infrastructure. Pointing APs at a single RADIUS and disabling timeouts so clients wait forever silently preserves a false sense of security while harming usability and providing no true redundancy. Failing open to an open SSID whenever RADIUS is unreachable admits anyone during the exact window an adversary may create with a denial-of-service against AAA. Caching one global PSK on every AP as the HA strategy for Enterprise mode abandons Enterprise identity under the label of resilience. Exam caveat: test failover under realistic load—secondary servers that exist only on paper often lack capacity, certificates, or identical authorization policy sets when the primary actually fails. Operational check: shut down the primary RADIUS in a maintenance window, confirm clients still authenticate via the secondary, verify no guest-open fail-open occurs, and restore primary while watching accounting continuity and alert hygiene.