Auto Logout (Duplicate Login Prevention)¶
By default, a RADIUS account with its concurrent-device limit set to 1 simply rejects a second login attempt — the user is stuck with a login error until the original session expires on its own (idle timeout or validity period), even if they switched devices, moved to a different access point, or their old session is otherwise no longer in real use.
Auto Logout solves this by evicting the account's existing session automatically instead of just rejecting the new login, so a genuine duplicate login self-heals rather than locking the user out. Two independent configuration options are available, depending on your deployment:
| Option | Scope | Mechanism |
|---|---|---|
| Local Hotspot Configuration | A single HSA/HSG, across all of its hotspot instances | client-single CLI setting |
| Central RADIUS CoA | Every HSA/HSG sharing one central RADIUS server | RADIUS Change-of-Authorization (CoA) |
Use Cases¶
| Scenario | Why Auto Logout matters |
|---|---|
| Single device, same router | A guest's device disconnects (Wi-Fi off, out of range) and reconnects before the old session times out — without Auto Logout, the reconnect is rejected as a duplicate login. |
| Device switch, same router | A user logs in from a phone, then later from a laptop on the same router — the account should follow the user, not stay pinned to the first device. |
| Roaming between routers | A user already logged in at one HSA/HSG tries to log in at a different HSA/HSG sharing the same central RADIUS (e.g., moving between buildings or sites) — only the Central RADIUS CoA option covers this case. |
| Shared/kiosk accounts | An account used by multiple people in turn (e.g., a front-desk login) should always let the latest login take over, not queue behind a stale session. |
Option 1: Local Hotspot Configuration¶
Enable client-single on each hotspot instance of the HSA/HSG. When a login request comes in, the device's own stale session — on any hotspot instance on that router, not just the one it's connecting through — is logged out first, then the new login proceeds immediately. No reject-then-retry: the first attempt succeeds.
Note
This option only covers sessions on the same router. If the account's existing session is on a different HSA/HSG, use Option 2: Central RADIUS CoA instead.
Requirements¶
| Requirement | Detail |
|---|---|
| Scope | Local only — the HSG or HSA must be the router actually running the hotspot instance(s). |
| Access profile | No. of concurrent device set to 1 (HOTSPOT USERS → Access Profile). |
CLI Configuration¶
Enable hotspot-client-single under each hotspot instance that should auto-logout duplicate sessions:
hotspot-client-single— kicks the device's own existing session (by MAC address) across every hotspot instance on this router before processing its next login.no hotspot-client-single— disables the behavior for that instance.
Enabling it on one instance only protects logins arriving through that instance; enable it on every instance where duplicate-login self-healing is needed.
Verification¶
| Items to Test | Action | Expected Outcome |
|---|---|---|
| Same device, same router | Log in, disconnect Wi-Fi, reconnect and log in again before the session times out | Login succeeds immediately — no "already logged in" error. |
| Different device, same router | Log in from Device A, then log in with the same account from Device B on the same router | Device A is logged out; Device B's login succeeds immediately. |
| Session confirms as closed | Check HOTSPOT USERS → User Sessions → Online Sessions after a switch | Device A no longer appears; only the new device's session is listed. |
Troubleshooting¶
| Symptom | Likely Cause | Solution |
|---|---|---|
| Login still rejected as duplicate | hotspot-client-single not enabled on the instance the new login is using |
Run show running-config and confirm hotspot-client-single appears under that security hotspot <iface> block. |
| Works on one instance but not another | Setting is per-instance, not global | Enable hotspot-client-single on every hotspot instance on the router. |
| Still rejected when the other session is on a different router | Local Hotspot Configuration doesn't cover other routers | Use Option 2: Central RADIUS CoA for cross-router cases. |
Option 2: Central RADIUS CoA¶
For deployments where multiple HSA/HSGs share one central RADIUS server, enable the RADIUS CoA relay on each remote HSA/HSG. When a login is rejected for exceeding the concurrent-device limit, the central RADIUS server sends a signed Disconnect-Request to the HSA/HSG currently holding the account's session, evicting it automatically.
This is a reject-then-retry design: the login attempt that triggers the eviction is still rejected (showing "exceeded simultaneous use"). The account's next login attempt succeeds once the old session has actually closed.
Note
Unlike client-single, this works across different physical routers — the defining use case is a user already logged in at HSA1 trying to log in at HSA2, both sharing the same central RADIUS.
Prerequisites¶
| Requirement | Detail |
|---|---|
| Access profile | No. of concurrent device set to 1 (HOTSPOT USERS → Access Profile). |
| Firewall / reachability | The central RADIUS server must be able to reach each remote HSA/HSG directly on UDP/3799 (IANA radius-dynauth). This is the opposite direction from normal RADIUS traffic (router → RADIUS), so it will not work behind carrier-grade NAT or an unconfigured WAN NAT with no inbound path. |
CLI Configuration¶
On each HSA/HSG that will receive CoA Disconnect-Requests:
port <port> source <ip>— sets the CoA listening port (default3799) and restricts the firewall opening to the trusted central RADIUS server's IP. Addsource2 <ip>for an HA pair.start— opens firewall access and starts the CoA relay process.
Verify the relay is running:
No CLI configuration is required on the central RADIUS server itself — the eviction trigger is built into the RADIUS service.
Verification¶
| Items to Test | Action | Expected Outcome |
|---|---|---|
| Relay running | show security radius-coa on the remote HSA/HSG |
Shows the CoA relay as running on the configured port. |
| First attempt rejected | Log in at HSA1, then attempt to log in with the same account at HSA2 | Login fails, showing an "exceeded simultaneous use" error. |
| Session evicted | Check HOTSPOT USERS → User Sessions → Online Sessions on HSA1 shortly after the failed attempt at HSA2 | The HSA1 session is closed. |
| Second attempt succeeds | Retry the same login at HSA2 | Login succeeds. |
Troubleshooting¶
| Symptom | Likely Cause | Solution |
|---|---|---|
| Every retry keeps failing, never succeeds | UDP/3799 not reachable from the central RADIUS server to this HSA/HSG | Confirm show security radius-coa shows the relay running, and that no upstream firewall/NAT blocks inbound UDP/3799 to this router. |
| First attempt succeeds instead of failing | No. of concurrent device is not set to 1 on the access profile |
Set the limit to 1 in HOTSPOT USERS → Access Profile. |
| Works between some HSA/HSGs but not others | CoA relay not configured on the HSA/HSG actually holding the stale session | Enable security radius-coa → port ... source ... → start on every HSA/HSG sharing the central RADIUS, not just the one being logged into. |
| Session evicted but login still rejected on the first new attempt | Expected behavior — eviction happens after the reject, not before | Retry once; the second attempt succeeds once the old session has closed. |
Choosing Between the Two Options¶
| Local Hotspot Configuration | Central RADIUS CoA | |
|---|---|---|
| Covers same-router duplicate login | Yes | Yes |
| Covers cross-router duplicate login | No | Yes |
| Reject-then-retry required | No — first attempt succeeds | Yes — first attempt still rejected |
| Configuration location | Each hotspot instance | Each remote HSA/HSG (relay) |
| Network requirement | None | Inbound UDP/3799 from central RADIUS |
Both options can be enabled together: client-single resolves same-router duplicates instantly, while Central RADIUS CoA handles the cross-router case as a fallback.
Related Features¶
- Hotspot Instance Configuration — Per-instance DHCP, portal, and access settings, including
client-single - Hotspot Roaming — Seamless multi-VLAN roaming under a single portal (a different problem: avoiding re-login entirely, rather than recovering from a duplicate login)
- Sample Hotspot Deployment — Base hotspot instance setup this case builds on