The router sends the initial request, and simply waits for a well-formed answer from the Radius/TACACS server. There is no active "keepalive" style checks, it doesn't ping the server, etc.

What the router does next, depends on your configured criteria. In general, once the timeout expires (default is 5 seconds) or if a malformed response is received, the router will try the secondary server or fail down to the next configured authentication method.

Radius, unlike TACACS, can also mark a server as "dead" and cease to try authentications against it for a preconfigured amount of time.

See the following settings to tweak this behavior:

Timeout Configuration:

TEST-1861(config)#tacacs-server timeout ?
  <1-1000>  Wait time (default 5 seconds)

TEST-1861(config)#radius-server timeout ?
  <1-1000>  Wait time (default 5 seconds)

Radius Dead-timer configuration:

TEST-1861(config)#radius-server deadtime ?
  <1-1440>  time in minutes

TEST-1861(config)#radius-server dead-criteria ?
  time   The time during which no properly formed 
         response must be recieved from the RADIUS server
  tries  The number of times the router must fail 
         to receive a response from the radius server
         to mark it as dead

TEST-1861(config)#radius-server dead-criteria time ?
  <1-120>  Time in seconds during which no response must
  be received from the RADIUS server in order to consider it dead

TEST-1861(config)#radius-server dead-criteria tries ?
  <1-100>  Number of transmits to radius server without 
  responses before marking server as dead

The router sends the initial request, and simply waits for a well-formed answer from the Radius/TACACS server. There are no active "keepalive" style health checks; the router doesn't ping the server and look at response-times or anything like that.

What the router does next, depends on your configured criteria. In general, once the timeout expires (default is 5 seconds), or if a malformed response is received, the router will try the secondary server or fail down to the next configured authentication method.

Radius, unlike TACACS, can also mark a server as "dead" and cease to try authentications against it for a preconfigured amount of time.

See the following settings to tweak this behavior:

Timeout Configuration:

TEST-1861(config)#tacacs-server timeout ?
  <1-1000>  Wait time (default 5 seconds)

TEST-1861(config)#radius-server timeout ?
  <1-1000>  Wait time (default 5 seconds)

Radius Dead-timer configuration:

TEST-1861(config)#radius-server deadtime ?
  <1-1440>  time in minutes

TEST-1861(config)#radius-server dead-criteria ?
  time   The time during which no properly formed 
         response must be recieved from the RADIUS server
  tries  The number of times the router must fail 
         to receive a response from the radius server
         to mark it as dead

TEST-1861(config)#radius-server dead-criteria time ?
  <1-120>  Time in seconds during which no response must
  be received from the RADIUS server in order to consider it dead

TEST-1861(config)#radius-server dead-criteria tries ?
  <1-100>  Number of transmits to radius server without 
  responses before marking server as dead