Smoothwall BYOD - Access Denied : authentication configuration missing

[2097]

Setup so far

 

Meraki Wireless ap - Radius pointing to NPS ( server 2019 ) and Accounting pointing to Smoothwall.

 

This part seems fine , I can see my staff account showup in smoothwall when i connect to the wifi

 

Says the following on smoothwall

 

smoothwall Authentication service Negotiate: DOMAINNAME Logout: address 192.168.0.22 , username DOMAIN\MYACCOUNT, method RADIUS ( I deleted some info there for security )

 

I have used the smoothwall WPAD.pac and assigned it using DHCP ( This has been assigned )

 

But on the client machine it says the following

Access Denied : authentication configuration missing

 

On the smoothwall logs , everytime i try and browse it says

 

Oct 5 09:22:47 smoothwall Web filter No header and no rule match in AuthResponse

 

Unsure what im doing wrong, My BYOD is a different VLAN but the transparent proxy is set to

 

Core Authentication and EveryWhere.

 

Any one able to offer me some advice ?

[ibpalle]

That error is shown when the proxy has no configuration to allow for the source IPs of the client. If you are using locations and define the 'Where' column in your proxy policies, make sure the BYOD subnet is included in your location definitions for the proxy the clients are going through.

[2097]

That error is shown when the proxy has no configuration to allow for the source IPs of the client. If you are using locations and define the 'Where' column in your proxy policies, make sure the BYOD subnet is included in your location definitions for the proxy the clients are going through.

 

Thanks for that , the "where" is currently set to "EveryWhere" .

 

Where is "EVerywhere" defined ? or should that include basically every IP address .

[2097]

Thanks for that , the "where" is currently set to "EveryWhere" .

 

Where is "EVerywhere" defined ? or should that include basically every IP address .

 

Just to note , i added out BYOD "Where" location to the transparent proxy . The BYOD location is a vlan 192.168.18.0/24

 

Does exactly the same thing ?

[2097]

When a user logins i see the following on smoothwall . Which i assume is all correct

 

Oct 5 11:05:10 smoothwall SystemD 5:invoking command 8021x_del_mac (60:F2:42:AB:46:0D,)

Oct 5 11:05:10 smoothwall Authentication service Negotiate: Keytab Logout: address 192.168.18.51, username DOMAIN\teststaff, method RADIUS

Oct 5 11:05:10 smoothwall SystemD 5:invoking command 8021x_del_macip (60:F2:42:AB:46:0D,192.168.18.51,)

Oct 5 11:05:23 smoothwall Authentication service Negotiate: Keytab Login: address 192.168.18.51, username DOMAIN\teststaff, method RADIUS

Oct 5 11:05:23 smoothwall SystemD 5:invoking command 8021x_add_macip (60:F2:42:AB:46:0D,192.168.18.51,)

[ibpalle]

Everywhere as location object includes all IPs so that will work. Could the device be using proxy settings - automatic or static?

 

The login information is correct but not relevant to the issue with missing authentication configuration. Try a quick edit of the transparent proxy and save, then restart the proxy service. Sometimes, when IPs have been changed, proxy configuration needs to be manually updated. A resave and restart of the proxy (or a system reboot) will sort that out.

[2097]

Everywhere as location object includes all IPs so that will work. Could the device be using proxy settings - automatic or static?

 

The login information is correct but not relevant to the issue with missing authentication configuration. Try a quick edit of the transparent proxy and save, then restart the proxy service. Sometimes, when IPs have been changed, proxy configuration needs to be manually updated. A resave and restart of the proxy (or a system reboot) will sort that out.

 

no static or automatic proxy applying ( only the one dished out via the wpad/DHCP)

 

Out of interest , Am i meant to have anything under Authentication > Directorys for radius ?

 

I see you can create a Radius or Radius accounting directory, But i only have AD and AzureAD specified.

[ibpalle]

The RADIUS entries you are seeing are coming from the services - authentication - BYOD section. Smoothwall is acting as RADIUS service for your Wifi setup.