Search the Community

We have NPS configured to send accounting requests to our Sophos XGS for SSO. Recently NPS seems to have stopped sending the accounting data to the XGS, I've ran a packet capture and can see nothing is being forwarded to the XGS. No config changes were made prior to this so not sure why this is happening. I've recreated all policies and re-installed the NPS role but nothing seems to be resolving the issue Has anyone else seen this? Any help is greatly appreciated

We are setting up a new WiFi network at work (a school) that uses an ancient aruba controller (with aruba 105 APs) following the principles of eduroam listed here and the radius server is windows NPS again following the docs here. Initially I copied the existing config we have got for our current wifi to no avail. The current network still works fine but no one can remember the details (and it is not in keeping with the BYOD route we are going down). I have consistently been getting an error message of "authentication failed due to user credentials mismatch" (error 16 Event 6273) which most people have suggested through various forums means that the APs shared secret does not match - I have checked this more than once it does! Additionally I have checked the obvious account user/pass out and again it is correct. In order to try and diagnose the problem further I brought in some of my unifi gear from home and spun up a completely fresh DC/CA/NPS server in a test environment. Same error but this time I have also installed wireshark. If I "accept users without validating credentials" in the CRP then NPS returns a access-accept response, but the client still is unable to connect to the network (client reports dot1X timeout followed by operation was cancelled/server reports success) - this leads me to think it is something wrong client side? Then if I switch the CRP to authenticate on this server (client reports explicit eap failure recieved followed by network is not available/Server sends an string of access-request/challenge immediately before access-reject) presumably this means that it is waiting for correct verification from the client? CRP settings are: Conditions NAS port Type - Wireless Other or 802.11 Username - .+@schooldomain\.org\.uk$ Settings Authentication Provider - Local Computer Manipulation attribute rules - Replace "@schooldomain\.org\.uk$" with "@schooldomain.local" Target - User Name Override Auth - Disabled Network Policy settings are: Conditions NAS Port Type - Wireless User Groups - SchoolDomain\Eduroam Settings EAP Config - Configured (PEAP with secured password EAP-MS-CHAPv2) Ignore Dial-In Properties Grant Access Client is supplied an IP Tunnel Medium 802/Type VLAN/Tunnel-ID 66 Encryption Enabled So I have been battling with this for several weeks now and banging my head against a wall would be more productive... Anyone got any pointers?

Due to various issues we’re having with RADIUS accounting packets, we’re looking around for alternative RADIUS services we could use to replace Microsoft NPS. As well as being able to do the things NPS does for us currently (authenticating users using PEAP/MSCHAPv2 against AD and checking their group memberships before allowing access) we also need to be able to have some semi-intelligent rules around sending RADIUS accounting packets on to our firewall, including things such as * Delaying sending accounting packets to the firewall until the user has a non-APIPA IP address * Transforming accounting STOP packets to INTERIM packets to combat issues arising when roaming between APs Is there any commercial supplier that provides a paid supported virtual appliance (probably with FreeRADIUS or something on it) that has easy configuration options (e.g. web based) that we can just plonk in to our Hyper-V environment and set up how we want? Also just to clarify, this is just for our BYOD SSID, we don’t have/use eduroam so we wouldn’t need eduroam capability.

Hi guys, So after a lot of time spent wrestling with RADIUS at one of my schools we finally have a fairly stable NPS server setup on a win2008r2 box using Aruba Wireless points. There's just ONE thing that's an issue at the moment: If the device (in this example a netbook) goes to sleep/hibernates and tries to connect on waking it gives the messages "Cannot connect to .....". If I leave it for 5 minutes or so and then try to reconnect it's fine. Currently using PEAP/MSCHAPv2. Connection is stable initially and have tested roaming round the school and only get a few drops when pinging a server, mobile devices, iPads etc. all seem to be ok but it's just this 'immediate reconnection' issue that's the problem. Logs in system32\logfiles\ are inconclusive and event viewer doesn't point to anything. Any ideas? EDIT: It appears the problem is a little bigger than previously thought. My clients that have been connected for well over an hour have disconnected and need that few minutes of 'cooling off' before re-establishing connection! Restarting the NPS service doesn't seem to have any affect. Very confusing! Cheers! Chris.

Hi all, we have rolled out the decrypt option on the filtering for the whole network. The school uses Unifi, the domain and intune devices are fine as we can deploy the certificate. But, can we use NPS or similar to push the certificate to guest devices so they can surf??? This is mostly for guest and WPA2 Enterprise using the AD for radius/NPS. Thanks.

Hi, I am currently setting up a Radius BYOD Network for my staff to connect personal devices to and have them Authenticate with AD and account with smoothwall for notification purposes. NPS is currently installed on our DC and working with authentication for laptops, iphones and older generation Android "pre version 11" any android 11 or newer will not connect. When connecting with an iphone or laptop it asks to trust the server certificate and all works, Android 11 or newer flat out refuses to connect. When searching online it looks like we need to install the CA Certificate on the device but nothing has explained how to download the CA cert so we can import this into android. Any help would be greatly appreciated. End Goal is to have personal devices connect to the WiFi and they can login with AD Credentials and get access to the Internet. Thanks in advance. A.

Hi all, Even after reading many articles on similar situations, I am still a little confused... Over the holidays I have configured Network Policy Server role on a Server 2012 R2 machine. Our wireless APs and controller are Ruckus. I want to create 3 SSIDs: 1) is for staff only, authenticated by either Domain Computer or Staff user group in AD - (EAP Protected PEAP) 2) is for students own devices (Ruckus will transfer these devices onto a separate VLAN which will go through a transparent internet proxy) - I need this to be authenticated by a username only (from AD) 3) is for guests ( I dont need to worry about this one for now ) What I am struggling with is the authentication for staff/students. On some devices i.e domain joined machines or Apple iPhones/iPads the devices join fine for either SSID and installs a certificate. However I have some non-domain joined machines that just will not join at all and as soon as I choose either the staff or student SSID from the wireless network list and enter a valid username/password from AD, it just fails to connect. I assume this is an authentication issue. Am I right in thinking that I can use NPS/RADIUS to connect a non-domain computer with just a valid AD Username? Any ideas what might be wrong here? Many thanks!

I have a Server 2008 R2 domain with windows xp sp3 clients. The Server 2008 R2 is a DC, Certificate Authority and NAP Server. I have cisco switches setup correctly to use 802.1x as I used to have a server 2003 domain with IAS and everything was fine. In NPS I have created a wired policy to put clients on to Vlan 2. In group policy, there are wired settings for clients to use PEAP and the Certificate to connect. The clients use machine credential. When I try and connect the client to the network..... I get Authentication Failed and in the Event Viewer on the NPS server I get: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 06/08/2010 21:26:46 Event ID: 6273 Task Category: Network Policy Server Level: Information Keywords: Audit Failure User: N/A Computer: DC2008.ad.londonacademy.org.uk Description: Network Policy Server denied access to a user. Contact the Network Policy Server administrator for more information. User: Security ID: S-1-5-21-1961120552-2230764613-812287295-2925 Account Name: host/DIANAFINANCE.ad.londonacademy.org.uk Account Domain: LONDONACADEMY Fully Qualified Account Name: ad.londonacademy.org.uk/Admin Computers/Admin Desktops/Finance/DIANAFINANCE Client Machine: Security ID: NULL SID Account Name: - Fully Qualified Account Name: - OS-Version: - Called Station Identifier: 00-17-E0-05-90-B2 Calling Station Identifier: 00-1B-78-AE-D5-2E NAS: NAS IPv4 Address: 172.17.1.167 NAS IPv6 Address: - NAS Identifier: - NAS Port-Type: Virtual NAS Port: 60046 RADIUS Client: Client Friendly Name: 0E06-167-3560PS Client IP Address: 172.17.1.167 Authentication Details: Connection Request Policy Name: Use Windows authentication for all users Network Policy Name: Admin_PCs_Vlan2 Authentication Provider: Windows Authentication Server: DC2008.ad.londonacademy.org.uk Authentication Type: PEAP EAP Type: - Account Session Identifier: - Logging Results: Accounting information was written to the local log file. Reason Code: 23 Reason: An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors. Can anyone please help?????

Hi all, I've just gone through the process of installing and configuring OpenVPN for our Network and all is working perfectly. However after a discussion with the Network Manager we decided we really need some kind of protection from poorly maintained systems connecting to the network and possibly bringing all sorts of malware with them. I've looked into ways of doing this with OpenVPN but all I can see is advice RE Post_Auth scripts that could possibly pull AV status from software before allowing the connection. Though the issue with this being I don't know what AV the clients will be running and in all likelihood it will be many different varieties as Staff will be using their own devices. I've looked at using Windows own VPN solutions with Routing and Remote Access though as PPTP is known to be insecure, without implementing PEAP-MS-CHAP-V2 which in turn requires certificates being installed on clients, it's a route I'd rather avoid. Ideally I'd like a solution that could offer the following; - Simple connectivity similiar to OpenVPN (they navigate to our URL and logon) - Ability to interrogate client for status of AV and deny connection if non-compliant - Some sort of EXE staff can take home and run in order to make the necessary connections and system changes for the connection and interrogation above Are there any other out there that people may be aware of? Preferably free and software based. All thoughts are welcome. Thanks, K

Hi All Has anyone setup a NPS network policy with a trusted CA certificate. I'm currently using a self signed cert from my internal CA. The issue is my internal domain and external domain don't match. See below Internal: *.ad.fXXXXXX.hXXXX.sch.uk External: fXXXXXXX.hXXXX.sch.uk Its for a BYOD network using PEAP as the authentication method and MSCHAP-V2 Does anyone have any advise on this. With Android not letting users check the do not validate certificates option its getting more difficult to get users on the BYOD network. Thanks

Hi, We have a Ruckus Controller in school that performs 802.1x authentication to a Windows Server 2008 R2 running NPS for wireless devices. We also have a Lightspeed web filter. If the Lightspeed filter doesn't know who you are it presents a captive portal page for you to login with your AD credentials before you can get out to the Internet. With this in mind, we created a WLAN for 802.1x authentication to our RADIUS server which works great. The problem we had was to then get out to the Internet you had to enter your password in on the captive portal page of Lightspeed. To bypass this we set the accountancy server on the Ruckus controller to point to the Lightspeed filter. In theory this should pass on the user identification and let the user straight out to the Internet rather than being presented with a login page. This isn't the case. I've logged it with both Ruckus and Lightspeed and we're at a junction point where neither are able to commit to changes. The main problem seems to be as a user moves from AP to AP they retain connection, but it seems to send a 'stop' message to the Lightspeed filter when they disassociate with the old AP which then proceeds to log the user out therefore presenting the captive portal login page. Ruckus say that is usual behaviour and Lightspeed said if they receive a 'stop' message then they will log the user out. Is anyone else in the same scenario as us, maybe not with Ruckus but with using Lightspeed as the 'accounting' server? Does anyone have any recommendations on how to bypass this captive portal once users have authentication with the RADIUS server? Please let me know if you require more details. Thanks

Hello Experts, I am having a weird problem regarding NPS Server when I upgraded my vpn servers from server 2008 R2 to Server 2012 R2. Actually in my infrasturcture I have a Windows 2008 R2 based AD and in its domain I have an NPS server joined as member server. This NPS server is based on server 2012 R2, when I upgraded my VPN servers from server 2008 R2 to server 2012 R2 the IKEv2 stops working every other protocols works on windows 7 when I try to connect using IKEv2 it hangs at verifying username and password nad when I tested IKEv2 in Win 8 it says IKE authentication credentials are unacceptable, inspite that my server certificate is valid EKU compatible. When I connected IKEv2 via my other server whose server 2008 R2 based VPN Server The IKEv2 works like a charm without any issues successfully authenticating. The problem seems to be with Server 2012 R2 based RRAS VPN Server.On my both server 2012 VPN and server 2008 R2 VPN servers the NPS server is added in the Radius Authentication. With options of MS-CHAPv2 and EAP selected in authentication options. I try to connect to the VPN server from Windows 8 "13801: IKE authentication credentials are unacceptable." When I try to connect via Win 7 Client the session hangs at verifying username and password. In the event logs I see this error.. after this error the session just hangs at verifying username and password..... http://fud.community.services.support.microsoft.com/Fud/FileDownloadHandler.ashx?fid=ce149a84-52e6-4448-812b-cdb878ac0ad4 Any Ideas...???? When I run the Best Practice Analyzer for Routing and Remote Access Services (RRAS) on the server I received two highlighted warning regarding server certificates. Any clues whats the problem with IKEv2.... http://fud.community.services.support.microsoft.com/Fud/FileDownloadHandler.ashx?fid=b441f8d5-7b44-416b-9d95-22e956350eb2 Please help me in this regards....this problem is driving me nuts...!!! Thanks

Hello, we have been having problems with netbooks logging in. We have a set of 30 netbooks which connects to our Ruckus 7372 APs which have one in each classroom and the classrooms are next to each other this should allow it to roam into different aps. They are connecting using a radius ssid which authenticates the nps server on the domain. The problem we have been having is it take about an half a hour to a hour for them all to login. User profiles are just folder redirection so shouldn't take long for them to login in. I will be staying late one night to have a look at the problem in more detail, just wondering if anyone has had issues the same or anyone could give me some pointers on what i can try to sort the problem. Thanks in advance