Search the Community

Hi folks, Bit of an unusla one here. On Monday we sudenly started getting issues with devices on our RADIUS authenticated network dropping off and failing to reconnect. Error logged on the Aruba controller indicates the server isnt responding. Checking the NPS config on our DC indicates all is well with the service and config. Weird bit is some clients seem to connect and are happy, and others just drop and wont reconnect. On Tuesday the issue seemed to resolve itself beofre I could get to the bottom of it. Today the problem has re-appeared. After an hour of faffing and fielding the neverending stream of calls (🤪) I disabled Sophos on the server. This has brought everything back to life. Before I log this with Sophos support throught I'd run this by her eto see if anyone else has experienced this, and what if any was the eventual solution. As ever any replies / comments greatfully received 😉 Cheers --Keith--

Hello, Have created a security group in AD which holds staff laptops (as computer objects not usernames) and this group has been added to Smoothwall under groups so it can be used for BYOD Radius. The issue is that When I try to connect to the wireless network the wireless controller giving the following message AAA Authentication Failure for UserName:host/LAPTOP.DOMAIN.LOCAL User Type: WLAN USER Is it possible to configure Smoothwall to authenticate wireless clients as device instead of username?

We are setting up a new WiFi network at work (a school) that uses an ancient aruba controller (with aruba 105 APs) following the principles of eduroam listed here and the radius server is windows NPS again following the docs here. Initially I copied the existing config we have got for our current wifi to no avail. The current network still works fine but no one can remember the details (and it is not in keeping with the BYOD route we are going down). I have consistently been getting an error message of "authentication failed due to user credentials mismatch" (error 16 Event 6273) which most people have suggested through various forums means that the APs shared secret does not match - I have checked this more than once it does! Additionally I have checked the obvious account user/pass out and again it is correct. In order to try and diagnose the problem further I brought in some of my unifi gear from home and spun up a completely fresh DC/CA/NPS server in a test environment. Same error but this time I have also installed wireshark. If I "accept users without validating credentials" in the CRP then NPS returns a access-accept response, but the client still is unable to connect to the network (client reports dot1X timeout followed by operation was cancelled/server reports success) - this leads me to think it is something wrong client side? Then if I switch the CRP to authenticate on this server (client reports explicit eap failure recieved followed by network is not available/Server sends an string of access-request/challenge immediately before access-reject) presumably this means that it is waiting for correct verification from the client? CRP settings are: Conditions NAS port Type - Wireless Other or 802.11 Username - .+@schooldomain\.org\.uk$ Settings Authentication Provider - Local Computer Manipulation attribute rules - Replace "@schooldomain\.org\.uk$" with "@schooldomain.local" Target - User Name Override Auth - Disabled Network Policy settings are: Conditions NAS Port Type - Wireless User Groups - SchoolDomain\Eduroam Settings EAP Config - Configured (PEAP with secured password EAP-MS-CHAPv2) Ignore Dial-In Properties Grant Access Client is supplied an IP Tunnel Medium 802/Type VLAN/Tunnel-ID 66 Encryption Enabled So I have been battling with this for several weeks now and banging my head against a wall would be more productive... Anyone got any pointers?

Due to various issues we’re having with RADIUS accounting packets, we’re looking around for alternative RADIUS services we could use to replace Microsoft NPS. As well as being able to do the things NPS does for us currently (authenticating users using PEAP/MSCHAPv2 against AD and checking their group memberships before allowing access) we also need to be able to have some semi-intelligent rules around sending RADIUS accounting packets on to our firewall, including things such as * Delaying sending accounting packets to the firewall until the user has a non-APIPA IP address * Transforming accounting STOP packets to INTERIM packets to combat issues arising when roaming between APs Is there any commercial supplier that provides a paid supported virtual appliance (probably with FreeRADIUS or something on it) that has easy configuration options (e.g. web based) that we can just plonk in to our Hyper-V environment and set up how we want? Also just to clarify, this is just for our BYOD SSID, we don’t have/use eduroam so we wouldn’t need eduroam capability.

Hi, We have setup a radius server on Windows 2008 r2 and smoothwall express 3.0 we want to use radius auth on smooth wall and so set that up. How ever when we try and go thru smoothwall it challenges us for the username and password as it is meant to do but then it keeps on challenging us time and time again and then denies access to smoothwall. It as if the user name and password are in correct, however when we set up a radius test on our ruckus controller(it has a radius test feature) it works. Is there something we are missing to do? Is smoothwall express and win2008r2 not happy together? Do we need to MOD smoothwall in another way? Thanks in advance Stuart

Greeting everyone. I succesfully implement a test EPA/TLS wifi connexion with a winxpsp2 computer and certificates generated with openCA. However, the connexion will not occurs before the Domain Logon since the certificat reside only in the user profile. I tried to move the certificate in the computer container, but Windows refuse to see/use it. I tried the change the Authmode registry key without success. I beleive that Windows refuse to use the certificate because it does not originates from it's AD (I don't do AD). I want to know if it is possible to force Windows to use a certificate for WPA connexion before the Domain logon? Dany Chouinard C.S. Or-et-des-Bois Val-d'Or,Qc,Canada

Hi guys, So after a lot of time spent wrestling with RADIUS at one of my schools we finally have a fairly stable NPS server setup on a win2008r2 box using Aruba Wireless points. There's just ONE thing that's an issue at the moment: If the device (in this example a netbook) goes to sleep/hibernates and tries to connect on waking it gives the messages "Cannot connect to .....". If I leave it for 5 minutes or so and then try to reconnect it's fine. Currently using PEAP/MSCHAPv2. Connection is stable initially and have tested roaming round the school and only get a few drops when pinging a server, mobile devices, iPads etc. all seem to be ok but it's just this 'immediate reconnection' issue that's the problem. Logs in system32\logfiles\ are inconclusive and event viewer doesn't point to anything. Any ideas? EDIT: It appears the problem is a little bigger than previously thought. My clients that have been connected for well over an hour have disconnected and need that few minutes of 'cooling off' before re-establishing connection! Restarting the NPS service doesn't seem to have any affect. Very confusing! Cheers! Chris.

We have an Alcatel Mobility Switch based WLAN with Captive Portal BYOD authentication via LDAP, and RADIUS AAA to our NPS server. Users logged on to domain-joined PCs and through the captive portal on the BYOD network are identified correctly (Username associated with IP address of device). This information is not passed to our Smoothwall filter (Username is IP address of client), which is causing problems with filtering and monitoring. The NPS server is a RADIUS client of the Smoothwall, and also authenticates users via LDAP to the same DC as on the Wireless network. Do I need to put a direct link (RADIUS client / supplicant) between the WLAN controller and the Smoothwall for the Accounting information to be recognised on the Smoothwall? If so, which is the supplicant? If not, where else could this configuration be incorrect?

Hello, I've been aware but have never used 802.1x for wired connections (or wireless for that matter) does anyone have a beginners guide? Can I configure this whilst using the system (any down time?) I have found people plugging in their own equipment into my network and I need to control it. I have a vanilla AD environment, do I need something called IAS? Cheers

Hi Gang, I have a IAS config question. I have setup radius auth for wifi clients running over ruckus gear and it works all well. The config i followed was the "ashbys IAS" doc thats floating around here. Ill admit Radius-auth isnt my strngest suit so please bear with me. What i have is a WLAN that requires radius auth -- this required me to create a server certificate (from local CA) which clients then installed automatically. Clients then had to change EAP type to PEAP, select the CA cert to validate and hey-ho connection. On the radius server i setup the RAP to enable "domain computers" OR "domain users". Fantastic. Now i have students joining this WLAN with their Ipods/iphones/Mac's in general because when they authenticate against the WLAN it shows up "certificate not trusted" which they can accept and again hey-ho. Connection. Obviously i have setup the wifi auth incorrectly, or expecting the wrong result. What id like to do is to restrict access to this WLAN to computers and any user logged into that computer that are part of the domain. Opposed to "domain users" as it is now apparent to me this will include any device that passes correct AD credentals. Can any one shed some light or point to a more relevant auth scheme? Thanks in advance

Hi, I am currently setting up a Radius BYOD Network for my staff to connect personal devices to and have them Authenticate with AD and account with smoothwall for notification purposes. NPS is currently installed on our DC and working with authentication for laptops, iphones and older generation Android "pre version 11" any android 11 or newer will not connect. When connecting with an iphone or laptop it asks to trust the server certificate and all works, Android 11 or newer flat out refuses to connect. When searching online it looks like we need to install the CA Certificate on the device but nothing has explained how to download the CA cert so we can import this into android. Any help would be greatly appreciated. End Goal is to have personal devices connect to the WiFi and they can login with AD Credentials and get access to the Internet. Thanks in advance. A.

We have NPS configured to send accounting requests to our Sophos XGS for SSO. Recently NPS seems to have stopped sending the accounting data to the XGS, I've ran a packet capture and can see nothing is being forwarded to the XGS. No config changes were made prior to this so not sure why this is happening. I've recreated all policies and re-installed the NPS role but nothing seems to be resolving the issue Has anyone else seen this? Any help is greatly appreciated

Hi all, Even after reading many articles on similar situations, I am still a little confused... Over the holidays I have configured Network Policy Server role on a Server 2012 R2 machine. Our wireless APs and controller are Ruckus. I want to create 3 SSIDs: 1) is for staff only, authenticated by either Domain Computer or Staff user group in AD - (EAP Protected PEAP) 2) is for students own devices (Ruckus will transfer these devices onto a separate VLAN which will go through a transparent internet proxy) - I need this to be authenticated by a username only (from AD) 3) is for guests ( I dont need to worry about this one for now ) What I am struggling with is the authentication for staff/students. On some devices i.e domain joined machines or Apple iPhones/iPads the devices join fine for either SSID and installs a certificate. However I have some non-domain joined machines that just will not join at all and as soon as I choose either the staff or student SSID from the wireless network list and enter a valid username/password from AD, it just fails to connect. I assume this is an authentication issue. Am I right in thinking that I can use NPS/RADIUS to connect a non-domain computer with just a valid AD Username? Any ideas what might be wrong here? Many thanks!

I have a Server 2008 R2 domain with windows xp sp3 clients. The Server 2008 R2 is a DC, Certificate Authority and NAP Server. I have cisco switches setup correctly to use 802.1x as I used to have a server 2003 domain with IAS and everything was fine. In NPS I have created a wired policy to put clients on to Vlan 2. In group policy, there are wired settings for clients to use PEAP and the Certificate to connect. The clients use machine credential. When I try and connect the client to the network..... I get Authentication Failed and in the Event Viewer on the NPS server I get: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 06/08/2010 21:26:46 Event ID: 6273 Task Category: Network Policy Server Level: Information Keywords: Audit Failure User: N/A Computer: DC2008.ad.londonacademy.org.uk Description: Network Policy Server denied access to a user. Contact the Network Policy Server administrator for more information. User: Security ID: S-1-5-21-1961120552-2230764613-812287295-2925 Account Name: host/DIANAFINANCE.ad.londonacademy.org.uk Account Domain: LONDONACADEMY Fully Qualified Account Name: ad.londonacademy.org.uk/Admin Computers/Admin Desktops/Finance/DIANAFINANCE Client Machine: Security ID: NULL SID Account Name: - Fully Qualified Account Name: - OS-Version: - Called Station Identifier: 00-17-E0-05-90-B2 Calling Station Identifier: 00-1B-78-AE-D5-2E NAS: NAS IPv4 Address: 172.17.1.167 NAS IPv6 Address: - NAS Identifier: - NAS Port-Type: Virtual NAS Port: 60046 RADIUS Client: Client Friendly Name: 0E06-167-3560PS Client IP Address: 172.17.1.167 Authentication Details: Connection Request Policy Name: Use Windows authentication for all users Network Policy Name: Admin_PCs_Vlan2 Authentication Provider: Windows Authentication Server: DC2008.ad.londonacademy.org.uk Authentication Type: PEAP EAP Type: - Account Session Identifier: - Logging Results: Accounting information was written to the local log file. Reason Code: 23 Reason: An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors. Can anyone please help?????

EduGeeks. As a designer and implentation engineer for networks across numerious Education sites I am often asked to implement more secure (or just simple) methods of VLAN assignments. (Especially as converged wireless solutions become more and more prevelant). I have now standardised on a 2003 IAS / AD solution that uses the clients AD login as the primary method to determin which VLAN to assign the port to. (The solution obviously can also assign guest access, MAC address assignment for VLAN etc as well as QoS assignment based on login). My question however is this. From your considerable EduGeek experience would this be "your" prefered method of VLAN assignment/Security or do you think there is a better way / angle I should approach this from. Fingers on buzzers and thanks for your input !

I am trying to get radius authentication setup on some new AP's that I'm going to deploy that will host both Staff and Open Guest Wireless. I have 8 of the EnGenius EAP350s They are Setup to do WPA2-Enterprise Radius Server Points to the IAS/Primary Domain Controller Which is a windows 2000 Server Shared Secret Matches the one Set for the Client in IAS IAS Remote Access Policy Setup as follows Conditions: Windows Group Matches - Domain\WirelessUsers AND NAS-Port Type Matches "Wireless - IEEE 802.11 or Wireless-Other" Grant Remote Access Permission Profile: Dial In Restricted to Media Wireless- IEEE 802.11 and Wireless-Other Encryption: Strongest Authentication: PEAP - Certificate is Set to the Domain Controllers Certificate (number of Retries =2 And allow client to change password after expired is checked) I did delete the Frame-Protocol PPP under Advanced. User Account I am testing with is in the WirelessUsers Group and the user is allowed to Dial in to the server. I can connect if I manually make a wifi profile on windows 7 and change the to User Authentication and also disable Validate the Server Certificate. Both of those settings are required for it to work. I am pushing the Domain controllers certificate out from group policy under Computer Configuration->Windows Settings->Security Settings->Public Key Pollicies->Trusted Root Certification Authority I also see this certificate under the wifi profile where it says Trusted Root Certification Authority on windows 7. I would like it to automatically do user authentication and have the certificate either trusted or just have the pop-up (on non domain computer) that say connect or terminate because it could not be validated. However if I try the connection Automatically it says; Failed because of user user account (or something like that) Here are the logs from my AP if I do an automatic connection (this is windows doing Multiple attempts I assume) May 24 15:07:01 EAP350 daemon.warn hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) May 24 15:07:01 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: disassociated May 24 15:07:01 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated May 24 15:06:57 EAP350 daemon.warn hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) May 24 15:06:57 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: disassociated May 24 15:06:57 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated May 24 15:06:53 EAP350 daemon.warn hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) May 24 15:06:53 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: disassociated May 24 15:06:53 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated May 24 15:06:49 EAP350 daemon.warn hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) May 24 15:06:49 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: disassociated May 24 15:06:49 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: disassociated May 24 15:06:49 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated May 24 15:06:48 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: disassociated May 24 15:06:48 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated May 24 15:06:35 EAP350 daemon.warn hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: could not extract EAP-Message from RADIUS message May 24 15:06:35 EAP350 daemon.warn hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: authentication failed - EAP type: 0 (Unknown) May 24 15:06:35 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: Supplicant used different EAP type: 1 (Identity) May 24 15:06:35 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated This is what a Successful Manual connection looks like: May 24 15:41:19 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 WPA: pairwise key handshake completed (RSN) May 24 15:41:19 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.1X: authenticated - EAP type: 25 (PEAP) May 24 15:41:19 EAP350 daemon.info hostapd: ath0: STA 8c:70:5a:6f:1e:74 IEEE 802.11: associated Any Ideas would be appreciated. I would like it to work automatically with single-signon obviously pushing wifi setting through GP is not an option on windows 2000 server. But I would also like a prompt to come up for username and password when non-domain machine connect so I can enter Domain\user and password. I tried this with a DDWRT based router (in AP only mode) to make sure it was not just the APs and I get the same results. I had this working at a previous Job in a with previous job and windows 2003/2008 domain environment with Aruba APs. Thanks, Jason

We use wpa2 enterprise and radius authentication for our staff wireless network. Whenever we connect a laptop to this network, we get a message from Windows saying: "Continue connecting? If you expect to find *our ssid* in this location, go ahead and connect. Otherwise, it may be a different network with the same name. Show certificate details" and then it gives the option to Connect or Cancel. We have a third party signed cert. Is there some way to push out this cert with Active Directory so that the laptops automatically trust this network? I have tried all kinds of things with no luck. Thanks!