topic Re: Firmware MN 14.33 causing wireless Radius authentication issue. in Cloud Networking Platform

Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Mon, 14 Mar 2022 18:57:20 GMT

Last week meraki updated the firmware on our MS225 switches, since then our MS42 wireless AP radius SSID is not working at all of our 4 sites. I enabled WPA2 wireless which works and guest works, I can test the radius SSID and it passes. but when connecting a PC they can't connect and event log shows

802.11 disassociation

unspecified reason

Whats weird is I see an iphone and an ipad connected but any pc i've tried to connect fails. Anyone else seeing this issue?

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

aleabrahao — Mon, 14 Mar 2022 19:06:39 GMT

Do you have tried to perform a Radius test on this SSID? Just to check de communication.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Mon, 14 Mar 2022 19:09:22 GMT

Yes testing is successful.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Philip D'Ath — Mon, 14 Mar 2022 19:56:03 GMT

I think this issue is highly unlikely to be related to the switch firmware. It may be that a reboot of the switches caused a reboot of the access points, and something around that has caused an issue.

Does the PC WiFI settings for the SSID match what is configured with the RADIUS server? For example, PEAP+MSCHAPv2 ?

I'm guessing these settings don't match.

Does the RADIUS server say it is allowing the connection? If not, why not?

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

BlakeRichardson — Mon, 14 Mar 2022 21:39:08 GMT

Have the PC's had any windows updates during that time?

What firmware version did you update to?

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Tue, 15 Mar 2022 12:21:37 GMT

Sorry, was an accident clicking as a solution, The problem started after the firmware upgrade, and is happening at 4 different sites, you don't configure PC wifi for Radius you just log in with windows creds.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Tue, 15 Mar 2022 12:26:12 GMT

Has nothing to do with the PC's, and the firmware is in the title of the post, slightly misspelled it's MS 14.33. I have a case open with meraki. Have updated firmware on the AP and rebooted the AP a few times, it worked fine since configuring radius authentication for wireless until the firmware upgrade.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

aleabrahao — Tue, 15 Mar 2022 12:31:45 GMT

@Nickj3234, It doesn't make sense, I have upgraded my networks to the same version and It works fine. Can you share your SSID configuration?

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Tue, 15 Mar 2022 12:51:26 GMT

Network access is set to My Radius Server

WPA encryption mode set to WPA2 only

802.11r and 802.11w disabled

no splash page

Defaults for all the timeouts and retries

RADIUS testing - disabled
RADIUS CoA support - disabled
RADIUS attribute specifying group policy name - Filter ID
RADIUS accounting - disabled
RADIUS proxy - do not use meraki proxy
Assign group policies by device type - disbled

Bridged mode: make clients part of the Lan

VLAN tagging - Don't use vlan tagging
RADIUS override - ignore vlan attribute in radius responses
Content filtering - don't filter content
Bonjour forwarding - disable
Mandatory DHCP - disable

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

aleabrahao — Tue, 15 Mar 2022 13:02:40 GMT

What is the Minimum bitrate applied in your RF profile? Have you tried to configure your connection manually?

https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_Clients_for_802.1X_and_Meraki_Authentication

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Tue, 15 Mar 2022 13:18:15 GMT

Bit rate is set to 11 for Radius, for Guest and the wpa2 it is 18. Haven't tried manual connection, not in the office today, will try it tomorrow.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Philip D'Ath — Tue, 15 Mar 2022 17:52:23 GMT

>you don't configure PC wifi for Radius you just log in with windows creds.

That means you are using the default configuration of PEAP+MSCHAPv2. Have you checked your PEAP certificate on your RADIUS server? Maybe it has expired.

Did you maybe manually load in the IP addresses as RADIUS clients (instead of loading in subnets), while the APs were set to DHCP, the switch upgrade happened, the APs rebooted, got new IP addresses, and now don't match the RADIUS client IP addresses configured?

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

aleabrahao — Tue, 15 Mar 2022 18:00:01 GMT

@Philip D'Ath , I don't think that's the case, because it works well on mobile devices. I recommended that he perform a manual configuration.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

aleabrahao — Tue, 15 Mar 2022 18:20:43 GMT

🙂

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Wed, 16 Mar 2022 13:37:16 GMT

Tried the manual connection and I was able to connect, thanks for the tip. It will be a pain to do this for all the users though, but I have something I can go back to the meraki tech with working my case.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

aleabrahao — Wed, 16 Mar 2022 14:09:13 GMT

Are you using Windows systems? Are your machines integrated into a domain? If yes, you can create a GPO in your Active Directory to add the connection.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Wed, 16 Mar 2022 14:11:59 GMT

Thanks, I'll look into that.

Re: Firmware MN 14.33 causing wireless Radius authentication issue.

Nickj3234 — Mon, 04 Apr 2022 19:35:47 GMT

So turned out was never an issue with the switch firmware updates, it was the NPS certificate expired, coincidentally expired the same day meraki did the firmware updates so they got the blame. Weird that testing the radius server still passed with the expired cert. Anyway thought I'd fess up it was my fault all along.