topic Re: [Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is in in Network Access Control

[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is invalid

Patrick Tran — Mon, 11 Mar 2019 02:30:51 GMT

Hi,

I got many Cisco AP which are linked to 2 Cisco WLC.

On each WLC, I configured a primary and a secondary RADIUS Server.

RADIUS servers are Cisco ACS 5.2.0.26 (patch 10)

Primary and secondary ACS configurations are synchronized.

There are no problem between primary WLC and Cisco ACS (primary and secondary).

When secondary WLC requests primary Cisco ACS, I get this error "11036 The Message-Authenticator RADIUS attribute is invalid"

Secondary WLC automatically contacts secondary Cisco ACS and it works fine.

Cisco ACS description for this error: "This maybe because of mismatched Shared Secrets."

The two Cisco ACS are synchronized so I should have same error on them...

Why does primary ACS generate this error?

Thanks for your help,

Patrick

Re: [Cisco ACS] 11036 The Message-Authenticator RADIUS attribute

Amjad Abdullah — Sat, 26 Jan 2019 20:03:34 GMT

Patrick: The shared secret mismatch could be from WLC side, not from ACS side.

Make sure that the shared secret of the primary radius server is configured correctly on the secondary WLC.

HTH

Amjad

[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is

Tarik Admani — Tue, 11 Sep 2012 13:10:14 GMT

Amjad,

That is a good observation, shouldnt 7.3 (which recently released) help put these types of issues to rest? I hear that the configuration can now be replicated from one controller to the next in a failover setup.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is

Patrick Tran — Wed, 12 Sep 2012 07:07:01 GMT

Hi Amjad,

Thanks for your help.

It was a shared secret mismatch from WLC side...

Regards,

Patrick

[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is

Amjad Abdullah — Wed, 12 Sep 2012 07:28:08 GMT

Thank you Patrick,

Glad that I could help.

Rating useful replies is more useful than saying "Thank you"

[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is

Amjad Abdullah — Wed, 12 Sep 2012 07:31:54 GMT

Tarik Admani wrote:

Amjad,

Thanks,

Tarik Admani
*Please rate helpful posts*

Yes. That is a good point.

With 7.3 you can use high availability (HA) between two WLCs and you can configure only one WLC (the primary) and all the configuraiotn can be replicated and synched to the other WLC (the secondary).

The two WLCs in the HA must be on same subnet though. Otherwise hot-standby HA between WLCs can't be used.

Rating useful replies is more useful than saying "Thank you"

Re: [Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is in

maruti.hv — Wed, 19 Feb 2025 14:30:55 GMT

its old post but on newer version of 9800 WLC there was similar issue but later it found to be BUG

check below link for more details

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi93213