topic Re: NAC Guest Server in Network Security

NAC Guest Server

raires73 — Fri, 21 Feb 2020 09:52:46 GMT

I'm unable to authenticate the Guest Client in the RADIUS of NAC Guest Server.

The NAC is configured in the AAA Servers of the Guest SSID, in the WLC4402 and the controller as client in the NAC Guest Srv.

The Allow Override is Enabled.

NAC Guest Server Â» radius.log :

Thu Jan 17 01:10:17 2008 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked

Thu Jan 17 01:10:17 2008 : Info: rlm_sql (sql): Attempting to connect to postgres@localhost:/radius

Thu Jan 17 01:10:17 2008 : Info: Ready to process requests.

Thu Jan 17 01:12:08 2008 : Error: rlm_exec (radius-user-auth): External script failed

Thu Jan 17 01:18:49 2008 : Error: rlm_exec (radius-user-auth): External script failed

Has anyone experienced this issue?

Thanks!

Re: NAC Guest Server

amritpatek — Fri, 01 Feb 2008 20:42:27 GMT

When a guest authenticates against a RADIUS client the RADIUS client uses RADIUS Authentication to ask the Cisco NAC Guest Server whether the user authentication is valid. If the guest authentication is valid, the Cisco NAC Guest Server returns a message stating that the user is valid and the amount of time remaining before the user session expires. The RADIUS client must honor the session-timeout attribute to remove the guest when the guest account time expires. Following link may help you

http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/10/g_radius.html

Re: NAC Guest Server

Dave Anthony David — Mon, 30 Jun 2008 13:34:53 GMT

Have you solve this problem? I'm stuck with this problem too.

Re: NAC Guest Server

pcomeaux — Mon, 07 Jul 2008 20:41:50 GMT

Hi -

What version of the NAC Guest server are you using?

I searched all TAC cases and have the following info to share with you based on your error message.

If it is 1.1.1, you might be running into this bug:

CSCsq86376

With the new locations feature in 1.1.1 of the guest server any customer that has the calling-station-id attribute on their controller set to MAC address will not pass any authentications.

The new locations feature expects the calling-station-id attribute to be set to the IP address.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq86376

thxs

peter

Re: NAC Guest Server

Dave Anthony David — Wed, 09 Jul 2008 05:16:19 GMT

I'm using 1.1.0 and 1.1.1, I already set the calling-station-id attribute to IP address but still i got problem.

Re: NAC Guest Server

alanwoods — Tue, 22 Jul 2008 06:37:46 GMT

I had exactly the same problem.

When the script (its an obfuscated PHP script under /guest/utils) fails, it is because it had not been able to match the username and password.

After a little debugging, it seems that this is caused by the controller setting (Controller/General/Web RADIUS Authentication) which in my case was set to CHAP. After changing it to PAP, the script can then see the password and authentication works.

I hope this helps.