topic Re: Invalid Message Authenticator in EAP Request in Wireless

Invalid Message Authenticator in EAP Request

lmslattery — Sat, 03 Jul 2021 22:05:36 GMT

Hi,

I am attemping to configure Infratructure authentication for WDS and WPA/PEAP Client authentication using ACS 4.1(1) Build 23 from an Aironet 1210 running IOS 12.3(8)JEC.

I have a production ACS server that has both LEAP and PEAP enabled under the global configuration options.

The access point has been correctly defined as a NAS using RADIUS-Aironet on the ACS server. The Access point has ACS defined as a RADIUS server and the shared secret set the same as the NAS definition within ACS.

For both WDS Infrastructure authentications(LEAP) and client authentication requests to the access point using PEAP I receive the following message in the ACS failed log:

"Invalid message authenticator in EAP request"

A search on CCO tells me that this is normally the result of a shared secret mismatch. I have however retyped the shared secret several times , and tested with simple strings such as "cisco" and the same result is received. Both the Radius definition on the AP and the NAS definition on ACS have bee re-created with no change in result.

As a test I ran up a clean install of ACS 4.1(1)23 in a VMware session. Configured a NAS object for the AP as I had previously done on the production system and it worked first go.

Would anyone have any clues on what could be wrong with my production ACS. ?

Many Thanks,

Leon

Re: Invalid Message Authenticator in EAP Request

irisrios — Tue, 18 Dec 2007 21:34:48 GMT

VMaware would work only if the client adaptor works successfully. I could guess no reason other than wrong key between AP and ACS that could have caused this issue. Nothing specific about the error.

Re: Invalid Message Authenticator in EAP Request

jcoke — Wed, 26 Dec 2007 23:35:19 GMT

I'm having this exact issue and have performed all the steps you have. Have you gotten anywhere with it?

Re: Invalid Message Authenticator in EAP Request

lmslattery — Thu, 27 Dec 2007 22:11:53 GMT

I ended up performing a clean install of ACS on another server to get around it.

I still have no idea what the root cause was.

Re: Invalid Message Authenticator in EAP Request

Scott Fella — Fri, 28 Dec 2007 02:12:20 GMT

One issue could of been a bad shared secret between the WLC and the ACS.... you would get the same error message that you did.

Re: Invalid Message Authenticator in EAP Request

jcoke — Fri, 28 Dec 2007 03:25:10 GMT

Not the issue. Like the OP I have reset it numerous times using copy/paste.

Re: Invalid Message Authenticator in EAP Request

Scott Fella — Fri, 28 Dec 2007 03:27:42 GMT

To be honest.... the cut and paste is the issue. we had to manually type out the shared secret for it to work. This was on the 4.1 code. Type it out on boththe ACS and WLC.

Re: Invalid Message Authenticator in EAP Request

jcoke — Fri, 28 Dec 2007 03:29:36 GMT

Yeah, I've manually typed "secret" in the thing as well.

Re: Invalid Message Authenticator in EAP Request

Scott Fella — Fri, 28 Dec 2007 03:31:33 GMT

Are you using symbols? try setting the shared secret as something simple like testtest on both and see if that works. If not then it has to be a configuration on the ACS.

Re: Invalid Message Authenticator in EAP Request

jcoke — Fri, 28 Dec 2007 03:34:19 GMT

Nope, I got to the point of bargaining with the things. Using secrets like "please" and "iwillgiveyou100dollarstowork" Well, maybe not the last one. 🙂

Re: Invalid Message Authenticator in EAP Request

Scott Fella — Fri, 28 Dec 2007 03:45:10 GMT

I would think that it would be a configuration on the ACS server then. Are you using autonomous or LWAP?

Here is a simple config setup tha might help..

http://cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00801df0e4.shtml

Re: Invalid Message Authenticator in EAP Request

jcoke — Fri, 28 Dec 2007 03:49:56 GMT

LWAP on 4402s (v4.2) and ACS 4.1 I saw that and this article.

PEAP under Unified Wireless Networks with ACS 4.0 and Windows 2003

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00807917aa.shtml

I'm going to set up a new ACS tomorrow and see if that works. Thanks for the advice.

Re: Invalid Message Authenticator in EAP Request

jcoke — Fri, 04 Jan 2008 23:15:12 GMT

I got this resolved today and thought I would pass the workaround along. We opened a TAC case on the WLC and the engineer first suggested that we check the shared secret. Since I'd reset it so many times in so many ways my head almost exploded 🙂 She also mentioned this:

"We also sometimes see 'strange issues' in ACS if the device is part of a device-group, so if you would remove the WLC from any device group, put it in by itself (not in a group), be sure Aironet or Airespace is chosen for the device-type, & recycle the ACS services.

This turned out to be the solu^H^H^H^Hworkaround. Not sure yet if its in the pipeline to be fixed in ACS. FYI the case number is 607634169.

Re: Invalid Message Authenticator in EAP Request

Scott Fella — Fri, 04 Jan 2008 23:56:25 GMT

That is what I mentioned earlier. rule of thumb is to restart ACS when making major changes. Always worked for me.

Re: Invalid Message Authenticator in EAP Request

jcoke — Sat, 05 Jan 2008 00:02:06 GMT

I don't see where you mentioned about the device groups. The strange part is that another WLC was authing with no problem. Very odd.

Re: Invalid Message Authenticator in EAP Request

lmslattery — Sat, 05 Jan 2008 00:09:30 GMT

Thinking about it. The ACS I was originally having problem with was also setup for "Device Groups".

Even though I was having this issue with Autonomous AP's rather than WLC's I'd say our problems are related.

Re: Invalid Message Authenticator in EAP Request

Scott Fella — Sat, 05 Jan 2008 00:22:42 GMT

Device group doesn't have to be configured if you don't want to. One working and the other not is not very strange for some odd reason. At leats you got it to work.

Re: Invalid Message Authenticator in EAP Request

apishko — Fri, 01 Feb 2008 13:26:29 GMT

Just want to thank all for this post. Hae just brought up a new 4.1 install and have been fighting with EAP-FAST authentication off an on for the past day or so (should know by now to look here first). Anyway, I removed the WLC from a device group and it started working.

Re: Invalid Message Authenticator in EAP Request

Stephen Fletcher — Thu, 28 Aug 2008 01:01:30 GMT

Bug in 4.1.1 build 23

- remove the AAA Client from device group to non-assigned group.

Re: Invalid Message Authenticator in EAP Request

Premdeep Banga — Thu, 28 Aug 2008 10:36:03 GMT

I have a question, when you placed the AAA client under a NDG, was there any Shared Key defined on the NDG level. Because it is an expected behavior, that if you define a Shared Key on the NDG level it over-rides key at the AAA Client level.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/NetCfg.html#wp342738

Refer to Step4.,

"Each device that is assigned to the Network Device Group will use the shared key that you enter here. The key that was assigned to the device when it was added to the system is ignored. If the key entry is null, the AAA client key is used."

Regards,

Prem

Please rate if it helps!