topic It will not even connect to in Wireless

Cisco 7925G Will Not Connect using PEAP

edwardforgacs — Mon, 05 Jul 2021 11:16:34 GMT

We have a working wireless setup using Aironet 1142 connected to Windows Network Policy Server using PEAP. Other clients can connect to the wireless fine but the 7925G phone just will not connect using PEAP. The only way we have been able to get it to connect to anything is using WPA version 1 with a shared key. It's running the latest firmware version 1.4.7.3.

The only error we can see coming from NPS is "The Security Support Provider Interface (SSPI) called by EAP reports that the NPS server and the access client cannot communicate because they do not possess a common algorithm."

MSCHAPv2 is enabled in NPS. The CA root certificate has also been installed on the phone and I note it is only a 2048-bit SHA1 certifiacate which is apparently all they support. The AP is also using AES and it was tested with TKIP as well, no difference.

Are there any tricks required for the 7925G to work over PEAP? Anyone that has it successfully working?

The AP is also using AES and

Leo Laohoo — Thu, 19 Nov 2015 09:58:23 GMT

The AP is also using AES and it was tested with TKIP as well

792X phones support nothing but CCKM.

Refer the link : http://www

mohanak — Thu, 19 Nov 2015 10:08:54 GMT

Refer the link : http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/7925g_7925gEX_7926/8_0_1/english/admin_guide/P256_BK_W9C6D5B6_00_wireless-ip-phone-admin/P256_BK_W9C6D5B6_00_wireless-ip-phone-admin_chapter_0100.html#P256_TP_P1D82ECA_00

CCKM was enabled, I have

edwardforgacs — Thu, 19 Nov 2015 10:19:40 GMT

CCKM was enabled, I have tried disabling WPA2 on the voice VLAN and still no success unfortunately. I have also seen the document referred to above and followed it carefully.

Ok, let's try with the basic:

Leo Laohoo — Thu, 19 Nov 2015 19:12:24 GMT

Ok, let's try with the basic: Can the phone authenticate to the SSID using OPEN authentication?

It will not even connect to

edwardforgacs — Fri, 20 Nov 2015 00:17:35 GMT

It will not even connect to the AP with Open selected and EAP turned off completely on that SSID. It was showing up in the AP debugs, but not now, it's as if it's given on on the AP or the AP has blocked it for some reason due to too many attempts. Is that possible?

Post the settings of the

Leo Laohoo — Fri, 20 Nov 2015 00:27:07 GMT

Post the settings of the phone and the settings of the WLAN.

Here's the complete AP config

edwardforgacs — Fri, 20 Nov 2015 00:35:32 GMT

Here's the complete AP config to start with

Building configuration...

Current configuration : 5289 bytes
!
! Last configuration change at 11:31:34 AEST Fri Nov 20 2015 by admin
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname aironet
!
!
logging rate-limit console 9
enable secret 5 *****

!
aaa new-model
!
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_eap
server name 192.168.0.2
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
!
!
!
!
!
aaa session-id common
clock timezone +1000 10 0
clock summer-time AEST recurring 1 Sun Oct 2:00 1 Sun Apr 2:00
no ip source-route
no ip cef
ip domain name quantumsoftware.com.au
ip name-server 192.168.0.2
ip name-server 192.168.0.3
!
!
!
!
ip dhcp-server 192.168.0.2
dot11 syslog
dot11 vlan-name Data vlan 1
dot11 vlan-name Voice vlan 100
!
dot11 ssid QSS
   vlan 1
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management wpa version 2
   guest-mode
   mbssid guest-mode
!
dot11 ssid QSS-Voice
   vlan 100
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management cckm
   mbssid guest-mode
!
!
dot11 network-map
dot11 arp-cache optional
dot11 phone dot11e
!
no ipv6 cef
!
!
username admin privilege 15 password 7 *****
!
!
ip ssh version 1
bridge irb
!
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption mode ciphers aes-ccm
!
encryption vlan 1 mode ciphers aes-ccm
!
encryption vlan 100 mode ciphers aes-ccm
!
ssid QSS
!
ssid QSS-Voice
!
antenna gain 20
mbssid
speed basic-1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.
power client local
station-role root
world-mode dot11d country-code AU both
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.100
encapsulation dot1Q 100
no ip route-cache
bridge-group 100
bridge-group 100 subscriber-loop-control
bridge-group 100 spanning-disabled
bridge-group 100 block-unknown-source
no bridge-group 100 source-learning
no bridge-group 100 unicast-flooding
!
interface Dot11Radio1
no ip address
no ip route-cache
!
encryption mode ciphers aes-ccm
!
encryption vlan 1 mode ciphers aes-ccm
!
encryption vlan 100 mode ciphers aes-ccm
!
ssid QSS
!
ssid QSS-Voice
!
antenna gain 20
peakdetect
no dfs band block
mbssid
speed basic-6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.
power client local
channel dfs
station-role root
world-mode dot11d country-code AU both
!
interface Dot11Radio1.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.100
encapsulation dot1Q 100
no ip route-cache
bridge-group 100
bridge-group 100 subscriber-loop-control
bridge-group 100 spanning-disabled
bridge-group 100 block-unknown-source
no bridge-group 100 source-learning
no bridge-group 100 unicast-flooding
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
!
interface GigabitEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface GigabitEthernet0.100
encapsulation dot1Q 100
no ip route-cache
bridge-group 100
bridge-group 100 spanning-disabled
no bridge-group 100 source-learning
!
interface BVI1
mac-address c89c.1d6e.9d5a
ip dhcp relay information trusted
ip address 192.168.0.31 255.255.255.0
ip helper-address 192.168.0.2
ip helper-address 192.168.0.3
no ip route-cache
!
ip default-gateway 192.168.0.32
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
!
radius-server attribute 32 include-in-access-req format %h
radius-server deadtime 15
!
radius server 192.168.0.2
address ipv4 192.168.0.2 auth-port 1812 acct-port 1813
key 7 ****
!
access-list 111 permit tcp any any neq telnet
bridge 1 route ip
!
!
!
line con 0
access-class 111 in
logging synchronous
line vty 0 4
access-class 23 in
exec-timeout 0 0
privilege level 15
logging synchronous
transport input ssh
line vty 5 15
access-class 23 in
privilege level 15
logging synchronous
transport input ssh
!
sntp logging
sntp server 192.168.0.2
sntp server 192.168.0.3
sntp broadcast client
end

The only settings on the

edwardforgacs — Sat, 21 Nov 2015 01:36:25 GMT

The only settings on the phone are the Wireless SSID, username, password, authentication mode is set to PEAP (I have also tried EAP-FAST and LEAP). All others are default settings, and the phone was able to connect successfully to another non-Cisco AP, it just will not connect to the 1142.