topic Re: No response from server NPS authentication in Wireless

No response from server NPS authentication

HUGH LANCASTER — Mon, 05 Jul 2021 17:24:45 GMT

I trying to get my new 3504 to authenticate to my window 2012 r2 Network Policy server on v1. The management interface on the WLC 3504 is on a trunk port. The management V ID is 30. From the controller v30 I can ping the 2012 r2 where Network Policy server is located on v1 and from the Network Policy server I can ping the controller. I can login to the web interface no issues. I set the service-port to Dynamic Host Configuration Protocol and it received an IP from the Dynamic Host Configuration Protocol server. When I complete the command test AAA show radius, I get "10.100.0.33 1 No response received from server". My old 2106 controller authenticates no issues. Any help appreciated!

(Cisco Controller) >test AAA show radius

Radius Test Request
WLan id........................................ 1
AP Group Name................................... default-group
Server Index................................... 1
Radius Test Response

Radius Server Retry Status
------------- ----- ------
10.100.0.33 1 No response received from server

Re: No response from server NPS authentication

HUGH LANCASTER — Thu, 16 May 2019 16:09:13 GMT

Sorry for spelling out some of the names. very difficult to post here.

Re: No response from server NPS authentication

HUGH LANCASTER — Mon, 20 May 2019 13:22:02 GMT

Here is a screen shot of my NPS

Re: No response from server NPS authentication

Some_Guy — Thu, 16 May 2019 20:23:01 GMT

Check for ideas in the Windows Event Viewer logs under Custom Views --> Server Roles --> Network Policy and Access Services.

In NPS did you add the IP address of your new WLC under "RADIUS Clients"?

Re: No response from server NPS authentication

patoberli — Fri, 17 May 2019 13:38:13 GMT

You should see every authentication attempt in the Event Viewer - Security log on the NPS server.
Important, is the NPS registered in your domain? To check that, right click on NPS (local) in the NPS management tool. If the "Register in AD" is greyed out it's ok.

Re: No response from server NPS authentication

Mikey Boy — Fri, 17 May 2019 13:46:43 GMT

If you are getting a no response from AAA server have you absolutely confirmed that the WLC is entered correctly as a client in the NPS server? Does the share secret etc match up on both ends?

Re: No response from server NPS authentication

HUGH LANCASTER — Mon, 20 May 2019 16:02:14 GMT

I changed the password on both ends to 123456 for testing and no go. ON WLC I completed a test and received this error "

test aaa radius username test password 123456 wlan-id 1

Fri May 17 10:50:54 2019

RADIUS server 10.100.0.33:1812 failed to respond to request (ID 0) for client 00:11:22:33:44:55 / user 'test'

In the event viewer NPS does not show any communication from the WLC test that I competed

Re: No response from server NPS authentication

HUGH LANCASTER — Fri, 17 May 2019 16:04:51 GMT

NPS is registered in the domain. It is authenticating to my 2106 controller and clients are authenticating. I am thinking it has something to with the VLAN. However, from the WLC 3504 I can ping the NPS server and vice versa.

I verified password on the NPS and Controller several times. If it was the password, i should get an error. I have the port trunked on the WLC. All my VLANS are operating with no issues. The NPS server is VLAN 1 and WLC in VLAN 30.

Re: No response from server NPS authentication

Some_Guy — Fri, 17 May 2019 17:47:44 GMT

@HUGH LANCASTER wrote:

I verified password on the NPS and Controller several times. If it was the password, i should get an error.

Are you sure you're looking in the right log? If your RADIUS Shared Secret is wrong, you will get an Event ID 13 in the "System" log of Windows Event Viewer. Most NPS stuff ordinarily is in the "Security" log, so it is easy to miss this event if you don't check the System log.

Alternatively if you view under "Server Roles" in Event Viewer then you will see all NPS events regardless of which Windows log they come from.

Re: No response from server NPS authentication

HUGH LANCASTER — Mon, 20 May 2019 13:26:16 GMT

Yes. I've look both places. I am seeing information from the "service port" showing in the NPS logs. "A radius message was received from the invalid client IP address 10.100.1.137 address. I enable DHCP on the service port.

Re: No response from server NPS authentication

patoberli — Mon, 20 May 2019 07:02:11 GMT

Can you provide me a screenshot of the Radius Clients screen on the NPS?
Firewall is allowing connections from the new IP of the WLC to the NPS?

Re: No response from server NPS authentication

HUGH LANCASTER — Mon, 20 May 2019 13:35:39 GMT

All internal

Re: No response from server NPS authentication

patoberli — Mon, 20 May 2019 13:09:52 GMT

Thanks.
As you are masking various parts of the IP address, is it the same as this one "A radius message was received from the invalid client IP address 10.100.x.x address" from your error message?
Or please stop masking private IP addresses, it just makes the troubleshooting much more complicated.

Re: No response from server NPS authentication

Some_Guy — Mon, 20 May 2019 18:26:07 GMT

This means the RADIUS request is getting to the NPS server, but the NPS server is ignoring it because it's coming from the service port's IP (10.100.1.137) instead of the IP you were expecting (10.100.32.3).

There is probably a way to set on the WLC which interface it will use for RADIUS requests. I don't know about it off the top of my head though. You'll need to configure the WLC to use the 10.100.32.3 interface for RADIUS.

Re: No response from server NPS authentication

HUGH LANCASTER — Mon, 20 May 2019 19:15:23 GMT

Makes sense to me. I created a case with tech support. I ran wireshark on both subnets and not seeing any communication with the 10.100.32.3 interface.

Re: No response from server NPS authentication

HUGH LANCASTER — Tue, 21 May 2019 20:18:01 GMT

I created a ticket with cisco and problem resolved. "Service port must be on a different supernet from the service-port interface". Thanks for all the help!

Re: No response from server NPS authentication

WhyFi — Wed, 11 Sep 2019 14:12:47 GMT

I have the same problem. But I don't understand what you mean with "Service port must be on a different supernet from the service-port interface".
Care to elaborate?

Edit: My problem was that I needed to reboot de NPS server. Now he responds.

Re: No response from server NPS authentication

NyiNyiZin59782 — Mon, 11 Jan 2021 04:36:34 GMT

Even I changed Service port subnet which is different from management subnet, Error is still happening.