topic Cisco Aironet 1040 and Radius Auth Failure in Wireless

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Sun, 04 Jul 2021 03:49:11 GMT

Alright now this might seem bizarre but I am really hoping someone can work out what I am doing wrong!

I have setup a Cisco Aironet 1040 to connect to our Radius server which I have also configured.

I can successfully connect up any Iphone or Ipad but I cannot get any laptop to connect.

I have attached the logs showing the Iphone Successfully logging in and the Laptop Failing.

Every single failure in the Event log for NPS comes up with

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:

Security ID: NULL SID

Account Name: scottd

Account Domain: AMSLAN

Fully Qualified Account Name: AMSLAN\scottd

Client Machine:

Security ID: NULL SID

Account Name: -

Fully Qualified Account Name: -

OS-Version: -

Called Station Identifier: 5835.d976.9420

Calling Station Identifier: d0df.9a92.0f40

NAS:

NAS IPv4 Address: 192.168.2.98

NAS IPv6 Address: -

NAS Identifier: ap

NAS Port-Type: Wireless - IEEE 802.11

NAS Port: 336

RADIUS Client:

Client Friendly Name: Cisco AP

Client IP Address: 192.168.2.98

Authentication Details:

Connection Request Policy Name: Secure Wireless Connections

Network Policy Name: -

Authentication Provider: Windows

Authentication Server: AMS-DC3.lan.ams.co.nz

Authentication Type: PEAP

EAP Type: -

Account Session Identifier: -

Logging Results: Accounting information was written to the local log file.

Reason Code: 266

Reason: The message received was unexpected or badly formatted.

A successful Iphone connection shows as below

Network Policy Server granted access to a user.

User:

Security ID: AMSLAN\scottd

Account Name: scottd

Account Domain: AMSLAN

Fully Qualified Account Name: AMSLAN\scottd

Client Machine:

Security ID: NULL SID

Account Name: -

Fully Qualified Account Name: -

OS-Version: -

Called Station Identifier: 5835.d976.9420

Calling Station Identifier: dc2b.6196.184b

NAS:

NAS IPv4 Address: 192.168.2.98

NAS IPv6 Address: -

NAS Identifier: ap

NAS Port-Type: Wireless - IEEE 802.11

NAS Port: 324

RADIUS Client:

Client Friendly Name: Cisco AP

Client IP Address: 192.168.2.98

Authentication Details:

Connection Request Policy Name: Secure Wireless Connections

Network Policy Name: Secure Wireless Connections

Authentication Provider: Windows

Authentication Server: AMS-DC3.lan.ams.co.nz

Authentication Type: PEAP

EAP Type: Microsoft: Secured password (EAP-MSCHAP v2)

Account Session Identifier: -

Logging Results: Accounting information was written to the local log file.

Quarantine Information:

Result: Full Access

Session Identifier: -

I just cannot for the life of me find any settings or configuration that will allow this to work. I am hoping that someone may have seen this or be able to offer some insight into what could be wrong.

Thanks in advance!

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Tue, 27 Sep 2011 04:17:42 GMT

Still having this issue if anyone is able to supply any kind of information to point me in the right direction it would be much appreciated!

Cisco Aironet 1040 and Radius Auth Failure

George Stefanick — Wed, 28 Sep 2011 00:53:19 GMT

Yea, i see is doesnt like it ...

Sep 25 23:47:26.884: dot11_auth_dot1x_parse_aaa_resp: Received server response: FAIL

Question, why is the security ID different between the Apple and the laptop?

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Wed, 28 Sep 2011 01:04:27 GMT

I wish I knew! The same information is entered but it doesn't seem to send the security ID no matter how I set up the wireless connection on the PC

Cisco Aironet 1040 and Radius Auth Failure

George Stefanick — Wed, 28 Sep 2011 01:35:44 GMT

What supplicant are you using on the laptop ?

Cisco Aironet 1040 and Radius Auth Failure

George Stefanick — Wed, 28 Sep 2011 01:38:01 GMT

read this ... see if this helps at all

http://social.technet.microsoft.com/Forums/en-US/winserverNAP/thread/fc4d949b-7ac5-4c50-b984-4c16b3710716/

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Wed, 28 Sep 2011 02:18:40 GMT

I have tried it on both Win XP and WIndows 7 both get the exact same error.

Tried it with and without certificates on, the certificate works as that is what it uses on the Iphones and Ipads

Tried WPA and WPA2 with AES or TKIP

on the Radius setup under NPS if I have any kind of authentication setup I get the

Reason Code: 266

Reason: The message received was unexpected or badly formatted.

If I set everything to open then it will connect fine so there is no issue with that side of things it's definetly to do with the security used, but whether it is a Cisco AP setting or a windows server/cleint setting eludes me.

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Wed, 28 Sep 2011 02:19:19 GMT

From everything I can see this is working correctly as the Iphones use the certificates.

Cisco Aironet 1040 and Radius Auth Failure

markmilenkovic — Wed, 28 Sep 2011 12:44:09 GMT

used to have a similar issues on several of our laptops depending on how they were built.

Driver updates fixed our problem though - not sur eif it will for you? but the error was the same for use

Reason: The message received was unexpected or badly formatted.

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Thu, 29 Sep 2011 02:00:38 GMT

I had already given drivers ago, But I tried again anyway. Sadly this didn't fix the problem.

Cisco Aironet 1040 and Radius Auth Failure

ams-it — Sun, 02 Oct 2011 22:53:49 GMT

Just tried a Wireless USB stick in multiple hardware and get the exact same issue, peap appears to be the issue but this is what the Iphones say they are connecting with and they work.....

Cisco Aironet 1040 and Radius Auth Failure

ajamerica — Fri, 16 Nov 2012 20:45:37 GMT

Was there any updates with this? I am running into the same issue with 2008 R2 NPS....

Cisco Aironet 1040 and Radius Auth Failure

jenwilson — Tue, 18 Dec 2012 11:47:55 GMT

Too many Trusted Auth Certs on the Radius server after update?

See

http://social.technet.microsoft.com/Forums/en-US/winserveressentials/thread/2636b892-7113-4692-a4f4-53d330ca6062

and

http://support.microsoft.com/kb/933430

Method 3 in the above link of adding the regentry SendTrustedIssuerList to 0 fixed the issue for me.

Cisco Aironet 1040 and Radius Auth Failure

Ivaylo Georgiev — Fri, 22 Nov 2013 17:12:14 GMT

Scott,

How did you solve this?

Cisco Aironet 1040 and Radius Auth Failure

kaaftab — Fri, 22 Nov 2013 22:39:04 GMT

check this link for reference

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080c1dd60.shtml