topic WLC User Authentication in Wireless

WLC User Authentication

ecejhe — Thu, 09 Sep 2021 13:33:32 GMT

I have 2 radius servers for authentication.

Primary: 10.63.17.11

Secondary: 10.111.0.7

I need to validate at what server where my machine is authenticating:

PC WLAN Mac address: 18-1D-EA-03-B7-45

I tried to do a debug from my machine (please see attached log)

But i can't see the radius IP address in the logs

Kindly help to validate where my authentication works?

Re: WLC User Authentication

Mark Elsen — Thu, 09 Sep 2021 16:11:06 GMT

- Have a look at the logs of the radius server's , btw the authentication does succeed , as from (when inputting your debug-file)

https://cway.cisco.com/wireless-debug-analyzer/

TimeTaskTranslated

Sep 09 14:26:42.091	*Dot1x_NW_MsgTask_5	WLC/AP is sending EAP-Identity-Request to the client
Sep 09 14:26:42.110	*Dot1x_NW_MsgTask_5	WLC/AP is sending EAP-Identity-Request to the client
Sep 09 14:26:42.121	*Dot1x_NW_MsgTask_5	Client sent EAP-Identity-Response to WLC/AP
Sep 09 14:26:42.182	*Dot1x_NW_MsgTask_5	RADIUS Server permitted access
Sep 09 14:26:42.182	*Dot1x_NW_MsgTask_5	Client will be required to Reauthenticate in 28800 seconds
Sep 09 14:26:42.184	*Dot1x_NW_MsgTask_5	4-Way PTK Handshake, Sending M1
Sep 09 14:26:42.188	*Dot1x_NW_MsgTask_5	4-Way PTK Handshake, Received M2
Sep 09 14:26:42.188	*Dot1x_NW_MsgTask_5	4-Way PTK Handshake, Sending M3
Sep 09 14:26:42.190	*Dot1x_NW_MsgTask_5	4-Way PTK Handshake, Received M4
Sep 09 14:26:42.191	*Dot1x_NW_MsgTask_5	Client has completed PSK Dot1x or WEP authentication phase
Sep 09 14:26:42.191	*Dot1x_NW_MsgTask_5	Client has entered RUN state
Sep 09 14:26:42.198	*DHCP Socket Task	Received DHCP request from client
Sep 09 14:26:42.204	*DHCP Socket Task	Received DHCP ACK from DHCP server

Re: WLC User Authentication

ecejhe — Thu, 09 Sep 2021 23:45:20 GMT

Thanks Marce, yes it was authenticated successfully but I am not sure at what radius did it authenticated.

I don't have access to Radius server as it was managed by Server Team. Is there any way to check where it was authenticated from the WLC?

Re: WLC User Authentication

Mark Elsen — Fri, 10 Sep 2021 07:01:56 GMT

>Is there any way to check where it was authenticated from the WLC

My initial reply already confirmed this , radius server access is a must to answer our question.

Re: WLC User Authentication

Rich R — Mon, 13 Sep 2021 11:31:51 GMT

Have you tried using AAA debugs?

(WLC) >debug aaa ?

all Configures debug of all AAA messages.
avp-xml Configures debug of AAA Avp xml events.
detail Configures debug of AAA detailed events.
events Configures debug of AAA events.
ldap Configures debug of AAA LDAP events.
local-auth Configures debug of AAA Local Authentication.
packet Configures debug of AAA packets.
tacacs Configures debug of AAA TACACS+ events.

packet, detail, events or all would probably give the info you want.