topic Re: Client failed EAP authentication with following reason: Cred faile in Wireless

Client failed EAP authentication with following reason: Cred failed

thuy.hoang — Wed, 07 Jun 2023 08:32:57 GMT

Hello Friends,

I have a WLC C9800 with the Local EAP configuration, but when the client with the local account, it shows Unable to connect.

I did some troubleshooting and found this logging:

2023/06/07 14:17:33.484807549 {wncd_x_R0-0}{1}: [errmsg] [15175]: (note): %DOT1X-5-FAIL: R0/0: wncd: Authentication failed for client (f8e9.4eae.ac0f) with reason (Cred Fail) on Interface capwap_90000005 AuditSessionID 03FA5D0A0000006C96384712 Username: user1
2023/06/07 14:17:33.484816399 {wncd_x_R0-0}{1}: [auth-mgr] [15175]: (info): [f8e9.4eae.ac0f:capwap_90000005] Authc failure from Dot1X, Auth event fail
2023/06/07 14:17:33.484824401 {wncd_x_R0-0}{1}: [auth-mgr] [15175]: (info): [f8e9.4eae.ac0f:capwap_90000005] Method dot1x changing state from 'Running' to 'Authc Failed'

I already see a post with the same issue as link below but not resolved

https://community.cisco.com/t5/wireless/wlc-9800-local-eap-authentication-failed-for-client/td-p/4420304

Is there anyone have a experience on that?

Thanks much.

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Wed, 07 Jun 2023 08:52:14 GMT

What is the model of the AP?

What is the firmware of the controller?

Is the AP local or FLEX?

Re: Client failed EAP authentication with following reason: Cred faile

thuy.hoang — Wed, 07 Jun 2023 09:00:44 GMT

Hi Leo,

AP model: 2802i

WLC version: 17.09.03

AP is now in FLEX mode.

Thanks much.

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Wed, 07 Jun 2023 09:09:06 GMT

Could either be CSCwc48042 or CSCvt38486.

Re: Client failed EAP authentication with following reason: Cred faile

thuy.hoang — Wed, 07 Jun 2023 09:32:36 GMT

Hi Leo,

Thanks for your advice.

I have look to those bugs detail but it looks not the same with our issue.

Re: Client failed EAP authentication with following reason: Cred faile

Rich R — Sat, 10 Jun 2023 11:52:33 GMT

Have you checked your WLC config using output from "show tech wireless" at https://cway.cisco.com/wireless-config-analyzer/ ?
Have you followed https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215026-local-eap-authentication-on-catalyst-980.html and checked that you did not miss any steps or config?
Also https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/local-extensible-auth-protocol.html
Have you reviewed the best practice guide (below)?

Re: Client failed EAP authentication with following reason: Cred faile

ChrisStegner — Fri, 23 Jun 2023 14:48:11 GMT

Have you gotten anywhere with this? I am having the exact same issue.

However, some additional detail... it used to work..

I have users attempting to connect with Iphones that get this error, but laptops on the same SSID work just fine.

I am guessing there was an IOS upgrade that killed this...

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Fri, 23 Jun 2023 16:19:37 GMT

What is the model of the AP?

What is the firmware of the controller?

Is the AP local or FLEX?

Re: Client failed EAP authentication with following reason: Cred faile

ChrisStegner — Fri, 23 Jun 2023 16:35:14 GMT

AP is C9130AXI-B
Firmware 17.6.4
Local

It lines up very well with the bugs that you noted above. But it is odd to me that it is just the IOS devices that are having the issue not the Windows boxes.

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Sat, 24 Jun 2023 01:44:51 GMT

Upgrade to 17.9.3 and try again.

Re: Client failed EAP authentication with following reason: Cred faile

fabiano.dantas — Wed, 12 Jul 2023 21:19:05 GMT

Hello Friends

I have this same problem, but with a particularity

-------------------

My Environment

WLC version: 17.09.03

AP model: 9120

AP in FLEX mode.

--------------------

The networks wireless it's run normaly with all devices on company.

Just doesn't work with laptops from HP.

Notebook HP 240 G7

The logs is similar from colleagues here.

anybody had problem similar?

Re: Client failed EAP authentication with following reason: Cred faile

fabiano.dantas — Wed, 12 Jul 2023 21:20:44 GMT

Hello Friends,

I have this same problem, but with a particularity

-------------------
My environment

WLC version: 17.09.03

AP model: 9120

AP in FLEX mode.

--------------------

The networks wireless it's run normaly with all devices on company.

Just doesn't work with laptops from HP, Notebook HP 240 G7.

The logs is similar from colleagues here.

anybody had problem similar?

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Thu, 13 Jul 2023 01:58:53 GMT

What is the exact model of the wireless NIC and what is the wireless NIC driver?

Unsure? Use the command "netsh wlan show drivers" and look at the top five lines.

Re: Client failed EAP authentication with following reason: Cred faile

zachhoiberg — Tue, 18 Jul 2023 19:10:59 GMT

We have two devices, both with similar drivers and card models, that are experiencing this issue.

Interface name: Wi-Fi

Driver : Intel(R) Dual Band Wireless-AC 7260
Vendor : Intel Corporation
Provider : Intel
Date : 4/29/2019
Version : 18.33.17.1
INF file : oem13.inf
Type : Native Wi-Fi Driver
Radio types supported : 802.11b 802.11g 802.11n 802.11a 802.11ac
FIPS 140-2 mode supported : Yes
802.11w Management Frame Protection supported : Yes
Hosted network supported : Yes
Authentication and cipher supported in infrastructure mode:
Open None
Open WEP-40bit
Open WEP-104bit
Open WEP
WPA-Enterprise TKIP
WPA-Enterprise CCMP
WPA-Personal TKIP
WPA-Personal CCMP
WPA2-Enterprise TKIP
WPA2-Enterprise CCMP
WPA2-Personal TKIP
WPA2-Personal CCMP
Open Vendor defined
Vendor defined Vendor defined
Authentication and cipher supported in ad-hoc mode:
Open None
Open WEP-40bit
Open WEP-104bit
Open WEP
WPA2-Personal CCMP
IHV service present : Yes
IHV adapter OUI : [00 80 86], type: [00]
IHV extensibility DLL path: C:\WINDOWS\System32\IWMSSvc.dll
IHV UI extensibility ClSID: {1bf6cb2d-2ae0-4879-a7aa-a75834fbd0e3}
IHV diagnostics CLSID : {00000000-0000-0000-0000-000000000000}
Wireless Display Supported: Yes (Graphics Driver: Yes, Wi-Fi Driver: Yes)

Interface name: Wi-Fi

    Driver                    : Intel(R) Wireless-N 7260
    Vendor                    : Intel Corporation
    Provider                  : Intel
    Date                      : 9/3/2018
    Version                   : 18.33.14.3
    INF file                  : oem12.inf
    Type                      : Native Wi-Fi Driver
    Radio types supported     : 802.11b 802.11g 802.11n
    FIPS 140-2 mode supported : Yes
    802.11w Management Frame Protection supported : Yes
    Hosted network supported : Yes
    Authentication and cipher supported in infrastructure mode:
                                Open            None
                                Open            WEP-40bit
                                Open            WEP-104bit
                                Open            WEP
                                WPA-Enterprise TKIP
                                WPA-Enterprise CCMP
                                WPA-Personal    TKIP
                                WPA-Personal    CCMP
                                WPA2-Enterprise TKIP
                                WPA2-Enterprise CCMP
                                WPA2-Personal   TKIP
                                WPA2-Personal   CCMP
                                Open            Vendor defined
                                Vendor defined Vendor defined
    Authentication and cipher supported in ad-hoc mode:
                                Open            None
                                Open            WEP-40bit
                                Open            WEP-104bit
                                Open            WEP
                                WPA2-Personal   CCMP
    Wireless Display Supported: Yes (Graphics Driver: Yes, Wi-Fi Driver: Yes)

The first result is the most up to date drivers for that WiFi card, the second seems to be the default Windows will grab for the card.

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Wed, 19 Jul 2023 00:28:38 GMT

@zachhoiberg wrote:
Driver : Intel(R) Dual Band Wireless-AC 7260
Version : 18.33.17.1

The wireless NIC driver is ancient. Please update it. The latest driver can be found HERE.

NOTE: Intel 7260 is already EoS/EoL so Intel (like any technology company) deletes all documentation and files (including drivers) from the public once EoS date has been reached. The product DN2820FY and AC 7260 are the same. Installing the wireless NIC driver for the DN2820FY into a laptop with 7260 should be fine.

Re: Client failed EAP authentication with following reason: Cred faile

zachhoiberg — Wed, 19 Jul 2023 13:22:31 GMT

That is the driver that is installed when I run that executable.

Re: Client failed EAP authentication with following reason: Cred faile

Leo Laohoo — Wed, 19 Jul 2023 23:54:50 GMT

@zachhoiberg wrote:
Radio types supported : 802.11b 802.11g 802.11n

Please check the controller to determine which radio (2.4 Ghz or 5.0 Ghz) the laptop has joined.

@zachhoiberg wrote:
Just doesn't work with laptops from HP, Notebook HP 240 G7.

Wait, that just not make any sense! Works for anything-n-everything except one particular model of laptop with an ancient wireless NIC?

Try creating a SSID with OPEN authentication and see if the laptops (plural) works or not. IF it works, then crank up to PSK. IF that works, then keep cranking until it breaks.

If OPEN SSID does not work, then something horribly is happening at the SOE level.

Re: Client failed EAP authentication with following reason: Cred faile

JPavonM — Thu, 20 Jul 2023 06:31:01 GMT

Have you checked thsi laptop has the correct certificate and the correct options in the WLAN profile? (cert server validation, user/machine creds,...)

Re: Client failed EAP authentication with following reason: Cred faile

thuy.hoang — Mon, 31 Jul 2023 05:59:00 GMT

Hello Friends,

Just shared that I have resolved the issue.

I changed the EAP certificate to self signed certs and local user should be created without password encrypted.

Thanks.

Re: Client failed EAP authentication with following reason: Cred faile

zachhoiberg — Tue, 15 Aug 2023 14:16:30 GMT

Open works, PSK works, PSK with local MAB works. DOT1X results in the following:

Aug 15 13:41:04.094: %DOT1X-5-FAIL: Chassis 1 R0/0: wncd: Authentication failed for client (e8b1.fcdc.827d) with reason (Cred Fail) on Interface capwap_90000098 AuditSessionID 8201C10A003A898CF96DAD1F Username: user@domain.local
Aug 15 13:41:04.094: %SESSION_MGR-5-FAIL: Chassis 1 R0/0: wncd: Authorization failed or unapplied for client (e8b1.fcdc.827d) on Interface capwap_90000098 AuditSessionID 8201C10A003A898CF96DAD1F. Failure reason: Authc fail. Authc failure reason: Cred Fail.

Certificate based authentication, both with a cert requested from the same CA via the AD enrollment policy.

When connected via PSK with MAB,

"Capabilities

802.11ac Spatial Stream: 2"

This is from the AC 7260:

Interface name: Wi-Fi