topic Re: WLC 9800 not connecting to RADIUS Microsoft NPS in Wireless

WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 12:09:01 GMT

Dears,

I need urgent support, I spent like 12 hours troubleshooting a wireless issue on my Cisco WLC 9800 for .1x authentication that was working & suddenly stopped.

The software code is 17.9.4a & 17.12.1

Here’s the logs on the WLC:

Feb  4 16:16:34.041: %DOT1X-5-FAIL: Chassis 1 R0/0: wncd: Authentication failed for client (8086.f285.a2f5) with reason (AAA Server Down) on Interface capwap_90000016 AuditSessionID 17DC140A00000010C5851691 Username: 123456
Feb  4 16:16:34.041: %SESSION_MGR-5-FAIL: Chassis 1 R0/0: wncd: Authorization failed or unapplied for client (8086.f285.a2f5) on Interface capwap_90000016 AuditSessionID 17DC140A00000010C5851691. Failure reason: Authc fail. Authc failure reason: Credential Failon

The strange thing is wireshark on NPS showing zero packets received from WLC.

I do confirm all the configuration is correct & nothing changed.

I rebooted WLC many times with no success.

Using NTRadping giving successful authentication.

Is the RADIUS service on the WLC destroyed or what noting that “show aaa servers detailed” showing all WNCD are up but showing 0 in the authentication request count all the time.

Thanks,

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

Mark Elsen — Sat, 11 Nov 2023 12:40:18 GMT

- It seems from the WLC log that it currently can't reach the NPS radius server ; can you ping it from the WLC ?

Also have a checkup of the WLC configuration with the CLI command show tech wireless ; feed the output into :
Wireless Config Analyzer
This procedure is strongly adviced 'anyways!' and 'in all circumstances!'

Use client debugging according to : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
You can have client debugs processed with : https://cway.cisco.com/wireless-debug-analyzer

Overall client behavior can be observed with : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

MHM Cisco World — Sat, 11 Nov 2023 12:43:24 GMT

0 auth request, meaning there is no WLAN using AAA for security.
I think there is no issue with AAA since it appear UP.

Thanks A Lot
MHM

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 12:59:56 GMT

How come it’s showing 0 & in the same time it’s giving me credential fail & I’ve AAA method pointing to the RADIUS server

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:04:25 GMT

I’ve WLC, RADIUS server & NTRadping all in same subnet.

NTRadping authenticate successfully but WLC not even sending packets to NPS.

I’ll do witeless config analyzer & reply again

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

MHM Cisco World — Sat, 11 Nov 2023 13:09:20 GMT

Device# sh aaa dead-criteria radius <server>

Can you share this

Thanks A Lot
MHM

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

Mark Elsen — Sat, 11 Nov 2023 13:09:26 GMT

- Don't forget to test if you can ping the RADIUS server from the WLC (?)

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:10:30 GMT

Pingable

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:11:53 GMT

TPL0-ND-WLC#sh aaa dead-criteria radius 10.10.10.211
RADIUS: No server group specified. Using radius
RADIUS Server Dead Criteria:
=============================
Server Details:
Address : 10.10.10.211
Auth Port : 1812
Acct Port : 1813
Server Group : radius
Dead Criteria Details:
Configured Retransmits : 3
Configured Timeout : 5
Estimated Outstanding Access Transactions: 0
Estimated Outstanding Accounting Transactions: 0
Dead Detect Time : 10s
Computed Retransmit Tries: 10
Statistics Gathered Since Last Successful Transaction
=====================================================
Max Computed Outstanding Transactions: 0
Max Computed Dead Detect Time: 0s
Max Computed Retransmits : 0

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:15:28 GMT

Here's the WCA analysis report, nothing wrong.
Can you help more please

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

Mark Elsen — Sat, 11 Nov 2023 13:25:38 GMT

>...Pingable
Take an embedded packet capture while reproducing the issue and then analyze this in Wireshark to validate if the 9800 is sending radius packets to your radius server and not getting any response.
Refer to the link below to configure the packet capture on the 9800:

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html#anc17

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

Mark Elsen — Sat, 11 Nov 2023 13:28:11 GMT

>...Here's the WCA analysis report, nothing wrong.
- You have errors (also) on the tab wlc1-Check Results , these and or all wlc errors should be corrected, the 3th one could be relevant,

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

MHM Cisco World — Sat, 11 Nov 2023 13:33:23 GMT

https://lihaifeng.net/?p=699

Same error' and As I was mentioned the wlc not send auth becuase there is no wlan use aaa.

Make double check in which wlan this user associated.

Thanks A Lot
MHM

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:34:18 GMT

But this SSID is not related to .1x & even not used

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:36:16 GMT

I checked again,

am pretty sure the WLAN is using AAA.

TPL0-ND-WLC#sh run | sec wlan CNCA_n
wlan CNCA_n policy CNCA
wlan CNCA_n 5 CNCA_n
dot11ax target-waketime
dot11ax twt-broadcast-support
security dot1x authentication-list Employee
security dot1x authorization-list Employee
no shutdown

& it's clearly using AAA as am receiving logs for Credential Fail on WLC

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:38:07 GMT

I took packet capture while I reproduced the issue & receiving logs on the WLC for credential fail but the packet capture showing 0 for RADIUS protocol & the packet capture on the RADIUS server also showing nothing received

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

Mark Elsen — Sat, 11 Nov 2023 13:51:08 GMT

- You took packet capture on NPS ; the procedure I mention is to see if anything originates from the 9800 ; can you do that too ?

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 13:52:22 GMT

I took both.

The packet capture on WLC showing 0 packets for RADIUS

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

Mark Elsen — Sat, 11 Nov 2023 14:02:48 GMT

>...The packet capture on WLC showing 0 packets for RADIUS
Correct the issues I pointed out from WirelessAnalyzer too , if in the end , it would be a 'simple' resource related bug , then a reload of the controller could help , but that has production impact (indeed)

Re: WLC 9800 not connecting to RADIUS Microsoft NPS

csco10971283 — Sat, 11 Nov 2023 14:05:06 GMT

I reloaded the controller 5 times without any success.

any other solution please.

also, the errors in wireless analyzer isn’t related to my issue at all