topic Re: WLC 9800 not connecting to RADIUS Microsoft NPS in Wireless https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957339#M262847 <P>=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2023.11.11 06:24:37 =~=~=~=~=~=~=~=~=~=~=~=<BR />sh run<BR />Building configuration...</P> <P>Current configuration : 19481 bytes<BR />!<BR />! Last configuration change at 05:43:09 PST Sat Nov 11 2023 by root<BR />! NVRAM config last updated at 02:14:22 PST Sat Nov 11 2023 by root<BR />!<BR />version 17.9<BR />service timestamps debug datetime msec<BR />service timestamps log datetime msec<BR />service call-home<BR />platform qfp utilization monitor load 80<BR />platform punt-keepalive disable-kernel-core<BR />!<BR />hostname TPL0-ND-WLC<BR />!<BR />boot-start-marker<BR />boot system bootflash:packages.conf<BR />boot-end-marker<BR />!<BR />!<BR />vrf definition Mgmt-intf<BR />!<BR />address-family ipv4<BR />exit-address-family<BR />!<BR />address-family ipv6<BR />exit-address-family<BR />!<BR />aaa new-model<BR />!<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;!<BR />aaa group server radius DALRADIUS<BR />server name DALRADIUS<BR />ip radius source-interface Vlan10<BR />deadtime 5<BR />!<BR />aaa group server ldap test<BR />server CNCA<BR />!<BR />aaa authentication login Guest_Wi-Fi local<BR />aaa authentication login test group DALRADIUS<BR />aaa authentication dot1x Employee group DALRADIUS<BR />aaa authorization network CNCA_Services local <BR />aaa authorization network Employee group DALRADIUS <BR />aaa authorization network test group DALRADIUS <BR />aaa authorization credential-download Guest_Wi-Fi local if-authenticated <BR />aaa authorization credential-download Employee group DALRADIUS <BR />!<BR />!<BR />aaa attribute list CNCA_Services<BR />attribute type ssid "CNCA Services_n"<BR />!<BR />aaa attribute list wlan_lobby_access<BR />!<BR />aaa server radius dynamic-author<BR />client 10.10.10.211<BR />!<BR />aaa session-id common<BR />clock timezone PST -8 0<BR />vtp mode off<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;vtp version 1<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />ip host tools.cisco.com 72.163.4.38<BR />ip domain lookup source-interface Vlan3<BR />!<BR />!<BR />!<BR />login on-success log<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />subscriber templating<BR />eap profile EAP<BR />method fast<BR />method peap<BR />method leap<BR />pki-trustpoint CISCO_IDEVID_SUDI<BR />!<BR />! <BR />! <BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;! <BR />! <BR />!<BR />!<BR />parameter-map type webauth global<BR />type webauth<BR />virtual-ip ipv4 192.0.2.1<BR />redirect on-success google.com<BR />!<BR />access-session mac-move deny<BR />multilink bundle-name authenticated<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />crypto pki trustpoint TP-self-signed-2016556975<BR />enrollment selfsigned<BR />subject-name cn=IOS-Self-Signed-Certificate-2016556975<BR />revocation-check none<BR />rsakeypair TP-self-signed-2016556975<BR />hash sha256<BR />!<BR />crypto pki trustpoint SLA-TrustPoint<BR />enrollment terminal<BR />revocation-check crl<BR />hash sha256<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;!<BR />crypto pki trustpoint US<BR />enrollment terminal pem<BR />subject-name C=US, CN=tpl0-ND-WLC.caminonuevo.org<BR />subject-alt-name tpl0-ND-WLC.caminonuevo.org<BR />revocation-check none<BR />rsakeypair TP-self-signed-2016556975<BR />!<BR />crypto pki trustpoint tpl0-nd-wlc<BR />enrollment terminal pem<BR />subject-name C=US, CN=tpl0-ND-WLC.caminonuevo.org<BR />subject-alt-name tpl0-ND-WLC.caminonuevo.org<BR />revocation-check none<BR />!<BR />!<BR />crypto pki certificate chain TP-self-signed-2016556975<BR />certificate self-signed 01<BR />30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 <BR />31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 <BR />69666963 6174652D 32303136 35353639 3735301E 170D3232 30373131 31373536 <BR />30315A17 0D333230 37313031 37353630 315A3031 312F302D 06035504 03132649 <BR />4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 30313635 <BR />35363937 35308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201 <BR />0A028201 0100D6A6 2A2E44CB E7A7FA4F 6B4C7EA4 AC9CFD03 096B0B87 D9CA7A7C <BR />DEBEA482 A3AF2169 28A776B9 E5344FF6 286A1E73 2302BF4D A0E4A31B 6EE9858F <BR />967AACF4 EE5F4D50 B993CB05 9641354B 6BF781EF C4FFAA06 DC902FF4 C1C97A6B <BR />0196C47C 447E24C1 AFFAE4F0 678BDC9E 2B36E3FA EFFCE256 13D65069 3B2A41AE <BR />26DFEA85 83DB55FB B3424CE0 16ADB08A BAF23C47 5E589D84 6A2D5043 3278A240 <BR />9456AAFC B06464D0 5E250A06 C01A7594 3A2F36F0 4E0ED21D ED9356E4 AFDA667C <BR />8C31FC74 1B05F7E8 21A05F1B B0F76D81 02AF437D E84CC339 18BA30BD 7EF9DCD6 <BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; 65907313 0F743A79 F04F2C3D 8C12D89E 497CFC3B 63332B36 5C65123F 739153C3 <BR />D8CFF70E 992B0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF <BR />301F0603 551D2304 18301680 147486E2 347BE48E B2D1B58F 1F3D0FE3 A1CCC8C1 <BR />2F301D06 03551D0E 04160414 7486E234 7BE48EB2 D1B58F1F 3D0FE3A1 CCC8C12F <BR />300D0609 2A864886 F70D0101 05050003 82010100 0068581B 2ADE2625 CC9E6723 <BR />FEB37680 6D48E56B 798CA81E DDAC33C0 ED3D95CF 2510B6C2 E7DAE9FA FD11FB5D <BR />F34A7CD0 9C296A92 6E37FA43 69E2A044 A098CAA2 3F2A3F2C 0DAE90C1 A8F33BBB <BR />F9CB2963 E4ADB67F 97D13A86 5923FE73 2BDDE061 E1D8CDCD 97C8AF70 21FB2BCC <BR />C4A1F091 E0DD22DE C43FCE7F 7CDAB448 411ADBDB E215A43D 3F89BDDE B1F4C3D2 <BR />E66ACF52 4205C54A 58280B0E 94B70DE3 ED010503 1B7DD333 7C448922 5D991B00 <BR />1AF064CC 155656BA 060F7CCC 4B4EC76D E2F7F7FD 9B1B6370 8C1A5E63 8C8D06B6 <BR />A223B341 1EB81119 08E47C4B EDBBE86F FC121A87 2F0AD3E7 7093B826 C5F404E8 <BR />5D628989 2A180776 B840E2C9 51D8C451 8621D0FB<BR />quit<BR />crypto pki certificate chain SLA-TrustPoint<BR />certificate ca 01<BR />30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030 <BR />32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363 <BR />6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934 <BR />3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305 <BR />43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720 <BR />526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030 <BR />82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D <BR />CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520 <BR />1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE <BR />4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC <BR />7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188 <BR />68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7 <BR />C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191 <BR />C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44 <BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201 <BR />06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85 <BR />4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500 <BR />03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905 <BR />604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B <BR />D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8 <BR />467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C <BR />7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B <BR />5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678 <BR />80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB <BR />418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0 <BR />D697DF7F 28<BR />quit<BR />crypto pki certificate chain US<BR />crypto pki certificate chain tpl0-nd-wlc<BR />!<BR />!<BR />license udi pid C9800-L-C-K9 sn FCL261901EM<BR />license smart transport callhome<BR />device classifier<BR />memory free low-watermark processor 170271<BR />!<BR />service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE<BR />linksec policy must-secure<BR />service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE<BR />linksec policy should-secure<BR />service-template DEFAULT_CRITICAL_VOICE_TEMPLATE<BR />voice vlan<BR />service-template DEFAULT_CRITICAL_DATA_TEMPLATE<BR />service-template webauth-global-inactive<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; inactivity-timer 3600 <BR />diagnostic bootup level minimal<BR />!<BR />!<BR />enable secret 9 $9$QYWgo3Jb5uYysU$LL9M8mjsmAVLWGNmLNKerR4PCR0Qda.Cj/5x5Eo/vN6<BR />!<BR />username root privilege 15 secret 9 $9$3/QH2l6H4/EH2E$2EzwaPhQ10K6QY5UaNIrjHVqvq/gwfYetNsd56arTh.<BR />username 541379948d29 mac aaa attribute list CNCA_Services wlan-profile-name "CNCA Services_n" description osos<BR />user-name cnca_guest<BR />creation-time 1699549809<BR />description Guest-User<BR />password 0 cnca_guest<BR />type network-user description Guest-User guest-user lifetime year 0 month 0 day 11 hour 0 minute 0 second 0<BR />user-name cncalobby<BR />creation-time 1699552762<BR />privilege 0<BR />view LobbyAdminView<BR />secret 9 $9$2l2J4/II3V.I4.$1Om2FR/O8r1.kl5lRuaPMnYNorpZBuof3HogToqvXGI<BR />type lobby-admin<BR />!<BR />redundancy<BR />mode sso<BR />!<BR />crypto engine compliance shield disable<BR />!<BR />!<BR />!<BR />!<BR />vlan internal allocation policy ascending<BR />!<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;vlan 3<BR />name WLC<BR />!<BR />vlan 10 <BR />!<BR />vlan 40<BR />name VLAN40<BR />!<BR />vlan 45<BR />name VLAN45<BR />!<BR />vlan 100,150,160,170,172,180 <BR />!<BR />vlan 200<BR />name VLAN200<BR />!<BR />!<BR />!<BR />class-map match-any AVC-Reanchor-Class<BR />match protocol cisco-jabber-audio<BR />match protocol cisco-jabber-video<BR />match protocol webex-media<BR />match protocol webex-app-sharing<BR />match protocol webex-control<BR />match protocol webex-meeting<BR />match protocol wifi-calling<BR />!<BR />!<BR />! <BR />!<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />! <BR />! <BR />!<BR />!<BR />interface Port-channel1<BR />switchport mode trunk<BR />switchport nonegotiate<BR />!<BR />interface TwoGigabitEthernet0/0/0<BR />switchport trunk allowed vlan 100<BR />switchport mode trunk<BR />negotiation auto<BR />no snmp trap link-status<BR />!<BR />interface TwoGigabitEthernet0/0/1<BR />negotiation auto<BR />no snmp trap link-status<BR />!<BR />interface TwoGigabitEthernet0/0/2<BR />negotiation auto<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; no snmp trap link-status<BR />!<BR />interface TwoGigabitEthernet0/0/3<BR />negotiation auto<BR />no snmp trap link-status<BR />!<BR />interface TenGigabitEthernet0/1/0<BR />switchport mode trunk<BR />switchport nonegotiate<BR />negotiation auto<BR />no snmp trap link-status<BR />channel-group 1 mode on<BR />!<BR />interface TenGigabitEthernet0/1/1<BR />switchport mode trunk<BR />switchport nonegotiate<BR />negotiation auto<BR />no snmp trap link-status<BR />channel-group 1 mode on<BR />!<BR />interface GigabitEthernet0<BR />vrf forwarding Mgmt-intf<BR />ip address 192.168.1.1 255.255.255.0<BR />negotiation auto<BR />no mop enabled<BR />!<BR />interface Vlan1<BR />no ip address<BR />no ip proxy-arp<BR />!<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;interface Vlan3<BR />ip address 10.10.3.2 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan10<BR />ip address 10.10.10.212 255.255.255.0<BR />!<BR />interface Vlan40<BR />description WIRELESS-PRIVATE<BR />ip address 10.10.40.8 255.255.252.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan45<BR />description WIRELESS-GUEST<BR />ip address 10.10.45.8 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan100<BR />description CNCA-Students-WiFi<BR />ip address 10.10.100.8 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan150<BR />description CNCA<BR />ip address 10.10.150.8 255.255.252.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan160<BR />description CNCA Students<BR />ip address 10.10.160.8 255.255.252.0<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; no ip proxy-arp<BR />!<BR />interface Vlan170<BR />description CNCA Services<BR />ip address 10.10.170.8 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan172<BR />description Guest-LAN<BR />ip address 10.10.172.8 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan180<BR />description CNCA Guest<BR />ip address 10.10.180.8 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />interface Vlan200<BR />description CNCA_HVAC<BR />ip address 10.10.200.8 255.255.255.0<BR />no ip proxy-arp<BR />!<BR />ip http server<BR />ip http authentication local<BR />ip http secure-server<BR />ip forward-protocol nd<BR />!<BR />ip tftp source-interface Vlan3<BR />ip tftp blocksize 8192<BR />ip route 0.0.0.0 0.0.0.0 10.10.3.1<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.1.1.254<BR />!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />ldap server CNCA<BR />ipv4 10.10.10.11<BR />base-dn DC=CaminoNuevo,DC=org<BR />!<BR />radius-server attribute wireless accounting username-delimiter hyphen<BR />!<BR />radius server DALRADIUS<BR />address ipv4 10.10.10.211 auth-port 1812 acct-port 1813<BR />key 1234567890<BR />!<BR />!<BR />control-plane<BR />!<BR />!<BR />!<BR />!<BR />!<BR />banner login ^CC N C A <BR />Only authorized persons proceed.^C<BR />parser view LobbyAdminView<BR />secret 9 $9$Lks1yKAJuLbROE$aCeZWuNXXQWtr8gLlma7uSje4PnSddY9bkSRKw6MggI<BR />commands configure include all user-name<BR />commands configure include aaa attribute list<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; commands configure include aaa attribute<BR />commands configure include aaa<BR />commands exec include configure terminal<BR />commands exec include configure<BR />commands exec include all show aaa local guest_user<BR />commands exec include show aaa local<BR />commands exec include show aaa<BR />commands exec include show<BR />!<BR />!<BR />!<BR />line con 0<BR />logging synchronous<BR />stopbits 1<BR />line aux 0<BR />line vty 0 4<BR />length 0<BR />transport input ssh<BR />line vty 5 15<BR />transport input ssh<BR />!<BR />call-home<BR />! If contact email address in call-home is configured as sch-smart-licensing@cisco.com<BR />! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.<BR />contact-email-addr sch-smart-licensing@cisco.com<BR />profile "CiscoTAC-1"<BR />active<BR />destination transport-method http<BR />ntp server 10.10.3.1 prefer source Vlan3<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;!<BR />!<BR />!<BR />!<BR />!<BR />!<BR />wireless aaa policy default-aaa-policy<BR />wireless cts-sxp profile default-sxp-profile<BR />wireless management interface Vlan3<BR />wireless profile airtime-fairness default-atf-policy 0<BR />wireless profile flex default-flex-profile<BR />description "default flex profile"<BR />wireless profile mesh default-mesh-profile<BR />description "Preconfigured default radio profile"<BR />wireless profile multi-bssid default-multi-bssid-profile<BR />description "Default multi bssid profile"<BR />wireless profile radio default-radio-profile<BR />description "Preconfigured default radio profile"<BR />wireless profile policy CNCA<BR />aaa-override<BR />description CNCA<BR />nac<BR />vlan VLAN0150<BR />no shutdown<BR />wireless profile policy VLAN45<BR />description VLAN45<BR />no ip mac-binding<BR />ipv4 dhcp server 10.10.45.1<BR />vlan VLAN45<BR />no shutdown<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;wireless profile policy CNCA_HVAC<BR />description CNCA_HVAC<BR />vlan CNCA_HVAC<BR />no shutdown<BR />wireless profile policy "CNCA Guest"<BR />description "CNCA Guest"<BR />vlan VLAN0180<BR />no shutdown<BR />wireless profile policy CNCA-PRIVATE<BR />description CNCA-PRIVATE<BR />no ip mac-binding<BR />ipv4 dhcp server 10.10.40.1<BR />vlan VLAN40<BR />no shutdown<BR />wireless profile policy "CNCA Students"<BR />description "CNCA Students"<BR />vlan VLAN0160<BR />no shutdown<BR />wireless profile policy CNCA-Students-WiFi<BR />description CNCA-Students-WiFi<BR />vlan VLAN0100<BR />no shutdown<BR />wireless profile policy "CNCA Services (Hidden)"<BR />description "CNCA Services (Hidden)"<BR />vlan VLAN0170<BR />no shutdown<BR />wireless profile policy default-policy-profile<BR />description "default policy profile"<BR />vlan VLAN0100<BR />no shutdown<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;wireless tag site default-site-tag<BR />description "default site tag"<BR />wireless tag policy default-policy-tag<BR />description "default policy-tag"<BR />wlan CNCA policy VLAN45<BR />wlan osos policy CNCA<BR />wlan test policy CNCA<BR />wlan CNCA_n policy CNCA<BR />wlan CNCA-HVAC policy CNCA_HVAC<BR />wlan CNCA-GUEST policy VLAN45<BR />wlan accessories policy VLAN45<BR />wlan "CNCA Guest_n" policy "CNCA Guest"<BR />wlan CNCA-PRIVATE policy CNCA-PRIVATE<BR />wlan CNCA-Students policy CNCA-Students-WiFi<BR />wlan "CNCA Services_n" policy "CNCA Services (Hidden)"<BR />wlan "CNCA Students_n" policy "CNCA Students"<BR />wireless tag rf default-rf-tag<BR />description "default RF tag"<BR />wireless mgmt-via-wireless<BR />wireless fabric control-plane default-control-plane<BR />wireless country US<BR />wlan CNCA 2 CNCA<BR />security wpa psk set-key ascii 0 8jldm2auaa0vinn1isnn9it<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan CNCA_n 5 CNCA_n<BR />dot11ax target-waketime<BR />dot11ax twt-broadcast-support<BR />security dot1x authentication-list Employee<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; security dot1x authorization-list Employee<BR />no shutdown<BR />wlan CNCA-HVAC 3 CNCA-HVAC<BR />no broadcast-ssid<BR />security wpa psk set-key ascii 0 hprlb7y7sz44wruz29919wd<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan CNCA-GUEST 4 CNCA-GUEST<BR />security wpa psk set-key ascii 0 welcome!<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan accessories 6 thingamabobs<BR />security wpa psk set-key ascii 0 "!1234567890!"<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan "CNCA Guest_n" 11 "CNCA Guest_n"<BR />no broadcast-ssid<BR />no security ft adaptive<BR />no security wpa<BR />no security wpa wpa2<BR />no security wpa wpa2 ciphers aes<BR />no security wpa akm dot1x<BR />security web-auth<BR />security web-auth authentication-list Guest_Wi-Fi<BR />security web-auth parameter-map global<BR />no shutdown<BR />wlan CNCA-PRIVATE 1 CNCA-PRIVATE<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; security wpa psk set-key ascii 0 "!Coll3geReadyCollegeB0und!"<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan CNCA-Students 7 CNCA-Students<BR />security wpa psk set-key ascii 0 #EducationCNCA<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan "CNCA Services_n" 10 "CNCA Services_n"<BR />no broadcast-ssid<BR />mac-filtering CNCA_Services<BR />no security ft adaptive<BR />security wpa psk set-key ascii 0 creche-holding-subside-gauge<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />wlan "CNCA Students_n" 9 "CNCA Students_n"<BR />no broadcast-ssid<BR />no security ft adaptive<BR />security wpa psk set-key ascii 0 uphill-dungeon-sirius-focus<BR />no security wpa akm dot1x<BR />security wpa akm psk<BR />no shutdown<BR />ap dot11 24ghz rf-profile Low_Client_Density_rf_24gh<BR />coverage data rssi threshold -90<BR />coverage level 2<BR />coverage voice rssi threshold -90<BR />description "pre configured Low Client Density rfprofile for 2.4gh radio"<BR />high-density rx-sop threshold low<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; rate RATE_12M supported<BR />rate RATE_24M supported<BR />rate RATE_6M supported<BR />tx-power v1 threshold -65<BR />no shutdown<BR />ap dot11 24ghz rf-profile High_Client_Density_rf_24gh<BR />description "pre configured High Client Density rfprofile for 2.4gh radio"<BR />high-density rx-sop threshold medium<BR />rate RATE_11M disable<BR />rate RATE_12M mandatory<BR />rate RATE_1M disable<BR />rate RATE_24M supported<BR />rate RATE_2M disable<BR />rate RATE_5_5M disable<BR />rate RATE_6M disable<BR />tx-power min 7<BR />no shutdown<BR />ap dot11 24ghz rf-profile Typical_Client_Density_rf_24gh<BR />description "pre configured Typical Client Density rfprofile for 2.4gh radio"<BR />rate RATE_11M disable<BR />rate RATE_12M mandatory<BR />rate RATE_1M disable<BR />rate RATE_24M supported<BR />rate RATE_2M disable<BR />rate RATE_5_5M disable<BR />rate RATE_6M disable<BR />no shutdown<BR />ap dot11 24ghz rate RATE_12M mandatory<BR />ap dot11 24ghz rate RATE_18M disable<BR />ap dot11 24ghz rate RATE_24M disable<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;ap dot11 24ghz rate RATE_36M disable<BR />ap dot11 24ghz rate RATE_48M disable<BR />ap dot11 24ghz rate RATE_54M disable<BR />ap dot11 24ghz rate RATE_6M disable<BR />ap dot11 6ghz rf-profile default-rf-profile-6ghz<BR />description "default rfprofile for 6GHz radio"<BR />rate RATE_12M mandatory<BR />rate RATE_24M mandatory<BR />rate RATE_6M mandatory<BR />no shutdown<BR />ap dot11 5ghz rf-profile Low_Client_Density_rf_5gh<BR />coverage data rssi threshold -90<BR />coverage level 2<BR />coverage voice rssi threshold -90<BR />description "pre configured Low Client Density rfprofile for 5gh radio"<BR />high-density rx-sop threshold low<BR />rate RATE_12M mandatory<BR />rate RATE_24M mandatory<BR />rate RATE_6M mandatory<BR />tx-power v1 threshold -60<BR />no shutdown<BR />ap dot11 5ghz rf-profile High_Client_Density_rf_5gh<BR />description "pre configured High Client Density rfprofile for 5gh radio"<BR />high-density rx-sop threshold medium<BR />rate RATE_12M mandatory<BR />rate RATE_24M mandatory<BR />rate RATE_6M disable<BR />rate RATE_9M disable<BR />tx-power min 7<BR />tx-power v1 threshold -65<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; no shutdown<BR />ap dot11 5ghz rf-profile Typical_Client_Density_rf_5gh<BR />description "pre configured Typical Density rfprofile for 5gh radio"<BR />rate RATE_12M mandatory<BR />rate RATE_24M mandatory<BR />rate RATE_6M mandatory<BR />no shutdown<BR />ap dot11 5ghz rate RATE_12M mandatory<BR />ap dot11 5ghz rate RATE_24M mandatory<BR />ap dot11 5ghz rate RATE_6M disable<BR />ap dot11 6ghz rrm monitor measurement 600<BR />ap tag-source-priority 2 source filter<BR />ap tag-source-priority 3 source ap<BR />ap profile default-ap-profile<BR />description "default ap profile"<BR />ap a49b.cd1a.06bc<BR />ap a49b.cd1a.0818<BR />ap a49b.cd1a.0a64<BR />ap a49b.cd1a.0f34<BR />ap a49b.cd1a.1360<BR />ap a49b.cd1a.1370<BR />ap a49b.cd1a.137c<BR />ap a49b.cd1a.13cc<BR />ap a49b.cd1a.13d4<BR />ap a49b.cd1a.13dc<BR />ap a49b.cd1a.1470<BR />ap a49b.cd1a.14a8<BR />ap a49b.cd1a.14cc<BR />ap b811.4b08.3f70<BR />ap b811.4b08.609c<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;ap b811.4b08.64ec<BR />ap b811.4b08.6570<BR />ap b811.4b0a.0018<BR />ap b811.4b0a.00ac<BR />ap b811.4b0a.00b4<BR />ap b811.4b0a.01f8<BR />ap b811.4b0a.0204<BR />ap b811.4b0a.0210<BR />ap b811.4b0a.0214<BR />ap b811.4b0a.0220<BR />ap b811.4b0a.0228<BR />ap b811.4b0a.0240<BR />ap b811.4b0a.0250<BR />ap b811.4b0a.0258<BR />ap b811.4b0a.0264<BR />ap b811.4b0a.028c<BR />ap b811.4b0a.02a0<BR />ap b811.4b0a.02a8<BR />ap b811.4b0a.02b0<BR />ap b811.4b0a.02c0<BR />ap b811.4b0a.02e8<BR />ap b811.4b0a.02ec<BR />ap b811.4b0a.031c<BR />ap b811.4b0a.032c<BR />ap b811.4b0a.033c<BR />ap b811.4b0a.034c<BR />ap b811.4b0a.036c<BR />ap b811.4b0a.0370<BR />ap b811.4b0a.0388<BR />ap b811.4b0a.0390<BR />--More-- &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8; &#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;&#8;ap b811.4b0a.0398<BR />ap b811.4b0a.03dc<BR />trapflags ap crash<BR />trapflags ap noradiocards<BR />trapflags ap register<BR />end</P> <P>&nbsp;</P> Sat, 11 Nov 2023 14:29:31 GMT csco10971283 2023-11-11T14:29:31Z WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957281#M262807 <P>Dears,</P> <P>I need urgent support, I spent like 12 hours troubleshooting a wireless issue on my Cisco WLC 9800 for .1x authentication that was working &amp; suddenly stopped.</P> <P>The software code is 17.9.4a &amp; 17.12.1</P> <P>Here’s the logs on the WLC:</P> <P>&nbsp;</P> <PRE>Feb 4 16:16:34.041: %DOT1X-5-FAIL: Chassis 1 R0/0: wncd: Authentication failed for client (8086.f285.a2f5) with reason (AAA Server Down) on Interface capwap_90000016 AuditSessionID 17DC140A00000010C5851691 Username: 123456 Feb 4 16:16:34.041: %SESSION_MGR-5-FAIL: Chassis 1 R0/0: wncd: Authorization failed or unapplied for client (8086.f285.a2f5) on Interface capwap_90000016 AuditSessionID 17DC140A00000010C5851691. Failure reason: Authc fail. Authc failure reason: Credential Failon</PRE> <P>The strange thing is wireshark on NPS showing zero packets received from WLC.</P> <P>&nbsp;I do confirm all the configuration is correct &amp; nothing changed.</P> <P>I rebooted WLC many times with no success.</P> <P>Using NTRadping giving successful authentication.</P> <P>Is the RADIUS service on the WLC destroyed or what noting that “show aaa servers detailed” showing all WNCD are up but showing 0 in the authentication request count all the time.</P> <P>&nbsp;</P> <P>Thanks,</P> Sat, 11 Nov 2023 12:09:01 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957281#M262807 csco10971283 2023-11-11T12:09:01Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957288#M262808 <P>&nbsp;</P> <P>&nbsp; - It seems from the WLC log that it currently can't reach the&nbsp; &nbsp;NPS radius server ; can you ping it from the WLC ?<BR /><BR />&nbsp; &nbsp; Also have a checkup of the WLC configuration with the CLI command <FONT color="#008000"><STRONG>show tech wireless</STRONG></FONT> ; feed the output into :<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<A href="https://cway.cisco.com/wireless-config-analyzer/" target="_blank">Wireless Config Analyzer</A><BR />&nbsp; &nbsp; This procedure is strongly adviced 'anyways!' and 'in all circumstances!'</P> <P>&nbsp; &nbsp;Use client debugging according to :&nbsp;<A href="https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity" target="_blank">https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity</A><BR />&nbsp; &nbsp;You can have client debugs processed with :&nbsp;<A href="https://cway.cisco.com/wireless-debug-analyzer" target="_blank">https://cway.cisco.com/wireless-debug-analyzer</A></P> <P>&nbsp; &nbsp;Overall client behavior can be observed with :&nbsp;<A href="https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5" target="_blank">https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5</A></P> <P>&nbsp;M.<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</P> Sat, 11 Nov 2023 12:40:18 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957288#M262808 Mark Elsen 2023-11-11T12:40:18Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957289#M262809 <P>0 auth request, meaning there is no WLAN using AAA for security.&nbsp;<BR />I think there is no issue with AAA since it appear UP.<BR /><BR />Thanks A Lot <BR />MHM</P> Sat, 11 Nov 2023 12:43:24 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957289#M262809 MHM Cisco World 2023-11-11T12:43:24Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957297#M262812 <P>How come it’s showing 0 &amp; in the same time it’s giving me credential fail &amp; I’ve AAA method pointing to the RADIUS server</P> Sat, 11 Nov 2023 12:59:56 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957297#M262812 csco10971283 2023-11-11T12:59:56Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957300#M262814 <P>I’ve WLC, RADIUS server &amp; NTRadping all in same subnet.</P> <P>NTRadping authenticate successfully but WLC not even sending packets to NPS.</P> <P>I’ll do witeless config analyzer &amp; reply again</P> Sat, 11 Nov 2023 13:04:25 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957300#M262814 csco10971283 2023-11-11T13:04:25Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957304#M262816 <PRE class="pre codeblock"><CODE>Device# sh aaa dead-criteria radius &lt;server&gt; </CODE></PRE> <P>&nbsp;Can you share this&nbsp;</P> <P>Thanks A Lot <BR />MHM</P> Sat, 11 Nov 2023 13:09:20 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957304#M262816 MHM Cisco World 2023-11-11T13:09:20Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957305#M262817 <P>&nbsp;</P> <P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- Don't forget to test if you can ping the RADIUS server from the WLC (?)</P> <P>&nbsp;M.</P> Sat, 11 Nov 2023 13:09:26 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957305#M262817 Mark Elsen 2023-11-11T13:09:26Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957306#M262818 <P>Pingable</P> Sat, 11 Nov 2023 13:10:30 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957306#M262818 csco10971283 2023-11-11T13:10:30Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957307#M262819 <P>TPL0-ND-WLC#sh aaa dead-criteria radius 10.10.10.211<BR />RADIUS: No server group specified. Using radius<BR />RADIUS Server Dead Criteria:<BR />=============================<BR />Server Details:<BR />Address : 10.10.10.211<BR />Auth Port : 1812<BR />Acct Port : 1813<BR />Server Group : radius<BR />Dead Criteria Details:<BR />Configured Retransmits : 3<BR />Configured Timeout : 5<BR />Estimated Outstanding Access Transactions: 0<BR />Estimated Outstanding Accounting Transactions: 0<BR />Dead Detect Time : 10s<BR />Computed Retransmit Tries: 10<BR />Statistics Gathered Since Last Successful Transaction<BR />=====================================================<BR />Max Computed Outstanding Transactions: 0<BR />Max Computed Dead Detect Time: 0s<BR />Max Computed Retransmits : 0</P> Sat, 11 Nov 2023 13:11:53 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957307#M262819 csco10971283 2023-11-11T13:11:53Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957311#M262823 <P>Here's the WCA analysis report, nothing wrong.<BR />Can you help more please</P> Sat, 11 Nov 2023 13:15:28 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957311#M262823 csco10971283 2023-11-11T13:15:28Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957315#M262827 <P>&nbsp;</P> <P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <U>&nbsp; &nbsp;<FONT color="#008000"><EM> &nbsp; &gt;...</EM></FONT></U><SPAN><U><FONT color="#008000"><EM>Pingable</EM></FONT></U><BR /></SPAN>&nbsp; &nbsp;Take an embedded packet capture while reproducing the issue and then analyze this in Wireshark to validate if the 9800 is sending radius packets to your radius server and not getting any response.<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Refer to the link below to configure the packet capture on the 9800:</P> <P><A href="https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html#anc17" target="_blank" rel="nofollow noopener noreferrer">https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html#anc17</A></P> <P>&nbsp;M.</P> <P><BR />&nbsp;</P> Sat, 11 Nov 2023 13:25:38 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957315#M262827 Mark Elsen 2023-11-11T13:25:38Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957318#M262829 <P>&nbsp;</P> <P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<EM> &nbsp; &nbsp; &gt;...Here's the WCA analysis report,<U> <FONT color="#FF6600">nothing wrong.</FONT></U></EM><BR />&nbsp;- You have <FONT color="#FF0000">errors</FONT> (also) on the tab <STRONG>wlc1-Check Results</STRONG> ,&nbsp; these and or all<STRONG> wlc</STRONG> errors should be corrected, the 3th one could be relevant,&nbsp;&nbsp;</P> <P>&nbsp;M.</P> Sat, 11 Nov 2023 13:28:11 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957318#M262829 Mark Elsen 2023-11-11T13:28:11Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957320#M262831 <P><A href="https://lihaifeng.net/?p=699" target="_blank">https://lihaifeng.net/?p=699</A></P> <P>Same error' and As I was mentioned the wlc not send auth becuase there is no wlan use aaa.</P> <P>Make double check in which wlan this user associated.</P> <P>Thanks A Lot <BR />MHM</P> Sat, 11 Nov 2023 13:33:23 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957320#M262831 MHM Cisco World 2023-11-11T13:33:23Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957321#M262832 <P>But this SSID is not related to .1x &amp; even not used</P> Sat, 11 Nov 2023 13:34:18 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957321#M262832 csco10971283 2023-11-11T13:34:18Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957324#M262833 <P>I checked again,</P> <P>am pretty sure the WLAN is using AAA.</P> <P>TPL0-ND-WLC#sh run | sec wlan CNCA_n<BR />wlan CNCA_n policy CNCA<BR />wlan CNCA_n 5 CNCA_n<BR />dot11ax target-waketime<BR />dot11ax twt-broadcast-support<BR />security dot1x authentication-list Employee<BR />security dot1x authorization-list Employee<BR />no shutdown<BR /><BR /></P> <P>&amp; it's clearly using AAA as am receiving logs for Credential Fail on WLC</P> Sat, 11 Nov 2023 13:36:16 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957324#M262833 csco10971283 2023-11-11T13:36:16Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957325#M262834 <P>I took packet capture while I reproduced the issue &amp; receiving logs on the WLC for credential fail but the packet capture showing 0 for RADIUS protocol &amp; the packet capture on the RADIUS server also showing nothing received</P> Sat, 11 Nov 2023 13:38:07 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957325#M262834 csco10971283 2023-11-11T13:38:07Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957330#M262838 <P>&nbsp;</P> <P>&nbsp;- You took packet capture on NPS ; the procedure I mention is to see if anything originates from the 9800 ; can you do that too ?</P> <P>&nbsp;M.</P> Sat, 11 Nov 2023 13:51:08 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957330#M262838 Mark Elsen 2023-11-11T13:51:08Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957331#M262839 <P>I took both.</P> <P>The packet capture on WLC showing 0 packets for RADIUS</P> Sat, 11 Nov 2023 13:52:22 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957331#M262839 csco10971283 2023-11-11T13:52:22Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957333#M262841 <P>&nbsp;</P> <P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<U><EM>&nbsp; &nbsp;&gt;...The packet capture on WLC showing 0 packets for RADIUS</EM></U><BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Correct the issues I pointed out from <STRONG>WirelessAnalyzer</STRONG> too , if in the end , it would be a 'simple' resource related bug , then a reload of the controller could help , but that has production impact (indeed)</P> <P>&nbsp;M.</P> Sat, 11 Nov 2023 14:02:48 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957333#M262841 Mark Elsen 2023-11-11T14:02:48Z Re: WLC 9800 not connecting to RADIUS Microsoft NPS https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957335#M262843 <P>I reloaded the controller 5 times without any success.</P> <P>any other solution please.</P> <P>also, the errors in wireless analyzer isn’t related to my issue at all</P> Sat, 11 Nov 2023 14:05:06 GMT https://community.cisco.com/t5/wireless/wlc-9800-not-connecting-to-radius-microsoft-nps/m-p/4957335#M262843 csco10971283 2023-11-11T14:05:06Z