topic Re: Users are unable to authenticate from Radius server - cisco 9800 W in Wireless

Users are unable to authenticate from Radius server - cisco 9800 WLC

Rajesh Kumar Reddy — Mon, 05 Aug 2024 06:23:14 GMT

Hello team,

I have a 9800 WLC in my setup where one of the SSID is configured for .1x authentication, Since yesterday users are unable to authenticate via Radius for this SSID.

There was ("No config changes was done on Radius, Switch or WLC), No Firmware upgrades and no power outages happened and this happened suddenly.

Could someone suggest what are all the things to be checked to find out the root cause like troubleshooting ways connectivity, logs, which logs will state the issue althose.

Thanks.

Rajesh.

Re: Users are unable to authenticate from Radius server - cisco 9800 W

Rasika Nayanajith — Mon, 05 Aug 2024 06:50:41 GMT

Please check on RADIUS server logs that will tell the reason for failure. Could be some certificate expiry

HTH
Rasika
*** Pls rate all useful responses ***

Re: Users are unable to authenticate from Radius server - cisco 9800 W

Rajesh Kumar Reddy — Mon, 05 Aug 2024 06:55:38 GMT

Hello Rasika Nayanajith,

Thanks alot for reply.

Could you let me know if you refer to any EAP certificate ?

If so should the new one generated on WLC or radius or suggest if something else.

Thanks

Rajesh

Re: Users are unable to authenticate from Radius server - cisco 9800 W

Mark Elsen — Mon, 05 Aug 2024 06:56:25 GMT

- Have a look at https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5

+ You may also want to engage in full client debugging according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
client debugs can be processed with Wireless Debug Analyzer

+ Common advisory : have a checkup of the 9800 WLC's configuration with the CLI command show tech wireless
and feed the output from that into Wireless Config Analyzer do not use a simple show tech as input for this procedure

Re: Users are unable to authenticate from Radius server - cisco 9800 W

MHM Cisco World — Mon, 05 Aug 2024 07:31:07 GMT

Re: Users are unable to authenticate from Radius server - cisco 9800 W

Rasika Nayanajith — Mon, 05 Aug 2024 09:59:39 GMT

Could you let me know if you refer to any EAP certificate ?

Yes, if all 802.1X client not able to connect out of sudden, always check the EAP certificate expiry.

If so should the new one generated on WLC or radius or suggest if something else.
It is typically on your RADIUS server (not on the WLC)

HTH
Rasika

Re: Users are unable to authenticate from Radius server - cisco 9800 W

JPavonM — Mon, 05 Aug 2024 15:20:07 GMT

Check the expiration date of your RADIUS server certificate been presented to the clients.

If it's a MS NPS one, the certificate is selected per-policy in the Constraints Tab, under PEAP or Smarcard selection.

If it's Cisco ISE, then look into Administration > Certificates and check the one selected for EAP in the PSNs.

Re: Users are unable to authenticate from Radius server - cisco 9800 W

Rajesh Kumar Reddy — Tue, 06 Aug 2024 06:52:29 GMT

Thanks alot for the support Rasika.

This worked for me post remapping the EAP certificate on the Radius server.

Re: Users are unable to authenticate from Radius server - cisco 9800 W

Rajesh Kumar Reddy — Tue, 06 Aug 2024 06:53:47 GMT

Thank you JPavonM,

It was issue with EAP certificate.

We have remapped the certificate on the radius server and users started authenticating.