topic Re: Radius Authentication Errors in Wireless

Radius Authentication Errors

Bohodir — Mon, 10 Jun 2024 16:12:35 GMT

Hello Community,

We are having intermittent Radius authentication issues last couple month now. Here is some background regarding our configuration:

We have 2 SSID is setup across all offices which are xxx_CORP and xxx_GUEST.

xxx_GUEST is based on permanent password authentication and works without issues.

However xxx_CORP is configured with Radius Authentication with certificate, and our radius

provider is radius-as-a-service.com. Intermittently our corporate devices like laptops are having

issues to connect. When I pull Meraki portal logs regarding authentication I see lots of these errors:

Client made an 802.1X authentication request to the RADIUS server, but it did not respond.auth_mode='wpa2-802.1x' vlan_id='50' radius_proto='ipv4' radius_ip='127.0.0.1' reason='radius_timeout' reassoc='1' radio='1' vap='0' channel='44' rssi='42'

With radius server we use secure radius configuration utilizing RadSec over TCP. I wondering why in the logs showing radius

server address as "127.0.0.1" why not actual radius server address configured ?

If anybody have any advice or experience I really appreciate your input.

Thank you very much.

Re: Radius Authentication Errors

aleabrahao — Mon, 10 Jun 2024 16:23:49 GMT

Have you had any recent firmware updates?

If so, which version are you running? Have you tried with another firmware version?

I also suggest you open a support case.

Re: Radius Authentication Errors

Bohodir — Mon, 10 Jun 2024 16:31:05 GMT

Thank you @alessandrodematos for quick response, here is firmware info:

Current version: MR 30.6

We upgraded couple month ago that also kind a aligns with radius issues, I have to check.

Re: Radius Authentication Errors

Philip D'Ath — Mon, 10 Jun 2024 21:06:27 GMT

What does the RADIUS server log show? Is it seeing the authentication request coming in? Is it allowing it or denying it (and if deny, why)?

Re: Radius Authentication Errors

Bohodir — Tue, 11 Jun 2024 15:45:54 GMT

Hey PhillipDath.

No unfortunately I do not see deny requests on Radius server. Especially from devices it has been issues. That's baffling me.

Re: Radius Authentication Errors

aleabrahao — Tue, 11 Jun 2024 15:50:30 GMT

In your place I would try to downgrade or upgrade to another version just to test. It would be interesting to request support from Meraki support.

Re: Radius Authentication Errors

kchand1 — Fri, 14 Jun 2024 13:36:46 GMT

Hello,

It is expected to observe 127.0.0.1 IP address while using the RADSec over TCP. Did you notice if the Access-Request messages are reaching your RADIUS server?

I will also recommend calling support to take a packet capture and confirm where the RADIUS authentication is failing on your network.

Re: Radius Authentication Errors

Henry-M — Mon, 21 Oct 2024 10:53:04 GMT

Was there ever a fix for this? I've got a similar issue using a cloud based Radsec provider.

The client will authenticate in the end but it generates alerts along the way...

Re: Radius Authentication Errors

Bohodir — Mon, 21 Oct 2024 18:11:47 GMT

No never fixed the issue, but occurrences is decreased. I suspecting Radius-as-Service issue. I'm still building on prem solution for this issue.