topic Re: cisco WLC radius authentication issue in Wireless

cisco WLC radius authentication issue

fasalrman@gmail.com — Mon, 05 Jul 2021 17:43:25 GMT

Hi All,

currently iam working on a migration of Cisco wlc 2504 to 3504.

we are using radius authentication with windows NPS to authenticate clients. when i am trying to connect the SSID, computer prompt me to enter the user name and password. once i enter credential it show the certificate in which the thumb print is same as my server certificate used for NPS. once i connect, getting ip address through dhcp and client shows connected. NPS server log shows authentication granted access logs and.i can see the connected client in the wlc.

the issue is wlc generated SNMP trap as, AAA Authentication Failure for Client MAC: 00:24:d7:96:8c:38 UserName:test User Type: WLAN USER Reason: Authentication failed in the controller.

authentication succeeded and client got the ip address through dhcp and shows connected, still WLC showing authentication failure traps.

wlc model: cisco wlc 3504

software version: 8.5.131.0

access point model: cisco 1532e outdoor

what could be the possible issues?

attached screen shots

Re: cisco WLC radius authentication issue

Francesco Molino — Thu, 18 Jul 2019 04:10:41 GMT

Hi

I don't have any 3504 right now but can you share your ssid please or can you validate you have the exact same config between old and new wlc?

Re: cisco WLC radius authentication issue

fasalrman@gmail.com — Thu, 18 Jul 2019 04:54:12 GMT

Hi,

Thank you for the reply

kindly find the attached the ssid details

Re: cisco WLC radius authentication issue

Francesco Molino — Thu, 18 Jul 2019 15:34:42 GMT

Thanks for sharing. Can you share the advanced tab config please? I would disable all extra features like Fast Transition to do the test and also enable the account radius in your ssid. Then, just for testing and to keep a config clean for troubleshooting, I would remove local and ldap from Authentication order protocols.

While authenticating, can you a run a debug on your WLC?

Thanks

Re: cisco WLC radius authentication issue

patoberli — Fri, 19 Jul 2019 14:34:56 GMT

Do you talk about the user 'test'?
Or do you mean the last line of the screenshot?

Have you added the new WLC IP (assuming it's not using the same addresses as the old one) as a Radius Client on NPS?
What is written in the Event Viewer under Security when you try to authenticate?
Which software version is running on the new WLC?

Re: cisco WLC radius authentication issue

fasalrman@gmail.com — Fri, 19 Jul 2019 18:46:06 GMT

Hi All,

contacted cisco TAC and they concluded that when iam trying from my pc which is under my company domain, the first time NPS denied access to the client the first time it is using my own username to authenticate, after 9 seconds the event viewer shows NPS granted access to the client by using the provided username and password.

Tried with mobile and another workstation which is under workgroup no errors were there in WLC

Re: cisco WLC radius authentication issue

fasalrman@gmail.com — Fri, 19 Jul 2019 18:47:04 GMT

Hi All,

Contacted Cisco TAC and they concluded that when iam trying from my pc which is under my company domain, the first time NPS denied access to the client the first time it is using my own username to authenticate, after 9 seconds the event viewer shows NPS granted access to the client by using the provided username and password.

Tried with mobile and another workstation which is under work group no errors were there in WLC

Re: cisco WLC radius authentication issue

patoberli — Fri, 19 Jul 2019 19:32:59 GMT

Yeah, normal behaviour for domain joined devices. You can create a group policy with the correct profile settings to work around that.