topic Re: RADIUS Authentication Failed in Wireless

RADIUS Authentication Failed

DaveCoughlan — Sun, 04 Jul 2021 03:50:06 GMT

Hi,

Im having trouble getting a Cisco 881W to authenticate with my RADIUS server. Other APs work fine but I cant get it to authenticate on the routers. When I try to connect, I get the following message:

DOT11-7-AUTH_FAILED: Station 0000.1111.2222 Authentication failed

Debug Radius gives me the following:

Sep 28 13:27:38: RADIUS/ENCODE(00000023):Orig. component type = DOT11
Sep 28 13:27:38: RADIUS: AAA Unsupported Attr: ssid              [265] 13
Sep 28 13:27:38: RADIUS:   4D 69 6E 64 41 75 73 74 72 61 6C                 [Min
dAustral]
Sep 28 13:27:38: RADIUS: AAA Unsupported Attr: interface         [157] 3
Sep 28 13:27:38: RADIUS:   32                                               [2]
Sep 28 13:27:38: RADIUS(00000023): Config NAS IP: 192.168.28.40
Sep 28 13:27:38: RADIUS/ENCODE(00000023): acct_session_id: 35
Sep 28 13:27:38: RADIUS(00000023): Config NAS IP: 192.168.28.40
Sep 28 13:27:38: RADIUS(00000023): sending
Sep 28 13:27:38: RADIUS/DECODE: No response from radius-server; parse response;
FAIL
Sep 28 13:27:38: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);
parse response; FAIL

The shared secret is correct and I can ping the radius server, not sure why its saying 'No response'.

Can anyone shed some light on this for me?

RADIUS Authentication Failed

Nigel Bowden — Wed, 28 Sep 2011 14:47:10 GMT

Maybe your RADIUS server is listening on the wrong port..? (1812/1645 ?)

RADIUS Authentication Failed

jliscano — Wed, 28 Sep 2011 19:34:50 GMT

Have you tried sourcing the interface for radius?

ip radius source-interface

Re: RADIUS Authentication Failed

DaveCoughlan — Thu, 29 Sep 2011 00:08:58 GMT

Thanks for the responses..

Nigel,

The server is listening on ports 1812/1813 and 1645/1646. Router is using 1812 & 1813.

jliscano,

BVI1 is set as the sourcing interface already. Posting the shortened config below:

Building configuration...

hostname SAHO-AP

aaa new-model

aaa group server radius rad_eap

server 192.168.x.167 auth-port 1812 acct-port 1813

aaa group server radius rad_mac

aaa group server radius rad_acct

server 192.168.x.167 auth-port 1812 acct-port 1813

aaa group server radius rad_admin

aaa group server tacacs+ tac_admin

aaa group server radius rad_pmip

aaa group server radius dummy

aaa authentication login eap_methods group rad_eap

aaa authentication login mac_methods local

aaa authorization exec default local

aaa accounting network acct_methods start-stop group rad_acct

aaa session-id common

clock timezone EST 10

clock summer-time D-EST recurring 1 Sun Apr 2:00 1 Sun Oct 3:00 1

ip domain name xxxx

ip name-server 192.168.x

dot11 syslog

dot11 ssid (omitted)

vlan 1

authentication open eap eap_methods

authentication key-management wpa version 2

accounting acct_methods

guest-mode

dot11 ids mfp distributor

dot11 ids mfp detector

dot11 ids mfp generator

crypto pki trustpoint TP-self-signed-x

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-x

revocation-check none

rsakeypair TP-self-signed-x

crypto pki certificate chain TP-self-signed-x

certificate self-signed 01

quit

bridge irb

interface Dot11Radio0

no ip address

no ip route-cache

encryption vlan 1 mode ciphers aes-ccm

broadcast-key vlan 1 change 30

ssid (Omitted)

antenna gain 0

station-role root

interface Dot11Radio0.1

encapsulation dot1Q 1 native

no ip route-cache

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled

interface GigabitEthernet0

description the embedded AP GigabitEthernet 0 is an internal interface connecti

ng AP with the host router

no ip address

no ip route-cache

interface GigabitEthernet0.1

encapsulation dot1Q 1 native

no ip route-cache

bridge-group 1

no bridge-group 1 source-learning

bridge-group 1 spanning-disabled

interface BVI1

ip address 192.168.x.40 -------------

no ip route-cache

ip http server

ip http authentication local

ip http secure-server

ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag

ip radius source-interface BVI1

snmp-server community xx RW

snmp-server host 192.168.x.36 xx snmp

radius-server attribute 32 include-in-access-req format %h

radius-server host 192.168.100.167 auth-port 1645 acct-port 1646 key xx

radius-server vsa send accounting

bridge 1 route ip