[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is invalid

[Patrick Tran]

Hi,

I got many Cisco AP which are linked to 2 Cisco WLC.

On each WLC, I configured a primary and a secondary RADIUS Server.

RADIUS servers are Cisco ACS 5.2.0.26 (patch 10)

Primary and secondary ACS configurations are synchronized.

There are no problem between primary WLC and Cisco ACS (primary and secondary).

When secondary WLC requests primary Cisco ACS, I get this error "11036 The Message-Authenticator RADIUS attribute is invalid"

Secondary WLC automatically contacts secondary Cisco ACS and it works fine.

Cisco ACS description for this error: "This maybe because of mismatched Shared Secrets."

The two Cisco ACS are synchronized so I should have same error on them...

Why does primary ACS generate this error?

Thanks for your help,

Patrick

[Amjad Abdullah · Accepted solution]

Patrick: The shared secret mismatch could be from WLC side, not from ACS side.

Make sure that the shared secret of the primary radius server is configured correctly on the secondary WLC.

HTH

Amjad

[Tarik Admani]

Amjad,

That is a good observation, shouldnt 7.3 (which recently released) help put these types of issues to rest? I hear that the configuration can now be replicated from one controller to the next in a failover setup.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Amjad Abdullah]

Tarik Admani wrote:
Amjad,
That is a good observation, shouldnt 7.3 (which recently released) help put these types of issues to rest? I hear that the configuration can now be replicated from one controller to the next in a failover setup.
Thanks,
Tarik Admani 
*Please rate helpful posts*

Yes. That is a good point.

With 7.3 you can use high availability (HA) between two WLCs and you can configure only one WLC (the primary) and all the configuraiotn can be replicated and synched to the other WLC (the secondary).

The two WLCs in the HA must be on same subnet though. Otherwise hot-standby HA between WLCs can't be used.

Rating useful replies is more useful than saying "Thank you"

[Patrick Tran]

Hi Amjad,

Thanks for your help.

It was a shared secret mismatch from WLC side...

Regards,

Patrick

[Amjad Abdullah]

Thank you Patrick,

Glad that I could help.

Rating useful replies is more useful than saying "Thank you"

[maruti.hv]

its old post but on newer version of 9800 WLC there was similar issue but later it found to be BUG

check below link for more details

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi93213