So I've read about 2 weeks of posts trying to figure this out and read multiple guides to no avail. So i'm hoping it's a stupid mistake. First here is my AP config.
ap#sh run
Building configuration...
Current configuration : 1750 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
logging rate-limit console 9
enable secret 5 $1$ONQR$Qrzcg9Lyrt2tFlyki7Qr4/
!
aaa new-model
!
!
aaa group server radius rad_eap
server 10.10.11.200 auth-port 1812 acct-port 1813
!
aaa authentication login eap_methods group rad_eap
!
aaa session-id common
!
!
dot11 syslog
!
dot11 ssid syrushcw
authentication open eap eap_methods
authentication key-management wpa version 2
guest-mode
!
!
!
username Cisco password 7 1531021F0725
!
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption mode ciphers aes-ccm
!
encryption vlan 1 mode ciphers aes-ccm
!
ssid syrushcw
!
antenna gain 0
speed basic-11.0 basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.
channel 2437
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 10.10.11.100 255.255.252.0
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server host 10.10.11.200 auth-port 1812 acct-port 1813 key 7 12092504011C5C162E
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
!
end
ap#
I do not know if the problem is on the AP or NPS server. I've read things such as worked fine on 2008 but exported and imported the config on 2008R2 and did not work. I am of course running 2008 R2. I've alse read NPS expects to get credentials in MD5-CHAP but cisco sends in Plain Text. I Know the client and server are talking since if I make a change on the server the cliet error is diffrent. Example
ap#test aaa group rad_eap cmclaine password legacy
Attempting authentication test to server-group rad_eap using radius
No authoritative response from any server.
If I uncheck Access-Request message must contain the Message-Authenticator attribute under Radius Clients Properties in NPS I get.
ap#test aaa group rad_eap cmclaine password legacy
Attempting authentication test to server-group rad_eap using radius
User authentication request was rejected by server.
In even viewer I see events such as Event ID 17 " An Access-Request was recieved from Radius client 10.10.11.100 without a Message-Authenticator attribute when a Message-Authenticator attribute is required."
I do not know if it matters I am running this on a Virtual Machine; I've tried both Virtual Box and Hyper-V. The virtual Machine has the fireall turned off, the only reason I bring this up; is when I do a netstat there are no connections to port 1812 or 1813.
I appreciate any help, thanks!
