2016 NPS Server does not work for a few select devices

[bjaegf119]

We have a few devices that do not appear to authenticate with our new 2016 NPS server.  If we move these devices back over to our legacy 2003/2008 NPS servers, the devices authenticate.  I have checked over the settings and and they all appear to be the exact same across each platform.  I have engaged the vendor of one of these device types but thought I would throw this out there.  This is all setup for PEAP.  Historically we have never had to install a certificate on the devices themselves.  There are a few devices out there which require the certificate.  In this instance one of the devices in question has never needed a certificate before.

Without the certificate the device gives error code 23: 

An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors.

With a certificate the device gives error code 265:

The certificate chain was issued by an authority that is not trusted.

I have also performed a client debug and have enabled the following:

debug dot1x aaa

debug dot1x events

debug dot1x packet

[Scott Fella]

With a new radius server, you must make sure all the root CA and intermediate CA are installed on the NPS server. So compare what is installed on your legacy vs you new and export then import the cert.

[Scott Fella]

Thinking about it, since you are doing PEAP, it’s the client devices that need to trust the root CA that is being used for auth on the radius server.

[bjaegf119]

I have checked and the same root certs live on both servers in question.

[Jurgens L]

Double check that the required certs are mapped for your policies on the NPS, sometimes if you have multiple certs on your server they get mixed up and may be mapped to an incorrect cert. Also don’t forget to register the NPS with AD (right-click on the NPS)



<<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>>