802.1X EAP failure with Windows AD Radius - Help!

[ElectroDan]

Okay so I've spent several DAYS on this and seem to be getting nowhere 😕 I'm starting to get fairly frustrated having followed numerous guides exactly.

I used this to setup the Meraki side:

https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise

This is the latest guide I followed:

http://www.cracknells.co.uk/servers-side/configuring-radius-authentication-for-a-wireless-network-802-1x-eap/

No matter what I try though, I can't get my phone or laptop to connect, nor get the Test function to succeed from the SSID > Radius Servers section.

When I click Test, I get:
Total APs: 14
APs failed: 14

I have Accounting enabled on the Windows Server (which is now a DC running Server 2016. I had been running 2012 R2 but decided to wipe it and install 2016 afresh as though maybe RADIUS worked better!). The NPS Account log shows this when I click the Test button:

<Event><Timestamp data_type="4">11/15/2018 14:15:21.607</Timestamp><Computer-Name data_type="1">MY-DC03</Computer-Name><Event-Source data_type="1">IAS</Event-Source><Class data_type="1">311 1 10.33.102.23 11/15/2018 13:06:56 231</Class><Client-IP-Address data_type="3">10.32.108.21</Client-IP-Address><Client-Vendor data_type="0">0</Client-Vendor><Client-Friendly-Name data_type="1">Meraki - AP1</Client-Friendly-Name><Session-Timeout data_type="0">30</Session-Timeout><Proxy-Policy-Name data_type="1">Meraki Staff Secure Wireless Connections</Proxy-Policy-Name><Provider-Type data_type="0">1</Provider-Type><SAM-Account-Name data_type="1">MYDOMAIN\JohnDoe</SAM-Account-Name><Fully-Qualifed-User-Name data_type="1">MYDOMAIN\JohnDoe</Fully-Qualifed-User-Name><Authentication-Type data_type="0">5</Authentication-Type><NP-Policy-Name data_type="1">Meraki Staff Secure Wireless Connections</NP-Policy-Name><Packet-Type data_type="0">11</Packet-Type><Reason-Code data_type="0">0</Reason-Code></Event>

I get pretty much the same error logged when trying to connect from my laptop. I also see this in the Meraki event log:

Nov 15 14:24:57	Purchasing	Radius_Test	ITSPARE01	802.11 association	channel: 40, rssi: 29
Nov 15 14:24:57	Purchasing	Radius_Test	ITSPARE01	802.11 disassociation	unknown reason
Nov 15 14:24:57	Purchasing	Radius_Test	ITSPARE01	802.1X deauthentication	radio: 1, vap: 4, client_mac: 84:3A:4B:56:F4:5C more »
Nov 15 14:24:48	Purchasing	Radius_Test	ITSPARE01	802.1X deauthentication	radio: 1, vap: 4, client_mac: 84:3A:4B:56:F4:5C more »
Nov 15 14:24:48	Purchasing	Radius_Test	ITSPARE01	802.11 association	channel: 40, rssi: 28
Nov 15 14:24:47	Purchasing	Radius_Test	ITSPARE01	802.11 disassociation	unspecified reason
Nov 15 14:24:47	Purchasing	Radius_Test	ITSPARE01	802.1X deauthentication	radio: 1, vap: 4, client_mac: 84:3A:4B:56:F4:5C more »
Nov 15 14:24:47	Purchasing	Radius_Test	ITSPARE01	802.1X EAP failure	radio: 1, vap: 4, client_mac: 84:3A:4B:56:F4:5C more »
Nov 15 14:24:47	Purchasing	Radius_Test	ITSPARE01	802.1X deauthentication	radio: 1, vap: 4, client_mac: 84:3A:4B:56:F4:5C more »
Nov 15 14:24:47	Purchasing	Radius_Test	ITSPARE01	802.11 association	channel: 40, rssi: 29

Any ideas?

[Udi Burg]

But when configuring NPS radius there is no use of user name and password.

The issue is that the initial test doesn't pass.

[kschutte]

Good day all,

I had a similar issue and would just like to share what resolved it for me.

After getting a radius error stating in the logs stating that "The RADIUS Request message that Network Policy Server received from the network access server was malformed."

I did a verbose packet capture and found that the packet was indeed not well formed and seems to be missing some data.

Turns out this was caused by a Bad MTU size, since my radius server sits in the cloud and is reached via VPN.

So the upstream provider used a MTU size of 1400 and Meraki MX by default uses 1500.

as you can imagine this caused some issues with the radius packets.

After logging a request for Meraki to change my MTU size to 1338, everything started working with Radius again.

Here is an article about changing the MTU size for Meraki. https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Troubleshooting_MTU_Issues

I ran this ping to test and kept lowering the MTU until I found the correct combo that produced a successful ping response.

ping "My Radius Server" -l 1472 -f

Hope this helps someone.

[rodflores8]

Thank you so much Berlin_IT_Guy. That fixed our problem. I did not call Meraki to change the MTU. I added the Frame-MTU attribute on the NPS server under the settings tab of our network policy and set it to 1344. I'll adjust that later but our wireless network is finally up. Thank you!

[sureelam]

Team,

We are experiencing a recurring problem with our NPS and Cisco Meraki MR Access Point. This issue has surfaced recently, where the AP authentication initially functions properly upon installation but stops working after 3 hours, despite no alterations to the network configuration.

The notable difference in the logs is the appearance of the user as Security ID: NULL SID (previously displayed as the username). The reason for this anomaly is identified as a malformed RADIUS Request message received by the Network Policy Server from the network access server.

Reason : The RADIUS Request message that Network Policy Server received from the network access server was malformed.

Our network setup consists solely of Meraki APs, connected in the following sequence: MR ----> Aruba Switch ----> Palo Alto Firewall ----> RADIUS via IPsec tunnel.

Looking forward to hearing from you guys soon...

[kschutte]

We had a sumular issue and it turned out to be due to MTU size. The packets would be broken up into smaller chunks that are not big enough to contain the header information in the packet required for raduis auth. The packets then arrive with only partial incomplete header information. Changing to the correct MTU fixed the issue for us.

[mito1]

Thank you for posting this! I've been fighting with this for over a week and your suggestion worked!

[Philip D'Ath]

This thread is 6 years old. It would be better if you started a new thread.

[AZR-DDespard]

Putting this here in case someone has this issue but user specific.

I was having a similar issue with Radius authentication. What I did to resolve this was narrow it down to a select group of users. Opened their AD accounts server side. On the dial-in tab, Changed the radial button under Network Access Permission to "Control access through NPS Network Policy". Applied and worked like a charm.

[Philip D'Ath]

I better way to handle this @AZR-DDespard is in the NPS policy tick the option to ignore the dial-in properties. They are a relic from the past.

[tyoung008]

I have an update on this thread.

1. The Test button does not work with NPS. It appears not to use PEAP and MS-CHAPv2, or maybe it is a TLS issue as described earlier. I don't want to modify the registry and enable TLS 1.0 or 1.1.
2. The WiFi client DOES work. So, keep that in mind when using the Test button.

[AdvantageProfessional]

No, it works just fine, been using it for several years across multiple deployments.

Make sure you set your certificate in nps policy to allow it to communicate with meraki securely, even unsigned will do.

[rodflores8]

Thank you for the post Mizerka. I'm new to certs, our test button does not work. How do you make the cert allow communication with Meraki securely?

[AdvantageProfessional]

you have to give it some cert, doesn't matter which one even, I still use just my nps server's self signed cert, but it NEEDS one to be able to use mschap and to authenticate correctly, recently I've installed ad ca role on my nps server which broke this and I had to recreate self signed in nps policy to get it going again.

[rodflores8]

Thank you for the reply back Mizerka. Actually after I reduced the MTU size as indicated by Berlin_IT_Guy it not only resolved the connection problem but also fixed the Test button failing. By the way, we did not call Meraki to change the MTU size. Instead I changed the network policy on our NPS server on the Settings tab under Standard. I added the Frame-MTU attribute and set it to 1344. That got everything working again. I'll gradually increase it to see how high I can set it but so glad the wireless is working again after trying many things for several days. Thank you all!

[WB2]

Ye sorry just chipping in to say we run PEAP w/ MS-CHAPv2 and it works well for us!