9800-80 running IOS 17.12.4 failed RADIUS when added a new PSN server

[DATHOZ]

We encountered an issue yesterday during testing with IOS version 17.12.4 (recommended) after adding a new RADIUS server to our ISE deployment. The problem arises when the RADIUS shared secret on the WLC contains special characters, specifically "@" and "_".

When we added a new ISE Policy Service Node (PSN) or attempted to modify the password to include any special character, authentication failed consistently. The failure was observed for both initial authentication and accounting requests.

The ISE logs indicate the following errors:

Error 1 (ISE log):

• Failure Reason: 11036 The Message-Authenticator attribute is invalid.
• Possible Resolution (from ISE): Check whether the Shared Secrets, configured on the Network Access Device and the RADIUS Server, match. Ensure that the AAA client, and the corresponding Network Access Device, have no hardware problems or problems with RADIUS or TACACS+ protocol compatibility. Also ensure that the RADIUS client, or the Network Access Device to the ISE, has no hardware problems.
• Root Cause (from ISE): The Message-Authenticator RADIUS attribute is invalid. This problem maybe because of mismatched Shared Secrets.

Error 2 (ISE log):

• Failure Reason: 11038 RADIUS Accounting-Request has invalid Message-Authenticator field
• Possible Resolution (from ISE): Ensure that the RADIUS Shared Secret configured on the RADIUS client matches that configured for the corresponding Network Access Device on the ISE server. Also, ensure that the RADIUS client has no hardware problems or problems with RADIUS protocol compatibility.
• Root Cause (from ISE): ISE cannot validate the Authenticator field received in the RADIUS Accounting-Request packet. The Message-Authenticator field should not be considered as an indication of an invalid Authenticator RADIUS attribute.

We suspect the issue lies in how the IOS version 17.12.4 handles special characters within the RADIUS shared secret, causing a mismatch in the Message-Authenticator attribute.

Do you know if this is a known bug with 17.12.4 or a related IOS version? If so, is there a fix or workaround available other than changing the password to avoid special characters?

[marce1000]

  - It seems at least related to the handling of the shared secret indeed on 17.12.4 :
    Ref : https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/118673-technote-radius-00.html
   >...
   >

11038 RADIUS Accounting-Request header contains invalid Authenticator field

The typical reason for this is the incorrect shared secret key.

                        (>earlier in the document
 >...
 When to expect validation failure:
Validation failure occurs when the shared secret is invalid. Then, the AAA server is not able to validate the request.
The ISE reports:

11036 The Message-Authenticator Radius Attribute is invalid.

   - You may need to escalate (contact TAC)

  M.

[MHM Cisco World]

In ISE allow protocol' enable message-authenticator 

MHM

[Rich R]

How are you entering the secret - on GUI or CLI?
If GUI have you tried CLI, if CLI have you tried GUI?
How long (how many characters) is the secret you are using?  Have you tried using a shorter secret?
Generally speaking you should avoid using a special character and the first character in the secret.
What type of password/key encryption are you using? None/Type 7/AES
You could take the pre-encrypted version of the key from a working version of IOS and try that?