AD test connection error

[athan1234]

How for set up a 8021x PEAPMSCHAV It is mandatary to have a CA in meraki.

I decided builting a connector that fights AD.
I built a user connector with administrative privileges. .
And a user for test .

This SSID is in the mode bridge tags vlan corporative .
Muy client don't have mx; they also have wireless.

Test is wrong, any idea?

I

[aleabrahao]

First point to correct, CA is not mandatory in Meraki, it is the way 802.1x works. that is, for any other vendor it is necessary to have a CA.

Second point, are you sure the communication port is correct?

[athan1234]

Hi @alessandrodematos thanks for your reply . You can deploy 8021x in NPS authentification EAP MSCHAV2 without CA .

[aleabrahao · Accepted solution]

Wrong, you cannot, it's a requirement for 802.1x. Please ready the documentation.

[aleabrahao]

By the way, for Sign-on with AD is necessary to have a CA.

Configuration and Requirements

In order to configure a splash page with Active Directory authentication, configuration steps must be completed on both Dashboard and Active Directory, outlined below:

Active Directory Configuration

The following requirements must be configured on each AD server being used for authentication:

• Every AD server specified in Dashboard must hold the Global Catalog role. Please refer to Microsoft documentation for specific configuration steps.
• Since communication between the MR and AD server will be encrypted using TLS, a valid certificate with the appropriate parameters must be configured on the server.
  • If no certificate is present, it will be necessary to install a Self-Signed certificate.
  • If a certificate already exists, please ensure that it has been configured with the necessary parameters for TLS.
• The MR will communicate from its LAN IP with each AD server over TCP port 3268, to ensure that no firewalls or ACLs on the network or server will block that communication.

When Active Directory authentication is configured, the MR queries the Global Catalog over TCP port 3268. Therefore the Active Directory server (Domain Controller) specified in Dashboard must also hold the Global Catalog role.

https://documentation.meraki.com/MR/MR_Splash_Page/Integrating_Active_Directory_with_Sign-On_Splash_Page_For_MR_Access_Points

[athan1234]

If you recall, I asked you how to deploy an 8021x around a month ago, roughly. You responded that it was impossible without a CA, so I deployed in order client Sign-on with AD, which works well even though the client lack a CA.