CSCug17169 - System password-encryption changes radius password

[austinspiller]

Has anyone been hitting this bug lately? In particularly when running 17.x.x code.

We are encountering an intermittent issue when upgrading code on our 9800 series WLCs, upon boot with new code all AAA/RADIUS authentication is broken. Only PSK WLANs are able to be connected to.

Here is an example of a log we receive: 086227: Jul 8 2025 09:10:59.028 EDT: %DOT1X-5-FAIL: Chassis 1 R0/0: wncd: Authentication failed for client (90cc.df39.0bca) with reason (AAA Server Down) on Interface capwap_90000056 AuditSessionID 06228B0A00000221EA29367A Username: host/TomSmithPC

While we see these logs in the console, we never see them on the Free RADIUS Server. However - if we issue a CLI aaa test command, we get a "SUCCESS" - and we see the static account successfully authenticate from the Free RADIUS side. All while client-side authentication fails.

Key Points:

• CLI Tests always succeed no matter if client fails/passes
• Full connectivity is established between RADIUS and WLC - ping is successful.
• No FW is blocking traffic
• Confusion as if we are hitting this old bug - or if this is a new bug. Keys would have to be correct in order for the test aaa command to be a success.

[Rich R]

Never ever seen that bug from 17.3.x to 17.15.x and every version in between. Given that it has only 3 cases attached in the 12 years since it was opened I'd say it's pretty rare.  I suspect there must be some very specific variant of config which triggers this in very rare cases which they haven't bothered to detail/mention in the bug notes.  The fact that they've classified it as Minor (Sev 4) and still not fixed it after 12 years also suggests they don't expect many customers to be affected.

First: what version of software exactly?

Second: there are other bugs you are more likely to be hitting.

If it was CSCug17169 then you would still see logs on Free Radius saying that there was an invalid authenticator on the requests (depending on log level enabled).

Make sure you are using TAC recommended IOS (link below) and use the Config Analyzer (link and instructions below) to check your config for errors and highlight best practices. Also see the Best Practices link below which has a tip on RADIUS Server Timeout.

[MHM Cisco World]

I think I Answer you before 

But anyway 

System password protection only encrypt password when you do show not encrypt when wlc use to connect to server

And as workaround only config radius again and add password again 

MHM

[Saikat Nandy]

If you run 'show aaa servers' during the problem state, do you see the status as 'Dead'?