NPS RADIUS – “Message-Authenticator attribute is not valid

[athan1234]

Hi everyone,

Some time ago, I configured an SSID using 802.1X authentication with NPS, and it has been working correctly.

Now, I need to add a new SSID to the same NPS server. In this case, the computer that will connect to the SSID is not joined to the domain.

I created a new Network Policy in NPS and placed it at the top of the policy list. The conditions are:

• NAS Port Type: Wireless – IEEE 802.11
• Calling Station ID: *.wifiname$

The complete IP range is already configured under RADIUS Clients.

However, when I try to connect to the Wi-Fi network, I receive the following error in the NPS Event Viewer:

An Access-Request message was received from RADIUS client x.x.x.x with a Message-Authenticator attribute that is not valid.

I have been reading about this error, and several posts suggest that it may be related to an incorrect shared secret.

I have checked the shared secret and it seems to be correct. Nevertheless, to rule this out, I created a new RADIUS client containing only this AP and configured a completely new shared secret on both sides, Meraki and NPS.

Unfortunately, I still receive exactly the same error.

Has anyone experienced this issue before or have any idea what else I could check?

Thanks in advance.

[aleabrahao]

Since you mentioned this works for another SSID against the same NPS server, I'd compare the RADIUS configuration of the working SSID versus the new SSID line-by-line. In my experience, when NPS throws "Message-Authenticator attribute is not valid", it's almost always a shared secret mismatch or the request is arriving from a different RADIUS client than the one defined in NPS.

[athan1234]

I can see that I am receiving the RADIUS request from this specific Access Point.

@aleabrahao , I have one question. Currently, I have the complete AP network configured as a RADIUS client. For testing purposes, would it be correct to add only this specific AP as a new RADIUS client using its /32 IP address and configure a new shared secret?

I already performed this test, configuring the same shared secret on both the AP and the RADIUS server, but I still received the same error.

In the RADIUS event logs, I can see that the request is coming from this specific AP, and in Wireshark I can also see the RADIUS request being sent.

This SSID uses a different VLAN from the one that is currently working. It is intended only for a PC using a local user account, as the PC is not joined to the domain. Could this be causing the issue?

[aleabrahao]

@athan1234 I really like proceeding this way, try adding this AP as a RADIUS client.
Can you see in the Event Viewer whether it is at least matching the correct policy?

[aleabrahao]

It would also be interesting for you to share all the settings of your policy.

[aleabrahao]

@athan1234 

Take a look at this.

https://documentation.meraki.com/Wireless/Design_and_Configure/Deployment_Guides/MAC-Based_Access_Control_Using_Microsoft_NPS_-_MR_Access_Points/Configuring_RADIUS_Authentication_with_WPA2-Enterprise#Supported_RADIUS_Attributes

[aleabrahao]

Just to confirm, your Called Station ID is configured as shown in the image, right?

Have you tried using the NAS ID?

[athan1234]

Hi,

I did another test using only the specific AP IP address as the RADIUS client 10.0.10.X/32

When I try to connect with only the AP IP configured, I get the message “Cannot connect to this network.” It seems that, when I configure only the AP IP, the authentication process does not even start.

However, when I remove the individual AP IP and configure the entire IP range again, I get the “Checking network requirements” message on the computer, and I can see the RADIUS request reaching NPS.

thenticator attribute that is not valid.

The relevant NPS event is:

Plain Text

1

Event ID: 18

2

Provider: NPS

3

4

An Access-Request message was received from RADIUS client 10.0.10.x

5

with a Message-Authenticator attribute that is not valid.

Mostrar más líneas

At this point, I don't think the shared secret is the problem, as I have already tested it with a new RADIUS client and a new shared secret configured on both NPS and the AP.

What I cannot determine is whether NPS is actually reaching the stage where it evaluates the Network Policies. Maybe the request is being rejected before any policy is checked.

However, I can confirm that the RADIUS request is coming from the expected AP IP address.

I have attached screenshots of my RADIUS client configuration and Network Policy.

The policy conditions are:

• NAS Port Type: Wireless – IEEE 802.11
• Called Station ID: *.WIFINAME$.

Yes i have SSID in advance  radius setting 

Any idea what else I could check, or how I can verify whether NPS is actually evaluating the policy?

Thanks!

[aleabrahao]

Based on the NPS error, I think you're looking in the wrong place now.

Event ID 18 - "Message-Authenticator attribute that is not valid" occurs before NPS evaluates Network Policies.

If NPS were evaluating your policy and rejecting it, you'd see events such as:

Event ID 6273 (Network Policy Server denied access)
Event ID 6272 (Network Policy Server granted access)

Instead, NPS is rejecting the RADIUS packet itself because the Message-Authenticator validation fails. That means the request never gets as far as checking:

NAS Port Type
Called-Station-ID
User/Computer groups
EAP settings
Policy order

So at this stage, your Called-Station-ID regex is effectively irrelevant.

One thing that caught my attention Called Station ID: *.WIFINAME$, Meraki typically sends Called-Station-ID in a format similar to
aa-bb-cc-dd-ee-ff:SSIDNAME or aa-bb-cc-dd-ee-ff:SSID Name

The fact that you're getting Event ID 18 strongly suggests NPS is not reaching Network Policy evaluation at all.

[aleabrahao]

Take a look at this article, I know it's for the WLC, but check out the NAS ID section. I think your regex or condition is incorrect.

https://wifinigel.blogspot.com/2014/03/the-microsoft-network-policy-server-nps.html

[Netwroking-GEEKER]

try ping the RADIUS OR NPS IP from the Controller or AP and check , if its fail so its conncetivity issue , also if its stuck with u ,i suggest using mac filtering feature , will help u 

[aleabrahao]

@Netwroking-GEEKER Please review the initial issue, we are talking about Cisco Meraki APs. If it were a communication problem, there wouldn't be any connection attempt logs in NPS.

[Jonatan Jonasson]

While I don't have a comment regarding the specific error - I want to ask you  about the conditions.

If I recall correctly, the "calling station id" is going to be the mac address of the client, while the "called station id" is going to include the SSID.

If you're using "Calling Station ID: *.wifiname$", couyld it be that the inbound request isn't matching the correct policy?

[Netwroking-GEEKER]

is it possible that u do have IPs overlapping ? like here supposed to be /32 ip for NAS only  , not range of IP's

also double check the secret and make sure after update it Restart the NPS to remove the Cache , 

and try this call station .*:wifiname$

[aleabrahao]

@athan1234 I'm not a Regex expert, but when I want it to accept anything before the name, I usually use this format:
^.*wifiname$