Greetings all, I tried searching and couldn't find a solution so I thought I would ask for assistance. I have a 9800-L that is replacing some old 5508's. I am trying to duplicate the RADIUS config and running in to an issue where it seems the WLC is sending the credentials formatted incorrectly. The SID doesn't contain the AD Domain name, rather it says NULL SID. The Account name is just the MAC address, it doesn't have the single hyphen delimiter, and the Fully Qualified Account Name is just Domain\MAC Address rather than the full group membership and object name I see when things are working.
Any Ideas? Thank you! (I replaced some identifying information like the domain name with the word "domain")
When things work on the 5508, I see the following message in the NPS logs:
User:
Security ID: Domain\047295-46cbca
Account Name: 047295-46cbca
Account Domain: Domain
Fully Qualified Account Name: Domain/AD OU/Account Name
Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
OS-Version: -
Called Station Identifier: b4-de-31-d0-6e-e0:SSID
Calling Station Identifier: 04-72-95-46-cb-ca
NAS:
NAS IPv4 Address: WLC IP Address
NAS IPv6 Address: -
NAS Identifier: WLC Name
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 13
RADIUS Client:
Client Friendly Name: WLC Name
Client IP Address: WLC IP Address
Authentication Details:
Connection Request Policy Name: Use Windows authentication for all users
Network Policy Name: "SSID" Access
Authentication Provider: Windows
Authentication Server: NPS Server FQDN
Authentication Type: PAP
EAP Type: -
Account Session Identifier: 36303838363639642F30343A37323A39353A34363A63623A63612F383231383433
Logging Results: Accounting information was written to the local log file.
Quarantine Information:
Result: Full Access
Session Identifier: -
The log entry for failed requests, on the NPS server getting requests from the new WLC looks like this:
User:
Security ID: NULL SID
Account Name: 8c705afc3400
Account Domain: Domain
Fully Qualified Account Name: Domain\8c705afc3400
Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
OS-Version: -
Called Station Identifier: f4-bd-9e-a0-c9-20:SSID
Calling Station Identifier: 8c-70-5a-fc-34-00
NAS:
NAS IPv4 Address: WLC IP Address
NAS IPv6 Address: -
NAS Identifier: a4-53-0e-9b-26-2b:WLC Name
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 20020
RADIUS Client:
Client Friendly Name: WLC Name
Client IP Address: WLC IP Address
Authentication Details:
Connection Request Policy Name: Use Windows authentication for all users
Network Policy Name: -
Authentication Provider: Windows
Authentication Server: NPS Server FQDN
Authentication Type: PAP
EAP Type: -
Account Session Identifier: -
Logging Results: Accounting information was written to the local log file.
Reason Code: 16
Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.
