04-26-2024 11:17 AM
Team, We are experiencing a recurring problem with our NPS and Cisco Meraki MR Access Point. This issue has surfaced recently, where the AP authentication initially functions properly upon installation but stops working after 3 hours, despite no alterations to the network configuration. The notable difference in the logs is the appearance of the user as Security ID: NULL SID (previously displayed as the username).
The reason for this anomaly is identified as a malformed RADIUS Request message received by the Network Policy Server from the network access server.
Reason : The RADIUS Request message that Network Policy Server received from the network access server was malformed.
Our network setup consists solely of Meraki APs, connected in the following sequence: MR ----> Aruba Switch ----> Palo Alto Firewall ----> RADIUS via IPsec tunnel. Looking forward to hearing from you guys soon...
04-26-2024 12:14 PM
You might want to provide some more detailed information on what's going on. You might want to check the Event Viewer on the NPS server - look for Event IDs 6272 and 6273.
04-26-2024 02:52 PM
If you collect the data packets from the Aruba switch, are they malformed there, or okay?
04-28-2024 01:09 PM
>This issue has surfaced recently
Take a look under Organization/Firmware upgrades. Does it show a recent firmware update? If so, roll back the change.
Otherwise, what changed around the timeframe that the issue started happening?
04-28-2024 01:10 PM
Once it is broken, I would also do a packet capture.
Also, if you have RADIUS packets going over a WAN - an MTU restriction can cause RADIUS packets to fail.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide