WLC 5508 fails 802.1x authentication when upgrading from version 7.4 to any version 8 OS

[grettel.aviles]

I have two WLCs paired in an HA running versión 7.4.121. Several SSIDs with 802.1x authenticate against a RADIUS server in a Windows 2008 server. Users authenticate normally on WLC running version 7, but once I upgrade to version 8 (I tried 8.0.140 and 8.2.151) all users fail to authenticate on 802.1x SSIDs. We already checked both sides (RADIUS and WLC) and nothing seems to change, except the logs from the WLC indicate AAA authentication failure from user xxxxx, while the RADIUS keeps sending the reason code 66, but no policies have changed and neither have the passwords for users.

I'll appreciate any feedback you could give on this matter as we've tried 3 times to upgrade this and Cisco TAC says it's not a WLC issue. Any tests you might've made (whether on the WLC or if it could be a Windows issue) will surely help.

I'm attaching the NPS version.

Regards.

[Rasika Nayanajith]

As per the below status code 66 indicate policy matching issue. Make sure appropriate EAP types are allowed.

https://technet.microsoft.com/en-us/library/dd197521(v=ws.10).aspx

66: Authentication failed. Either the client computer attempted to use an authentication method that is not enabled on the matching network policy or the client computer attempted to authenticate as Guest, but guest authentication is not enabled. To resolve this issue, ensure that all client computers are configured to use one or more authentication methods that are allowed by matching network policies.

If you have test setup I would use it to test it before upgrade production WLCs again.

HTH

Rasika

*** Pls rate all useful responses ***

[grettel.aviles]

Hi Rasika,

I verified that appropriate EAP types were enabled on a recent maintenance window attempting to make this upgrade work. As I mentioned before, there were no changes made on the RADIUS once I upgraded the WLC to version 8. We even used some test commands on the WLC's console to check if connectivity and compatibility to the RADIUS was established and it was successful.