4

I am pretty new to this and am trying to set up WPA2 enterprise where users can connect to the Wifi using their AD credentials (PEAP-MSCHAPv2).

The Cisco WLC has been configured to relay requests to the NPS, which is also the DC. The NPS can be pinged from the WLC and vice-versa. Passwords have been checked and doubled checked and are correctly entered in the WLC and in the NPS for the radius client.

When trying to connect to the WiFi, test is user is prompted for their credentials, which is what we want. Creds are entered and we get the message that it was not able to connect.

Checking event viewer of the NPS (also the DC), I see the following errors:

  • Under Network Policy and Access Services:

    enter image description here

  • Under Windows Logs -> Application:

    enter image description here

  • Under Windows Log -> System:

    enter image description here

From what I have found online, reason 22 comes up when there is an issue with the cert. On the client side, I have disabled the need to validate certs (for testing purposes). I have added a cert from our CA (on a different DC) to the NPS as shown below:

enter image description here

Not sure why users are not able to connect or how to fix the error. Any suggestions or ideas are appreciated!

Edit - adding client config:

enter image description here

Not validating certs:

enter image description here

Also, from client, shows that EAP type 25 is being sent from Client:

enter image description here

Improve this question
3
  • Can you post the settings of the NPS Network Policy "Conditions" tab? In my setup it is setup with: Authenticaiton type = EAP / Nas Port Type = Wireless IEEE 802.11 / Windows Group = <my group of authorized users>
    – JFL
    Commented Feb 22, 2018 at 16:13
  • @JFL i have two conditions under my network policy: Nas Port Type = Wireless - Other or Wireless - IEEE 802.11 Windows Groups = domain/Users
    – Arturo Martinez
    Commented Feb 22, 2018 at 16:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Apr 19, 2019 at 6:22

1 Answer 1

Reset to default
1

PEAP-MSCHAPv2 does need to to validate server side certificate. I see you have disabled the need to validate certs (for testing purposes). It wont work without validating server side cert.

This looks like mis-configuration issue. You need to make sure same authentication type is used at both ends (client and server). Wireless profiles at client must be configured to use/support PEAP-MSCHAPv2. If you see your first screen shot, i dont see any value in front of 'EAP Type:' field. And in your last screen shot, select checkbox against MS-CHAPv2.

Improve this answer
4
  • I found one link. showing same behavior you seeing.
    – Vinnie
    Commented Feb 20, 2018 at 21:16
  • 2
    Validation of the cert is not required. That is a client side configuration, although this will make the connection significantly less secure.
    – YLearn
    Commented Feb 21, 2018 at 1:01
  • @Vinnie - I made the changes to Network Policy to accept the MS-CHAPv2 authentication method and this came up in the logs: Reason Code: 66 Reason: The user attempted to use an authentication method that is not enabled on the matching network policy. Also, I have edited the original post to include my current client side configuration.
    – Arturo Martinez
    Commented Feb 22, 2018 at 14:06
  • @ArturoMartinez its difficult to know the root cause here, because we don't know inside-out information about network details at your end. But log does say that end client and server are not talking same authentication protocol.
    – Vinnie
    Commented Feb 22, 2018 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.