3

I am pretty new to this and am trying to set up WPA2 enterprise where users can connect to the Wifi using their AD credentials (PEAP-MSCHAPv2).

The Cisco WLC has been configured to relay requests to the NPS, which is also the DC. The NPS can be pinged from the WLC and vice-versa. Passwords have been checked and doubled checked and are correctly entered in the WLC and in the NPS for the radius client.

When trying to connect to the WiFi, test is user is prompted for their credentials, which is what we want. Creds are entered and we get the message that it was not able to connect.

Checking event viewer of the NPS (also the DC), I see the following errors:

  • Under Network Policy and Access Services:

    enter image description here

  • Under Windows Logs -> Application:

    enter image description here

  • Under Windows Log -> System:

    enter image description here

From what I have found online, reason 22 comes up when there is an issue with the cert. On the client side, I have disabled the need to validate certs (for testing purposes). I have added a cert from our CA (on a different DC) to the NPS as shown below:

enter image description here

Not sure why users are not able to connect or how to fix the error. Any suggestions or ideas are appreciated!

Edit - adding client config:

enter image description here

Not validating certs:

enter image description here

Also, from client, shows that EAP type 25 is being sent from Client:

enter image description here

  • Can you post the settings of the NPS Network Policy "Conditions" tab? In my setup it is setup with: Authenticaiton type = EAP / Nas Port Type = Wireless IEEE 802.11 / Windows Group = <my group of authorized users> – JFL Feb 22 '18 at 16:13
  • @JFL i have two conditions under my network policy: Nas Port Type = Wireless - Other or Wireless - IEEE 802.11 Windows Groups = domain/Users – Arturo Martinez Feb 22 '18 at 16:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Apr 19 at 6:22
0

PEAP-MSCHAPv2 does need to to validate server side certificate. I see you have disabled the need to validate certs (for testing purposes). It wont work without validating server side cert.

This looks like mis-configuration issue. You need to make sure same authentication type is used at both ends (client and server). Wireless profiles at client must be configured to use/support PEAP-MSCHAPv2. If you see your first screen shot, i dont see any value in front of 'EAP Type:' field. And in your last screen shot, select checkbox against MS-CHAPv2.

  • I found one link. showing same behavior you seeing. – Vinnie Feb 20 '18 at 21:16
  • 2
    Validation of the cert is not required. That is a client side configuration, although this will make the connection significantly less secure. – YLearn Feb 21 '18 at 1:01
  • @Vinnie - I made the changes to Network Policy to accept the MS-CHAPv2 authentication method and this came up in the logs: Reason Code: 66 Reason: The user attempted to use an authentication method that is not enabled on the matching network policy. Also, I have edited the original post to include my current client side configuration. – Arturo Martinez Feb 22 '18 at 14:06
  • @ArturoMartinez its difficult to know the root cause here, because we don't know inside-out information about network details at your end. But log does say that end client and server are not talking same authentication protocol. – Vinnie Feb 22 '18 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.