AAA Authentication Failure

I just moved from a windows 2003 IAS server over to window 2008 NPS and I am getting  this message on the WLC. AAA Authentication Failure for UserName:VESLABCT10_15DO\Administrator User Type:  WLAN USER. this is a test user. I double checked the password both for NPS and WLC. It worked great under windows 2003 IAS. I installed certifcates services on the windows 2008 and exported the certificate and install the certificate on the client. Any suggestions

Maybe check on the NPS logs the reason of the failure ? WLC is just a forwarder in this case :-)

Similar Messages

  • Annoying 'fake' aaa authentication failure

    Hi
    Got some new 3750x running c3750e-universalk9-mz.150-2.SE5.bin. They have identical aaa configs to other switches running 15 code (4948e) doing LOCAL device user authentication for VTY SSH access.
    Relevant bits are:
    username xxx privilege NN secret yyy
    aaa new-model
    aaa authentication login VTY local
    aaa authorization config-commands
    aaa authorization exec VTY local
    aaa authorization commands 15 VTY local
    aaa session-id common
    line vty 0 4
     session-timeout 10
     access-class 23 in
     authorization commands 15 VTY
     authorization exec VTY
     login authentication VTY
     transport input ssh
    For some reason, on SSH to the device, the login banner comes up but the password: prompt takes a few seconds. At the same time some authfail logs are seen even through haven't yet had a chance to login/enter the password. Once entering the correct password, authentication is always (correctly) successfully
    This does not occur on the older code (12.2) or on the 4948e with 15.0 code.
    It is annoying as we collect audit syslogs and every login where local is used generates one or more fails before a success.
    Is there something obscure in 15.0+ code that changes LOCAL aaa behaviour ?

    Telnet works differently anyway in that you login with a username/password. With ssh, I am passing the username.
    I did enable telnet anyway and this works without failure
    Log I get is a straightforward fail. The issue must be to do with the ssh handshake and passing of username and the behaviour has changed on some code bases. I've noticed the ASR1000 with 15.0 do the same. It is annoying due to filling up audit logs with 'rubbish'
    May 13 09:58:52.926: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: x.x.x.x] [localport: 22] [Reason: Login Authentication Failed] at 09:58:52 UTC Tue May 13 2014

  • Client AAA Authentication Failure

    Hi, I have configured a WLAN for AAA authentication and have configured AAA/Radius authentication on the WLC, however the clients don't get authenticated when they try to join. I have run a debug and I am getting an authentication rejected message from the radius server. Below is the output.
    Access-Challenge received from RADIUS server 10.24.12.32 for mobile x.x.x.x receiveId = 5
    *Dot1x_NW_MsgTask_4: Nov 18 15:52:47.915: x.x.x.x Processing Access-Challenge for mobile x.x.x.x
    *Dot1x_NW_MsgTask_4: Nov 18 15:52:47.915: x.x.x.x WARNING: updated EAP-Identifier 1 ===> 27 for STA x.x.x.x
    *Dot1x_NW_MsgTask_4: Nov 18 15:52:47.915: x.x.x.x Sending EAP Request from AAA to mobile x.x.x.x (EAP Id 27)
    *Dot1x_NW_MsgTask_4: Nov 18 15:52:47.935: x.x.x.x Received EAPOL EAPPKT from mobile x.x.x.x
    *Dot1x_NW_MsgTask_4: Nov 18 15:52:47.935: x.x.x.x Received EAP Response from mobile x.x.x.x (EAP Id 27, EAP Type 3)
    *aaaQueueReader: Nov 18 15:52:47.935: apfVapRadiusInfoGet: WLAN(1) dynamic int attributes srcAddr:0x0, gw:0x0, mask:0x0, vlan:0, dpPort:0, srcPort:0
    *aaaQueueReader: Nov 18 15:52:47.935: x.x.x.x Successful transmission of Authentication Packet (id 76) to 10.24.12.32:1812, proxy state x.x.x.x-00:00
    *radiusTransportThread: Nov 18 15:52:47.938: ****Enter processIncomingMessages: response code=3
    ****Enter processRadiusResponse: response code=3
    *radiusTransportThread: Nov 18 15:52:47.938: x.x.x.x Access-Reject received from RADIUS server 10.24.12.32 for mobile x.x.x.x receiveId = 5

    Thanks for the reply, I checked the logs and it shows the correct username who has attempted to login and then for the same user it shows the machine name trying to login. Could it be something to do with the client's configuration?
    Are there any specific config that needs to be made on the clients who are mostly windows based devices, the user doesn't get prompted to enter a username or password even when 802.1X is selected for the Authentication.

  • Web Auth with AAA (RAIDUS) Failure

    Hi Guys,
    We are having an issue with out Web Auth Using AAA Servers. We get the following error: AAA Authentication Failure for UserName:14t.park User Type: WLAN USER, This error is from the Web Interface, I have been looking at the debug settings to see if there is anything that might give me more detail of what is going on but I can see anything under the Web-Auth Debug for AAA Authentication.
    I have checked on our RAIDUS Servers and I can't find any errors relating to Authentication with the NPS.
    Does anyone have any suggestions?

    Machine credentials requires a lookup on the computer OU and that has to be defined on the client side.
    Thanks,
    Scott
    Help out other by using the rating system and marking answered questions as "Answered"

  • AAA authentication not working and 'default' method list

    Guys,
    I hope someone can help me here in troubleshooting AAA issue. I have copied configuration and debug below. The router keeps using local username/password even though ACS servers are reachable and working. From debugs it seems it keeps using 'default' method list ignoring TACACS config. Any help will be appreciated
    Config
    aaa new-model
    username admin privilege 15 secret 5 xxxxxxxxxx.
    aaa authentication login default group tacacs+ local
    aaa authentication enable default group tacacs+ enable
    aaa authorization console
    aaa authorization exec default group tacacs+ local
    aaa authorization commands 15 default group tacacs+ local
    aaa authorization reverse-access default group tacacs+ local
    aaa accounting commands 0 default start-stop group tacacs+
    aaa accounting commands 15 default start-stop group tacacs+
    aaa accounting connection default start-stop group tacacs+
    aaa session-id common
    tacacs-server host x.x.x.x
    tacacs-server host x.x.x.x
    tacacs-server host x.x.x.x
    tacacs-server host x.x.x.x
    tacacs-server directed-request
    tacacs-server key 7 0006140E54xxxxxxxxxx
    ip tacacs source-interface Vlan200
    Debugs
    002344: Dec  5 01:36:03.087 ICT: AAA/BIND(00000022): Bind i/f
    002345: Dec  5 01:36:03.087 ICT: AAA/AUTHEN/LOGIN (00000022): Pick method list 'default'
    002346: Dec  5 01:36:11.080 ICT: AAA/AUTHEN/LOGIN (00000022): Pick method list 'default'
    core01#
    002347: Dec  5 01:36:59.404 ICT: AAA: parse name=tty0 idb type=-1 tty=-1
    002348: Dec  5 01:36:59.404 ICT: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0
    002349: Dec  5 01:36:59.404 ICT: AAA/MEMORY: create_user (0x6526934) user='admin' ruser='core01' ds0=0 port='tty0' rem_addr='async' authen_type=ASCII service=NONE priv=15 initial_task_id='0', vrf= (id=0)
    002350: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): Port='tty0' list='' service=CMD
    002351: Dec  5 01:36:59.404 ICT: AAA/AUTHOR/CMD: tty0 (2162495688) user='admin'
    002352: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send AV service=shell
    002353: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send AV cmd=configure
    002354: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send AV cmd-arg=terminal
    002355: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send AV cmd-arg=<cr>
    002356: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): found list "default"
    002357: Dec  5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): Method=tacacs+ (tacacs+)
    002358: Dec  5 01:36:59.404 ICT: AAA/AUTHOR/TAC+: (2162495688): user=admin
    002359: Dec  5 01:36:59.404 ICT: AAA/AUTHOR/TAC+: (2162495688): send AV service=shell
    002360: Dec  5 01:36:59.404 ICT: AAA/AUTHOR/TAC+: (2162495688): send AV cmd=configure
    002361: Dec  5 01:36:59.404 ICT: AAA/AUTHOR/TAC+: (2162495688): send AV cmd-arg=terminal
    002362: Dec  5 01:36:59.404 ICT: AAA/AUTHOR/TAC+: (2162495688): send AV cmd-arg=<cr>
    Enter configuration commands, one per line.  End with CNTL/Z.
    core01(config)#
    002363: Dec  5 01:37:04.261 ICT: AAA/AUTHOR (2162495688): Post authorization status = ERROR
    002364: Dec  5 01:37:04.261 ICT: tty0 AAA/AUTHOR/CMD (2162495688): Method=LOCAL
    002365: Dec  5 01:37:04.261 ICT: AAA/AUTHOR (2162495688): Post authorization status = PASS_ADD
    002366: Dec  5 01:37:04.261 ICT: AAA/MEMORY: free_user (0x6526934) user='admin' ruser='core01' port='tty0' rem_addr='async' authen_type=ASCII service=NONE priv=15
    core01(config)#

    Are the tacacs+ servers reachable using the source vlan 200. Also in the tacacs+ server can you check if the IP address for this device is correctly configured and also please check the pwd on both the server and this device match.
    As rick suggested sh tacacs would be good as well. That would show failures and successes
    HTH
    Kishore

  • LSASS.exe Authentication Failure ever 30 minutes

    I'm getting two authentication failures every 30 minutes from lsass.exe on various ports (changes every time). The attempted authentication is for the admin account, which was recently changed. This is sourced from the server back to the server on either 127.0.0.1 or the server's IP. Anyone have any idea on this?
    This topic first appeared in the Spiceworks Community

    Verify your RADIUS configuration with the Test button on the AAA Server Groups configuration screen. Once you supply a username and password, this button allows you to send a test authentication request to the ACS server.
    Choose Configuration > Remote Access VPN > AAA Setup > AAA Server Groups.
    Select your desired AAA Server group in the top pane. Select the AAA server that you want to test in the lower pane. Click the Test button to the right of the lower pane. In the window that appears, click the Authentication radio button, and supply the credentials with which you want to test. Click OK when finished

  • Aaa authentication enable default group tacacs+ enable

    I am implementing CSACS 4.0. First on the client, I will apply aaa authenticatio/ authorization under vty. The issure if I use the followin command
    aaa authentication enable default group tacacs+ enable
    what will happen if I login via console? Will I be required to enter any username/password?
    Below is my configuration
    aaa new-model
    aaa authentication login authvty group TACACS + local
    aaa authentication enable default group tacacs+ enable
    aaa authorization commands 15 authvty TACACS+ local
    TACACS-server host IP
    Tacacs-server key key
    Ip tacacs source-interface VLAN 3
    aaa accounting send stop-record authentication failure
    aaa accounting delay-start
    aaa accounting exec authvty start-stop group tacacs+
    aaa accounting commands 15 authvty start-stop group tacacs+
    aaa accounting connection authvty start-stop group tacacs+
    line vty 0 15
    login authentication authvty
    authorization commands 15 authvty
    accounting connection authvty
    accounting commands 15 authvty
    accunting exec authvty
    Any suggestion will be appreciated!

    It should work because this is a message.banner prompt everytime you try to login (console/vty). I have it configured on my router.
    If you have banner motd, it will be displayed as well (see below). So I ahve to remove it to get only the aaa banner & prompt being displayed:
    *** Username: cisco, Password: cisco (priv 15f - local) ****
    Unauthorized use is prohibited.
    Enter your name here: user1
    Enter your password now:
    Router#
    The config more or less looks like:
    aaa new-model
    aaa authentication banner ^CUnauthorized use is prohibited.^C
    aaa authentication password-prompt "Enter your password now:"
    aaa authentication username-prompt "Enter your name here:"
    aaa authentication login default group radius
    aaa authentication login CONSOLE local
    HTH
    AK

  • Intermittent AD Authentication failures in ISE 1.2

              Starting today I was getting intermittent authentication failures in ISE. It would say that the user was not found in the selected identity store. The account is there though. At one point I ran a authetication test from the external identity source menu and I got a failure and then the next time a pass. I have no idea why this is happening. I just updated to ISE 1.2 the other day. I'm also seeing what looks like a high level of latency on both of my PSN's. Is this normal?  Any ideas?
    Thanks
    Jef

    Interesting. I have one location that is not having this problem at all. The other is having it somewhat frequently. The PSN's for each location are tied to the local AD servers. I have not had this until we started getting 300-380 PC's connecting. We are a school so we are slowly getting started. It's real random. One user will work then another time they won't. Happens with admin and user. I have notices that with this new version of ISE it is complaining that it is getting accounting updates from the NAS too often, but I have not looked into this because I just installed 1.2 about 3-4 days ago and haven't had time to look into it.
    When you say Multicast to you AD...how did you check that? We do use multicast.

  • HI, Im using Iphone 4 and i recently got my IOS updated to IOS7 and  now im getting the error message as "PDP authentication failure" Im using Aircel carrier.

    HI, Im using Iphone 4 and i recently got my IOS updated to IOS7 and  now im getting the error message as "PDP authentication failure" Im using Aircel carrier.
    Please let me know how to fix this issue

    update...
    I am not one to give up. So I called AT&T today. Now they are telling me they canceled my order because they were unable to fulfill my order. Basically, AT&T told me they sold out so they canceled my order so I can proceed to reorder again. It took them 4 days to realize this. I will be lucky if I get a new phone by Christmas. I am sure they will find a way to cancel my order again.
    Again, I argued, how is this my fault. I placed my order at the store around 11 a.m. Pacific time. My friend ordered his phone online sometime after me. He got his but my order was canceled. AT&T tried to explain to me that they sold over 600,000 phones, almost 500 per minute during there peak. Again, I asked, how this was my fault.
    I can understand over selling the phone. It is a great product. There is no reason to cancel my order. You adjust my order and tell me you will let me know when my phone will be in. I would have been mad that my phone was going to be late but I would have survived. At least I would be getting one.
    At this point, I have no order and AT&T or Apple website will allow me to order one. I just want to get in the QUEUE for one.
    Frustrated.

  • How to solve the error message "Could not activate cellular data network: PDP authentication failure"when using 3g or gPRS on safari with an iphone 4 and latest software updates

    Please can someone help me to solve the error message "Could not activate cellular data network: PDP authentication failure"when using 3G or GPRS on safari with an iphone 4GS and latest software updates. I have tried resetting the network and phone settings. I have restored the factory settings on itunes and still the problem persists.

    All iPhones sold in Japan are sold carrier locked and cannot be officially unlocked by the carrier. If you unlocked it, it was by unauthorized means (hacked), and support cannot be given to you in this forum.
    Hacked iPhones are subject to countermeasures by Apple, particularly when updating the firmware. It is likely permanently re-locked or permanently disabled.
    Message was edited by: modular747

  • The test couldn't sign in to Outlook Web App due to an authentication failure. Extest_ account.

    Hi.
    I'm using SCOM 2012 R2 and have imported the Exchange server 2010 MP.
    I have runned the TestCasConnectivityUser.ps1 script and almost everything is okay except for the OWA test login.
    The OWA rule is working for some time until (I think) SCOM is doing a automatic password reset of the extest_ account. Then I get the OWA error below. The other test connectivity are working. Any suggestions.
    One or more of the Outlook Web App connectivity tests had warnings. Detailed information:
    Target: xxx|xxx
    Error: The test couldn't sign in to Outlook Web App due to an authentication failure.
    URL: https://xxx.com/OWA/
    Mailbox: xxxx
    User: extest_xxx
    Details:
    [22:50:08.936] : The TrustAnySSLCertificate flag was specified, so any certificate will be trusted.
    [22:50:08.936] : Sending the HTTP GET logon request without credentials for authentication type verification.
    [22:50:09.154] : The HTTP request succeeded with result code 200 (OK).
    [22:50:09.154] : The sign-in page is from ISA Server, not Outlook Web App.
    [22:50:09.154] : The server reported that it supports authentication method FBA.
    [22:50:09.154] : This virtual directory URL type is External or Unknown, so the authentication type won't be checked.
    [22:50:09.154] : Trying to sign in with method 'Fba'.
    [22:50:09.154] : Sending HTTP request for logon page 'https://xxx.com/CookieAuth.dll?Logon'.
    [22:50:09.154] : The HTTP request succeeded with result code 200 (OK).
    [22:50:09.373] : The test couldn't sign in to Outlook Web App due to an authentication failure.
    URL: https://xxx.com/OWA/
    Mailbox: xxx
    User: extest_xxx
    [22:50:09.373] : Test failed for URL 'https://xxx/OWA/'.
    Authentication Method: FBA
    Mailbox Server: xxx
    Client Access Server Name: xxx
    Scenario: Logon
    Scenario Description: Sign in to Outlook Web App and verify the response page.
    User Name: extest_xxx
    Performance Counter Name: Logon Latency
    Result: Skipped
    Site: xxx
    Latency: -00:00:00.0010000
    Secure Access: True
    ConnectionType: Plaintext
    Port: 0
    Latency (ms): -1
    Virtual Directory Name: owa (Default Web Site)
    URL: https://xxx.com/OWA/
    URL Type: External
    Error:
    The test couldn't sign in to Outlook Web App due to an authentication failure.
    URL: https://xxx.com/OWA/
    Mailbox: xxx
    User: extest_xxx
    Diagnostic command: "Test-OwaConnectivity -TestType:External -MonitoringContext:$true -TrustAnySSLCertificate:$true -LightMode:$true"
    EventSourceName: MSExchange Monitoring OWAConnectivity External
    Knowledge:
    http://go.microsoft.com/fwlink/?LinkID=67336&id=CB86B85A-AF81-43FC-9B07-3C6FC00D3D42
    Computer: xxx
    Impacted Entities (3):
    OWA Service - xxx, xxx - xxx, Exchange
    Knowledge:     View additional knowledge...
    External Knowledge Sources
    For more information, see the respective topic at the Microsoft Exchange Server TechCenter
    Thanks
    MHem

    Hi,
    Based on the error, it looks like an OWA authentication failure.
    Have you tried post this to LYNC forums?
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • ISE internal user authentication failure - user not found

    Hi Forumers'
    I trying to do wireless 802.1x, where identity store using intenral user.
    But i found this error message when i trying to connect
    Authentication failed                                                                                 :
    22056 Subject not found in the applicable identity store(s)
    My authrorization rules is built like this
    identity groups = user identities group / " mygroup"
    condition = no setting
    permissions = standard / PermitAccess
    Question 1
    Any troubleshooting step to do on this?
    Question 2
    For the Authorization rules, what's the condition should set for using Internal User as Identity store?
    Thanks
    Noel

    The error is caused to an authentication failure and is not an issue with authorization
    You need to look at your authentications policy (Policy->Authentications) and see which identity store was authenticated against
    In addition can do the Live Authentications page (Monitor->Authentications) and for the failing record click on the icon under details. This will give you the full details of the requets processing and you can see which rule was matched in the identity policy (Identity Policy Matched Rule) and "Selected Identity Stores".

  • [SOLVED] Authentication failure while try to login in GDM

    Hi,
    I just installed Arch Linux 64 bit on Virtualbox (I using GNOME and GDM). I have set on  rc.conf daemon arrays to start dbus and gdm and it run well.
    My problem is I can't login using root. When I try to login, it prompt Authentication failure
    I can't re-configure my rc.conf because I can't login, and I stuck in GDM screen..
    When I try to use "Ctrl+Alt+F1", it effects to my host (ubuntu), not to my guest Arch
    How to skip GDM to started for this condition and how to solve this authentication failure ?
    Last edited by alphazero (2011-11-20 11:51:19)

    Since I run on virtualbox. I can't use Ctrl-F1, so I try to edit rc.conf using LiveCD
    After I modify rc.conf and remove gdm in daemon array, I reboot and login as root.. adduser and finally it works login as user
    And I add again gdm after it worked to log as user.
    So problem solved.. Thanks to wonder for your help.
    Last edited by alphazero (2011-11-20 11:50:54)

  • I have problem c connecting to cellular data network. There is massage "couldn't activate cellular data network, PDP authentication failure". What is it and how I solve this problem?

    I have problem c connecting to cellular data network. There is massage "couldn't activate cellular data network, PDP authentication failure". What is it and how I solve this problem?

    If you have a data only plan for the iPad with your carrier, if no change after powering your iPad off and on you will need to contact your carrier.

  • LMS 4.2.3 Continuous Authentication failure alarm in DFM

    Hi All,
    We are getting continuous minor alarm[Authentication Failure] for single router in the DFM.  can we check from which ip we are getting the authentication request??
    possible steps to find the cause for the authentication failure.?
    Regards,
    Channa

    Hi Vinod,
    I tried delete the DFM and DFM1.log files. but after stopping the deamon manager.unable to delete DFM1.log as this file was accessed by the smserver.exe in the backend.
    i have successful moved both RPS files and DFM.log file from the location. but the issue persists.
    I try again to delete DFM1.log file in the MW and update.
    Regards,
    Channa

Maybe you are looking for