Invalid Message Authenticator in EAP Request

Question

Hi,
I am attemping to configure Infratructure authentication for WDS and WPA/PEAP Client authentication using ACS 4.1(1) Build 23 from an Aironet 1210 running IOS 12.3(8)JEC.
I have a production ACS server that has both LEAP and PEAP enabled under the global configuration options.
The access point has been correctly defined as a NAS using RADIUS-Aironet on the ACS server. The Access point has ACS defined as a RADIUS server and the shared secret set the same as the NAS definition within ACS.
For both WDS Infrastructure authentications(LEAP) and client authentication requests to the access point using PEAP I receive the following message in the ACS failed log:
"Invalid message authenticator in EAP request"
A search on CCO tells me that this is normally the result of a shared secret mismatch. I have however retyped the shared secret several times , and tested with simple strings such as "cisco" and the same result is received. Both the Radius definition on the AP and the NAS definition on ACS have bee re-created with no change in result.
As a test I ran up a clean install of ACS 4.1(1)23 in a VMware session. Configured a NAS object for the AP as I had previously done on the production system and it worked first go.
Would anyone have any clues on what could be wrong with my production ACS. ?
Many Thanks,
Leon

Answer 1

I have a question, when you placed the AAA client under a NDG, was there any Shared Key defined on the NDG level. Because it is an expected behavior, that if you define a Shared Key on the NDG level it over-rides key at the AAA Client level.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/NetCfg.html#wp342738
Refer to Step4.,
"Each device that is assigned to the Network Device Group will use the shared key that you enter here. The key that was assigned to the device when it was added to the system is ignored. If the key entry is null, the AAA client key is used."
Regards,
Prem
Please rate if it helps!