[ ISSUE ] NCS / PI authentication using Microsoft NPS as a RADIUS server

Question

So here is my goal:
Authenticate employees who use NCS or PI with their ActiveDirectory credentials against Microsoft NPS.
Background:
I have successfully configured our switches to use the NPS server and our AD credentials to log into and receive plvl=15 access.
I've also used NPS to authenticate wireless clients in a lab setting.
Problem:
I cannot figure out what is going on with NCS/PI authentication against NPS.
Here are a couple/few steps I've taken:
- I've added the RADIUS client to the list.
- I've created a network policy to grant access to a specific group of users (AD group).  It accepts either CHAP or PAP authentication
- I've also taken out the default radius attributes and inserted these:
- - Vendor Specific, Cisco-AV-Pair
- - - - I've used both the ASCII format of the task list and/or variations of the HEX value
- - Vendor-Specific, RAIDUS Standard
- - - - I've used both the ASCII format of the task list and/or variations of the HEX value
On the NPS server I can see the request coming in on the NPS logs.  Access has been granted and it matches the Network Policy I created.
The usual message I receive is this:
No authorization information found for Remote Authenticated User. Please check the correctness of the associated task(s) and Virtual Domain(s) in the remote server
Attached is a picture from a packet capture.  The RAIDUS "Access-Accept" message has something under the Attribute Value Pairs section:
- "[Not enough room in packet for AVP] "
This capture was taken when I was only using the RAIDUS role value and not all the RAIDUS Tasks.
Has anyone gotten this to work using Cisco NCS/PI and Microsoft NPS?
Here are some of guides I used:
http://mihai.radoveanu.ro/2010/11/configuring-the-radius-authentication-with-cisco-wireless-control-system-6-0-196-0/
https://supportforums.cisco.com/thread/339057
http://www.cisco.com/en/US/products/ps6305/products_tech_note09186a00809038e6.shtml

Answer 1

Hi Kyujin,
I wish I had finished my guide.  Didn't realize it would take this long.
But what I meant is that when adding the attributes to my NPS (Microsoft's Network Policy Server) I only had to add the role and virtual domain if using Prime Infrastructure.
If you use NCS, you have to add the role, all the tasks, and the virtual domain.
See the screenshots and see if that helps explain it.  Not sure how TACACS will work as I'm not familiar with it.
Microsoft NPS - Attributes for NCS
Microsoft NPS - Attributes for PI