Problems w/config AP1200 - WPA Enterprise/Local RADIUS Server

I have been attempting to reconfigure a AP1200 in our lab environment from using static WEP keys to WPA/TKIP. I can make the solution work with WPA-PSK, but not enterprise. I believe I have everything configured correctly but cannot "validate identity" on the client. Below are the details to my configuration.
SSID: labssid (Open authentication with EAP)
Cipher: TKIP
Key management: Mandatory (WPA)
I have a Cisco ACS server but am attempting to get this running intially using the local RADIUS server on the Access Point. I have a user defined locally called "test" with a password of "test".
I am using an IBM ThinkPad T43 with the built-in wireless (Intel PRO/Wireless 2915ABG NIC) for testing. I have the "Use Windows to configure my wireless network settings" checked so I am using the inherant Windows configuration screens. However, I have also attempted to use the IBM NIC configuration utility and receive the same failures. I have the client device configured as follows:
1. Network authentication: WPA
2. Data encryption: TKIP
3. Authentication: Protected EAP (PEAP) (only option other than smartcard, cert.)
3a. (PROPERTIES) - AuthMethod: Secured Password (EAP-MSCHAP v2)
4. Authenticate as computer whe computer information is avail (UNCHECKED)
5. Authenticate as guest when user or computer is unavailable (UNCHECKED)
When I attempt to provide my test/test credientials the Access Point logs the following:
Station 0016.6f77.9ccd Authentication failed
When I look at the Local RADIUS server stats, for each authentication failure the following stat is recorded:
"Unknown EAP Type"
If I try to authenticate 5 times, there will be 5 Unknown EAP Type stats logged.
What am I missing?

I didn't realize the local RADIUS couldn't do PEAP. That makes sense now, as in testing I decided to point the AP at my ACS server and was able to authenticate. I'm having an issue authenticating at times because it seems the AP looses it's connection TO the ACS server. The Access Point logs the following:
1. Station 0016.6f77.9ccd Authentication failed
2. RADIUS server 192.168.102.82:1645,1646 has returned.
3. RADIUS server 192.168.102.82:1645,1646 is not responding.
The "not responding" and "returned" logs are recorded at the exact same time period. In my most recent case, it was "Aug 31 18:19:36.981". Both have that time stamp. It's as if the AP looses some heartbeat to the RADIUS server and doesn't check to see if it's alive until a certain interval. When I'm not able to authenticate, if I log into the ACS and manually "restart" the services through the GUI, I authenticate right away. I'm thinking this is an ACS issue not an AP issue, but am wondering if anyone else has ever noticed this behavior.

Similar Messages

  • EAP-FAST on Local Radius Server : Can't Get It Working

    Hi all
    I'm using an 877w router (flash:c870-advsecurityk9-mz.124-24.T4.bin) as local radius server and have followed various config guides on CCO. LEAP works fine but I just can't get EAP-FAST to work.
    I'm testing with win7 client using anyconnect secure mobility client, and also a mac book pro but without luck.
    the router sees unknown auth type, and when I run some debugs it talks of unknown eap type 3
    sh radius local-server s
    Successes              : 1           Unknown usernames      : 0        
    Client blocks          : 0           Invalid passwords      : 0        
    Unknown NAS            : 0           Invalid packet from NAS: 17      
    NAS : 172.27.44.1
    Successes              : 1           Unknown usernames      : 0        
    Client blocks          : 0           Invalid passwords      : 0        
    Corrupted packet       : 0           Unknown RADIUS message : 0        
    No username attribute  : 0           Missing auth attribute : 0        
    Shared key mismatch    : 0           Invalid state attribute: 0        
    Unknown EAP message    : 0           Unknown EAP auth type  : 17       
    Auto provision success : 0           Auto provision failure : 0        
    PAC refresh            : 0           Invalid PAC received   : 0       
    Can anyone suggest what I might be doing wrong?
    Regs, Tim

    Thanks Nicolas, relevant snippets from config:
    aaa new-model
    aaa group server radius rad_eap
    server 172.27.44.1 auth-port 1812 acct-port 1813
    aaa authentication login eap_methods group rad_eap
    aaa authorization exec default local
    aaa session-id common
    dot11 ssid home
    vlan 3
    authentication open eap eap_methods
    authentication network-eap eap_methods
    authentication key-management wpa
    ip dhcp pool home
       import all
       network 192.168.1.0 255.255.255.0
       default-router 192.168.1.1
       dns-server 194.74.65.68 194.74.65.69
    ip inspect name ethernetin tcp
    ip inspect name ethernetin udp
    ip inspect name ethernetin pop3
    ip inspect name ethernetin ssh
    ip inspect name ethernetin dns
    ip inspect name ethernetin ftp
    ip inspect name ethernetin tftp
    ip inspect name ethernetin smtp
    ip inspect name ethernetin icmp
    ip inspect name ethernetin telnet
    interface Dot11Radio0
    no ip address
    encryption vlan 1 mode ciphers aes-ccm tkip
    encryption vlan 2 mode ciphers aes-ccm tkip
    encryption vlan 3 mode ciphers aes-ccm tkip
    broadcast-key vlan 1 change 30
    broadcast-key vlan 2 change 30
    broadcast-key vlan 3 change 30
    ssid home
    speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
    station-role root
    interface Dot11Radio0.3
    encapsulation dot1Q 3
    no cdp enable
    bridge-group 3
    bridge-group 3 subscriber-loop-control
    bridge-group 3 spanning-disabled
    bridge-group 3 block-unknown-source
    no bridge-group 3 source-learning
    no bridge-group 3 unicast-flooding
    interface Vlan3
    no ip address
    bridge-group 3
    interface BVI3
    ip address 192.168.1.1 255.255.255.0
    ip inspect ethernetin in
    ip nat inside
    ip virtual-reassembly
    radius-server local
    no authentication mac
    nas 172.27.44.1 key 0 123456
    user test1 nthash 0 B151E8FF684B4F376C018E632A247D84
    user test2 nthash 0 F2EEAE1D895645B819C9FD217D0CA1F9
    user test3 nthash 0 0CB6948805F797BF2A82807973B89537
    radius-server host 172.27.44.1 auth-port 1812 acct-port 1813 key 123456
    radius-server vsa send accounting

  • Local radius server : one username for several devices ?

    I've just installed a AP 1231g as a local radius server and I've got two devices that are authenticated by the AP with the same username/password .
    is not there a problem?

    Hi,
    Problem ?? no there is no issues. You are using a single user name to access network devices.
    Regards,
    ~JG
    Please rate if helps

  • 1240AG as WDS & Local Radius Server

    Have 5 1240AG's and want to use one as WDS and Local Radius Server.
    Am using the following as a guide:
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c951f.shtml#hw
    The above example uses a Cisco Secure ACS and designates both an AP and a WSLM as the WDS. I just want to use the AP as the WDS.
    Isn't it possible to do the whole thing just using a 1240AG as both the WDS and Local Radius Server and not use a Cisco Secure ACS or WSLM?
    Is there an online guide for such a thing? (looked, didn't find it)
    Appreciate the guidance
    Cheers

    Thanks, that's what I thought.
    I had found the WDS setup link but wasn't sure if I was missing something.
    The link you provided for the Local Radius Server setup is for "partners" only I believe? Can't access it.
    But I think I should be able to find some guides/examples somewhere else in the archives. I'm starting w/ these 2 links;
    https://www.cisco.com/en/US/products/ps6521/prod_configuration_examples_list.html
    and
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c0912.shtml
    Appreciated the heads up about port 1812.

  • 1100 with Local Radius Server problems Atheros Client

    I have Local authentication turned on for the 1100 and am using the Atheros Client Utility configuring LEAP with username/password and it is failing, here is the debug from the 1100.Any help much appreciated.
    Xcon-ap1100#conf t
    Enter configuration commands, one per line. End with CNTL/Z.
    Xcon-ap1100(config)#radius
    Xcon-ap1100(config)#radius-server local
    Xcon-ap1100(config-radsrv)#no nas 10.201.1.5
    Xcon-ap1100(config-radsrv)#nas 10.201.1.5 key thiskey
    Xcon-ap1100(config-radsrv)#end
    Xcon-ap1100#debug radius
    Radius protocol debugging is on
    Radius protocol brief debugging is off
    Radius protocol verbose debugging is off
    Radius packet hex dump debugging is off
    Radius packet protocol debugging is on
    Radius packet retransmission debugging is off
    Radius server fail-over debugging is off
    Xcon-ap1100#term mon
    Xcon-ap1100#
    *Apr 3 16:26:26.961: RADIUS: AAA Unsupported [248] 10
    *Apr 3 16:26:26.961: RADIUS: 43 61 72 64 69 66 66 4E [CardiffN]
    *Apr 3 16:26:26.962: RADIUS: AAA Unsupported [150] 3
    *Apr 3 16:26:26.962: RADIUS: 32 [2]
    *Apr 3 16:26:26.962: RADIUS(000000FC): Storing nasport 246 in rad_db
    *Apr 3 16:26:26.962: RADIUS(000000FC): Config NAS IP: 10.201.1.5
    *Apr 3 16:26:26.963: RADIUS/ENCODE(000000FC): acct_session_id: 251
    *Apr 3 16:26:26.963: RADIUS(000000FC): Config NAS IP: 10.201.1.5
    *Apr 3 16:26:26.963: RADIUS(000000FC): sending
    *Apr 3 16:26:26.963: RADIUS(000000FC): Send Access-Request to 10.201.1.5:1645 id 21645/158, len 130
    *Apr 3 16:26:26.963: RADIUS: authenticator 74 20 7D 86 32 7B 1A 65 - 88 DE A7 58 51 91 FA 5D
    *Apr 3 16:26:26.963: RADIUS: User-Name [1] 6 "test"
    *Apr 3 16:26:26.964: RADIUS: Framed-MTU [12] 6 1400
    *Apr 3 16:26:26.964: RADIUS: Called-Station-Id [30] 16 "000f.f751.7970"
    *Apr 3 16:26:26.964: RADIUS: Calling-Station-Id [31] 16 "0090.963d.7bf6"
    *Apr 3 16:26:26.964: RADIUS: Service-Type [6] 6 Login [1]
    *Apr 3 16:26:26.965: RADIUS: Message-Authenticato[80] 18 *
    *Apr 3 16:26:26.965: RADIUS: EAP-Message [79] 11
    *Apr 3 16:26:26.965: RADIUS: 02 02 00 09 01 74 65 73 74 [?????test]
    *Apr 3 16:26:26.965: RADIUS: NAS-Port-Type [61] 6 802.11 wireless [19]
    *Apr 3 16:26:26.965: RADIUS: NAS-Port [5] 6 246
    *Apr 3 16:26:26.965: RADIUS: NAS-IP-Address [4] 6 10.201.1.5
    *Apr 3 16:26:26.965: RADIUS: Nas-Identifier [32] 13 "Xcon-ap1100"
    *Apr 3 16:26:31.966: RADIUS: Retransmit to (10.201.1.5:1645,1646) for id 21645/158
    *Apr 3 16:26:36.966: RADIUS: Retransmit to (10.201.1.5:1645,1646) for id 21645/158
    *Apr 3 16:26:41.966: RADIUS: Retransmit to (10.201.1.5:1645,1646) for id 21645/158
    *Apr 3 16:26:46.965: RADIUS: No response from (10.201.1.5:1645,1646) for id 21645/158
    *Apr 3 16:26:46.965: RADIUS/DECODE: parse response no app start; FAIL
    *Apr 3 16:26:46.965: RADIUS/DECODE: parse response; FAIL
    *Apr 3 16:26:46.966: %DOT11-7-AUTH_FAILED: Station 0090.963d.7bf6 Authentication failed
    *Apr 3 16:26:50.070: RADIUS: AAA Unsupported [248] 10
    *Apr 3 16:26:50.070: RADIUS: 43 61 72 64 69 66 66 4E [CardiffN]
    *Apr 3 16:26:50.071: RADIUS: AAA Unsupported [150] 3
    *Apr 3 16:26:50.071: RADIUS: 32 [2]
    *Apr 3 16:26:50.071: RADIUS(000000FD): Storing nasport 247 in rad_db
    *Apr 3 16:26:50.072: RADIUS(000000FD): Config NAS IP: 10.201.1.5
    *Apr 3 16:29:29.041: %DOT11-7-AUTH_FAILED: Station 0090.963d.7bf6 Authentication failed
    *Apr 3 16:29:52.253: %DOT11-7-AUTH_FAILED: Station 0090.963d.7bf6 Authentication failed

    I have a very similar situation here. Took me a while to figure out why existing user certificates are OK but no new users can enroll. I checked all certificates for expiry. No go. It was not the expiry ("Valid to") time, but rather the "Valid From" time that is messed up.
    This is what happens: The rollover gets created and replaces the original one (which remains in memory, no flash) But the new one is valid from the expiry of the old one - in my case TOMORROW and after a power-outage the day before yesterday (the most definitive way to get a reboot!) I only have the new NOT YET VALID certificate.
    OK, I can wait until tomorrow and see if it works. But the design is far from intelligent. The industry standard is that when you renew a certificate, the validity of the new one is immediate - even if it means it runs for a few days longer than the designated lifetime.
    So much for the overlap period of 30 days (as you can see from your own post) if the old certificate goes away after a reboot and the new one is not yet valid! (The CA certificate expiration timer gets reset to some Unix time-zero ( 01:00:00 CEST Jan 1 1970) which I take to mean "not valid yet".)
    I only have a few days of trouble - and just one to go after finally working it out, but it could have been up to 30 days if I for any reason had rebooted after the roll-over certificate got created.
    Cheers
    Bernhard

  • 802.1x or WPA-Enterprise or Radius

    I have seen a lot of posts mentioning compatibility with WPA encrypted networks. However, all these are WPA-Personal (or WPA-PSK), meaning they have a pre-shared key, or password, for authentication.
    My question is whether 802.1x is supported on the iPhone. Many businesses, schools, etc., require this (sometimes called WPA-Enterprise) for authentication, in which a username and password must be entered rather than a shared-key.
    Can any of you savvy new iPhone users answer this question? It would save me a trip to the store...
    Thank you!
    Various Macs and PC's   Mac OS X (10.4)  

    No details on specific encryption support in the user manual, but I found this:
    http://www.utexas.edu/its/alerts/announcements/iphonecompatibility_on_the_ut_wirelessnetwork/
    "The iPhone does not support the WPA Enterprise protocol, the industry standard used to support user login on the UT network."
    Powerbook G4   Mac OS X (10.4.10)  

  • How to set local radius with AP 1240AG series

    Hi,
    I have been trying to set up a AP with AIR-AP1242AG-Ak9 as a local authenticator radius but with no success. I have followed the steps from a lot of posts but no go, even with the most simple and understanable post like this one: 
    https://supportforums.cisco.com/document/101121/configuring-autonomous-ap-local-radius-authentication
    The guy at the end of the post says:
    Configuring AP
    1. Go to Security>Encryption Manager
    2. Specify Encryption (can be WEP or WPA)
    3. Specify that WEP is Mandatory
    4. Specify the key accordingly
    5. Click Apply
    6. Go to Security>SSID Manage
    7. Select the desired SSID
    But when I go via GUI fist of all:
    I dont understand why it says it can be WEP o WPA because if I select WEP and follow the rest of the steps, I got an error message: WPA mandatory is supported only with Cipher TKIP or AES CCMP or AES CCMP +TKIP <see encryption managerpage>
    Besides WEP, as far as I kknow it only works with a password only and I want the PC clients to aunthenticate with the AP itself as a Radius local server so it should ask for a username and password defined in the AP.
    Second of all, the steps from the guy states on item 4, specfy the key acordinly? what this means? I only see keys filed in hexa.
    third of all, if I do the steps in the error above, it allows me to set WPA with key management Mandatory but only by selecting the Cipher drop down menu, so which item should I pick ?there are a lot like AES CCMP, AES CCMP+TKIP, etc
    But whenever another PC tries to login, it asks for the username and password, but it never get passed just saying error on the network.
    I include the debug for the local radius below
    I also included the config of the AP
    All I want is the AP ask for a username and password, login successfully and thats it.
    anybody else or someone that has a function config to share with me? I would appreciate it, cause I have been more than 12 hours in a row trying to set it up but no go 

    Here is a one of my post related to this topic,see if that helps,
    http://mrncciew.com/2013/03/03/autonomous-ap-as-local-radius-server/
    If supported use WPA2 with AES as that is most secure. Do not use WEP. If WPA2/AES is not supported then try to use WAP with TKIP.
    Here is other useful configuration example on the same topic
    https://rscciew.wordpress.com/2014/07/24/autonomous-ap-with-local-radius-server-eap-fast/
    HTH
    Rasika
    **** Pls rate all useful responses ***

  • Local radius question?

    Hi,
    I was just taking a look at the local radius functionality on a router. I've found a strange problem which doesn't make sense to me and I was wondering if someone could explain what I'm seeing. As a basic lab to learn the ropes with local radius I created a local radius server on my router and got the local vty lines to use it for authentication.
    This is my config:
    interface Loopback0
      ip address 192.168.0.1 255.255.255.255
    ip radius source-interface Loopback0
    aaa group server radius LOCAL-RADIUS
    server 192.168.0.1 auth-port 1812 acct-port 1813
    aaa authentication login default group LOCAL-RADIUS
    radius-server local
      nas 192.168.0.1 key 0 <removed>
      user mwhittle nthash 0 <removed>
    radius-server attribute 32 include-in-access-req format %h
    radius-server host 192.168.0.1 auth-port 1812 acct-port 1813 key <removed>
    radius-server vsa send accounting
    Now he's the strange thing... If I configure the radius user to "mwhittle" with the password "mwhittle" it works and I get an Access-Accept. If I configure anything another than the username for the password it doesn't work and I get an Access-Reject. I have tried many combinations but as long as the username and password are the same it works and if they aren't it doesn't. This can't be normal behavior unless I'm missing something.
    Any ideas?
    Kind regards,
    Mike

    Hi,
    What kind of RADIUS client application are you using with the IOS local  RADIUS server?  Please note that this server supports *only* wireless  clients,
    and only for the LEAP and EAP-FAST EAP types, and also MAC authentication.  It does not provide support for other kinds of RADIUS clients.
    The fact that username=password happens to seem to work is, I believe, an accidental artifact of the MAC authentication support, where username
    is always equal to password.
    If we are not using the MAC auth, then please feel free to open up a TAC case and we will help you..
    lemme know if this answered your question..
    Regards
    Surendra
    ====
    Please dont forget to rate the posts which answered your question and mark it as answered or was helpfull

  • EAP-FAST with local radius on 1242AG

    I'm trying to get EAP-FAST working using the local radius server on a 1242AG autonomous AP using the latest firmware from Cisco. The cypher I'm using is CCMP. LEAP works fine with all my clients, however if I move to EAP-FAST in the radius config my clients fail to authenticate
    I know I need to set PAC to automatic somewhere, but the EAP-FAST configuration in the 1242AG GUI doesn't make this clear what to do.
    Any help or a basic example you be great.
    thanks,
    Simon

    I think this is what you're looking for;
    Local EAP Authentication on the Wireless LAN Controller with EAP-FAST and LDAP Server Configuration Example
    http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml
    HTH
    Regards,
    Jatin
    Do rate helpful posts~

  • WPA Enterprise on Macbook Pro Core 2 Duo, late 2006 model

    Hi all.
    I have the most bizarre problem when connection the a WPA Enterprise network.
    I am running 10.4.10 with all the software updates and latest network fixes.
    I am able to connect to WPA Enterprise network (hidden) when I enter the network name, username and password under 'preferred networks' in the System Pref., Network section. Once I disable the airport and enable it again, it will automatically logon to the WPA Enterprise network.
    However, if I remove the WPA Enterprise network from the 'preferred networks' list and try to manually logon, by clicking on the airport icon in the menu bar (next to the speaker and battery icon), using the same logon credentials, I get a 'WPA Enterprise authentication failed. Please contact your network admin ...'.
    (Connecting to any(!) other type of network works fine)
    I have phoned apple support, but was told they are not aware of any such problems with WPA Enterprise on 10.4.10.
    I would be most grateful to hear from others who have problems connecting to a WPA Enterprise networks via the above methodes.
    Thanks.
    Chris

    See if your computer is compatible with Lion. The license allows you to install it on computers you own.
    Computer Compatibility - Lion                       Lion               
    Check to make sure your applications are compatible. PowerPC applications are no longer supported after 10.6.      
    Application Compatibility
    Applications Compatibility (2)
    If you buy the Snow Leopard family pack, you can install it on 5 computers in your family. You might have to look at Amazon and other places to find it.
    http://wiki.answers.com/Q/How_many_computers_can_you_install_snow_leopard_on

  • Ssid access control with WPA Ent and RADIUS author

    Hi, I'd like to control the ssid requested in WPA Enterprise with RADIUS authorization: how to ?
    Is there an attribute in RADIUS IOS or Cisco Aironet ?
    thanks

    Depends on what you are using for a radius server.
    Here are some links that might help.
    http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a00807917aa.shtml
    http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080921f67.shtml

  • Wireless local radius authentication

    Greetings,
    I have a AIR-AP1121G-A-K9, and I would like to authenticate users with a username and password on the AP using the local radius server.
    I used the configuration at http://www.aironet.info/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c0912.shtml
    and tried a couple other posted configuration, but are running into the same issue regardless of which method I am using.
    show ver
    Cisco IOS Software, C1100 Software (C1100-K9W7-M), Version 12.3(8)JED1, RELEASE
    SOFTWARE (fc3)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2010 by Cisco Systems, Inc.
    Compiled Tue 27-Apr-10 12:52 by alnguyen
    ROM: Bootstrap program is C1100 boot loader
    BOOTLDR: C1100 Boot Loader (C1100-BOOT-M) Version 12.2(8)JA, EARLY DEPLOYMENT RE
    LEASE SOFTWARE (fc1)
    ORP_ROOFDECK uptime is 21 hours, 3 minutes
    System returned to ROM by power-on
    System image file is "flash:/c1100-k9w7-mx.123-8.JED1/c1100-k9w7-mx.123-8.JED1"
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    cisco AIR-AP1121G-A-K9     (PowerPCElvis) processor (revision A0) with 15138K/12
    36K bytes of memory.
    Processor board ID FOC08370K83
    PowerPCElvis CPU at 197Mhz, revision number 0x0950
    Last reset from power-on
    1 FastEthernet interface
    1 802.11 Radio(s)
    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: 00:12:01:6B:86:46
    Part Number                          : 73-7886-07
    PCA Assembly Number                  : 800-21481-07
    PCA Revision Number                  : A0
    PCB Serial Number                    : XXX
    Top Assembly Part Number             : 800-22053-04
    Top Assembly Serial Number           : XXX
    Top Revision Number                  : A0
    Product/Model Number                 : AIR-AP1121G-A-K9
    Configuration register is 0xF
    show run
    Current configuration : 4240 bytes
    version 12.3
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname XXX
    ip subnet-zero
    ip domain name XXX!
    ip ssh version 2
    aaa new-model
    aaa group server radius rad_eap
    server 172.16.1.35 auth-port 1812 acct-port 1813
    aaa group server radius rad_acct
    server 172.16.1.35 auth-port 1812 acct-port 1813
    aaa authentication login eap_methods group rad_eap
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    dot11 syslog
    dot11 ssid YYY
       authentication open eap eap_methods
       authentication network-eap eap_methods
       guest-mode
    bridge irb
    interface Dot11Radio0
    no ip address
    ip helper-address 172.16.1.1
    no ip route-cache
    encryption key 1 size 128bit 7 66061D688B874859701297485642 transmit-key
    encryption mode wep mandatory
    broadcast-key change 300
    ssid YYY
    speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
    54.0
    channel 2437
    station-role root
    rts threshold 2312
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface FastEthernet0
    no ip address
    no ip route-cache
    duplex auto
    speed auto
    bridge-group 1
    no bridge-group 1 source-learning
    bridge-group 1 spanning-disabled
    interface BVI1
    ip address 172.16.1.35 255.255.255.0
    ip helper-address 172.16.1.1
    no ip route-cache
    ip default-gateway 172.16.1.1
    ip http server
    ip http authentication local
    ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    radius-server local
      no authentication eapfast
      no authentication mac
      nas 172.16.1.35 key 7 VVV
      group YYY
        ssid YYY
        block count 3 time 30
        reauthentication time 300
      user zzz nthash 7 0225540F2A2429741C162F3C2636455854560E72760A6A667B315E37
    5553010B7A group YYY
    radius-server attribute 32 include-in-access-req format %h
    radius-server host 172.16.1.35 auth-port 1812 acct-port 1813 key 7 VVV
    radius-server vsa send accounting
    bridge 1 route ip
    line con 0
    line vty 0 4
    access-class 10 in
    line vty 5 15
    end
    Debug Output:
    331: AAA/ACCT(00000000): add node, session 4
    *Mar  1 21:37:37.331: AAA/ACCT/NET(00000004): add, count 1
    *Mar  1 21:37:37.331: dot11_auth_add_client_entry: Create new client 0023.6c85.3
    2cd for application 0x1
    *Mar  1 21:37:37.331: dot11_auth_initialize_client: 0023.6c85.32cd is added to t
    he client list for application 0x1
    *Mar  1 21:37:37.331: dot11_auth_add_client_entry: req->auth_type 4
    *Mar  1 21:37:37.331: dot11_auth_add_client_entry: auth_methods_inprocess: 2
    *Mar  1 21:37:37.331: dot11_auth_add_client_entry: eap list name: eap_methods
    *Mar  1 21:37:37.331: dot11_run_auth_methods: Start auth method EAP or LEAP
    *Mar  1 21:37:37.331: dot11_auth_dot1x_start: in the dot11_auth_dot1x_start
    *Mar  1 21:37:37.331: dot11_auth_dot1x_send_id_req_to_client: Sending identity r
    equest to 0023.6c85.32cd
    *Mar  1 21:37:37.332: EAPOL pak dump tx
    *Mar  1 21:37:37.332: EAPOL Version: 0x1  type: 0x0  length: 0x0036
    *Mar  1 21:37:37.332: EAP code: 0x1  id: 0x1  length: 0x0036 type: 0x1
    00ECBA00: 01000036 01010036 01006E65 74776F72  ...6...6..networ
    00ECBA10: 6B69643D 4F52505F 5075626C 69632C6E  kid=YYY,n
    00ECBA20: 61736964 3D4F5250 5F524F4F 46444543  asid=YYY
    00ECBA30: 4B2C706F 72746964 3D30               K,portid=0
    *Mar  1 21:37:37.333: dot11_auth_send_msg:  sending data to requestor status 1
    *Mar  1 21:37:37.333: dot11_auth_send_msg: Sending EAPOL to requestor
    *Mar  1 21:37:37.333: dot11_auth_dot1x_send_id_req_to_client: Client 0023.6c85.3
    2cd timer started for 30 seconds
    *Mar  1 21:38:07.333: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,TI
    MEOUT) for 0023.6c85.32cd
    *Mar  1 21:38:07.333: dot11_auth_dot1x_send_client_fail: Authentication failed f
    or 0023.6c85.32cd
    *Mar  1 21:38:07.333: dot11_auth_send_msg:  sending data to requestor status 0
    *Mar  1 21:38:07.333: dot11_auth_send_msg: client FAILED to authenticate 0023.6c
    85.32cd, node_type 64 for application 0x1
    *Mar  1 21:38:07.333: dot11_auth_delete_client_entry: 0023.6c85.32cd is deleted
    for application 0x1
    *Mar  1 21:38:07.334: %DOT11-7-AUTH_FAILED: Station 0023.6c85.32cd Authenticatio
    n failed
    *Mar  1 21:38:07.334: AAA/ACCT/HC(00000004): Update DOT11/00A83CE0
    *Mar  1 21:38:07.335: AAA/ACCT/HC(00000004): DOT11/00A83CE0 [pre-sess] (rx/tx) b
    ase 0/0 pre 6861/188 call 6861/188
    *Mar  1 21:38:07.335: AAA/ACCT/HC(00000004): DOT11/00A83CE0 [pre-sess] (rx/tx) a
    djusted, pre 6861/188 call 0/0
    *Mar  1 21:38:07.335: AAA/ACCT/HC(00000004): Deregister DOT11/00A83CE0
    *Mar  1 21:38:07.335: dot11_auth_client_abort: Received abort request for client
    0023.6c85.32cd
    *Mar  1 21:38:07.335: dot11_auth_client_abort: No client entry to abort: 0023.6c
    85.32cd for application 0x1
    *Mar  1 21:38:07.335: AAA/ACCT/EVENT/(00000004): CALL STOP
    *Mar  1 21:38:07.335: AAA/ACCT/CALL STOP(00000004): Sending stop requests
    *Mar  1 21:38:07.336: AAA/ACCT(00000004): Send all stops
    *Mar  1 21:38:07.336: AAA/ACCT/NET(00000004): STOP
    *Mar  1 21:38:07.336: AAA/ACCT/NET(00000004): Method list not found
    *Mar  1 21:38:07.336: AAA/ACCT(00000004): del node, session 4
    *Mar  1 21:38:07.336: AAA/ACCT/NET(00000004): free_rec, count 0
    *Mar  1 21:38:07.336: AAA/ACCT/NET(00000004) reccnt 0, csr TRUE, osr 0
    *Mar  1 21:38:07.337: AAA/ACCT/NET(00000004): Last rec in db, intf not enqueued
    *Mar  1 21:41:34.645: AAA/BIND(00000005): Bind i/f
    *Mar  1 21:41:34.645: AAA/ACCT/EVENT/(00000005): CALL START
    *Mar  1 21:41:34.645: Getting session id for NET(00000005) : db=C4EBC0
    *Mar  1 21:41:34.645: AAA/ACCT(00000000): add node, session 5
    *Mar  1 21:41:34.646: AAA/ACCT/NET(00000005): add, count 1
    *Mar  1 21:41:34.646: Getting session id for NONE(00000005) : db=C4EBC0
    *Mar  1 21:41:34.646: AAA/AUTHEN/LOGIN (00000005): Pick method list 'Permanent L
    ocal'
    *Mar  1 21:41:39.002: AAA/AUTHOR (0x5): Pick method list 'default'
    *Mar  1 21:41:39.002: AAA/AUTHOR/EXEC(00000005): processing AV cmd=
    *Mar  1 21:41:39.003: AAA/AUTHOR/EXEC(00000005): processing AV priv-lvl=15
    *Mar  1 21:41:39.003: AAA/AUTHOR/EXEC(00000005): Authorization successful
    Any ideas how I can get simple username/password working on an autonomous AP with local radius server?
    Thank you,

    You could get a better idea of why the auth is being failed with the output of "show radius local-server statistics".  You could also run "debug radius local-server client" and "debug radius local-server error".

  • Local Radius / LEAP only

    With a Cisco 1120, does the local radius server only support LEAP? Any way to get support for PEAP?
    Thanks,

    The "Local Authentication Server" is currently LEAP only.

  • RADIUS Server - Extending the network

    I have successfully set up RADIUS running on 10.5.5. Users are able log in and all is working well (except for Windows XP clients connecting from login, but who cares about them at the moment!)
    I want to be able to extend the network. I am using Apple AirPort Extreme base stations. There is an option to extend the wireless network, but when I tick this, I lose the ability to set up with WPA Enterprise and RADIUS. If I give the networks the same SSID will this let me roam?
    Any help appreciated!

    Hallo
    I found this to help you with Windows Xp login http://www.usr.com/support/doc-popup-template.asp?url=faqs/networking/zero-confi g-radius/zero-config-radius.htm&loc=unst
    Windows XP klient på Leopard server RADIUS (AirPorts)

  • Aaa radius server control privilege level

    I've got radius authentication working on my switch, but I'm trying to allow two types of users login using Windows Active Directory. NetworkUsers who can view configuration and NetworkAdmins who can do anything. I would like for NetworkAdmins to when they login go directly into privilege level 15 but cant get that part to work. Here is my setup:
    Windows 2008 R2 Domain controller with NPS installed.
    Radius client: I have the IP of the switch along with the key. I have cisco selected under the vendor name in the advance tab
    Network Policies:
    NetworkAdmins which has the networkadmin group under conditions and under settings i have nothing listed under Standard and for Vendor Specific i have :
    Cisco-AV-Pair    Cisco    shell:priv-lvl=15
    My switch config:
    aaa new-model
    aaa group server radius MTFAAA
     server name dc-01
     server name dc-02
    aaa authentication login NetworkAdmins group MTFAAA local
    aaa authorization exec NetworkAdmins group MTFAAA local
    radius server dc-01
     address ipv4 10.0.1.10 auth-port 1645 acct-port 1646
     key 7 ******
    radius server dc-02
     address ipv4 10.0.1.11 auth-port 1645 acct-port 1646
     key 7 ******
    No matter what i do it doesnt default to privilege level 15 when i login. Any thoughts

    Have you specified the authorization exec group under line vty? I think it is authorization exec command. Something like that.

Maybe you are looking for