Radius WPA2 Enterprise Error

I have 3 AirPort Dual Band BaseStations on the wired network and security is handled by the Radius service on a Mac (Snow Leopard) Server. In fact, 1 of them is a Time Capsule and although the wireless setup is identical to the other BSs, a MacBook Pro sitting about 4 feet from the TC insists on instead connecting through a double wall to one of the other BSs which is in the next room. After restarting AirPort on the MBP it seemed to be ok, then later that day - no connection and try as I might I couldn't get it to connect.
Today I had another look at the MBP and the problem seems to be related to the authentication with the Radius Server (10.6.2 on an XServe in this case). When I checked the logs I see this error repeated
"Error: Ignoring request to authentication address * port 1812 from unknown client xx.xx.xx.xx port 65524"
where xx.xx.xx.xx IS the address of the Time Capsule that the MBP should be trying to connect to and this is most definitely listed as a Base Station in the Radius config. Again, I restarted AirPort on the MBP and authentication was rapidly established and connection was perfect. But will it be able to connect when it wakes up again?
So without any actual configuration changes, I may get the above error, or I may not. Under what circumstances would this error be generated when the config is obviously not incorrect?
Anyone help here?

I am trying to deal with this very issue now. My connections work through regular computers (Macs), albeit with the "non-trusted certificate" warning. I am trying to get this to work with my iPhone. I sent the certificate to my iPhone (and installed it), but I still get the error. Interestingly it's through a Time Capsule (Dual Band II), so I may try it with my earlier revision of TC.
Edit: Confirmed: the older TC (single-band) works well. The new TC just gets ignored by the server so it never gets a chance to even protest the untrusted certificate. I'll continue to work the problem...
Edit2: Rebooting the RADIUS server seems to have solved this problem (?)
Edit3: Pro tip (evidently): Reboot the RADIUS server every time you add/delete a base station.

Similar Messages

  • Cisco 1140AP using WPA2-enterprise with radius

    All,
    I am trying to configure an1140 AP to use WPA2-enterprise & radius. Ultimately I want to be able to connect to the SSID using my active directory credentials. I would like the AP to send authentication requests to our Network Policy Server. Here is a copy of the config; any help is appreciated.
    version 12.4
    no service pad
    aaa new-model
    aaa group server radius rad_eap
    server 172.16.16.101 auth-port 1812 acct-port 1813
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa group server radius rad_eap1
    aaa authentication login myLogin local
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authentication dot1x rad_eap group radius
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    dot11 syslog
    dot11 ssid ITWireless
       authentication open eap rad_eap
       authentication key-management wpa version 2
       guest-mode
    username admin password 7 XXXXXXXXXXXXXXXXXXXXX
    bridge irb
    interface Dot11Radio0
    no ip address
    no ip route-cache
    encryption mode ciphers aes-ccm
    ssid ITWireless
    antenna gain 0
    interface Dot11Radio1
    no ip address
    no ip route-cache
    encryption mode ciphers aes-ccm
    ssid ITWireless
    interface BVI1
    ip address 172.16.42.21 255.255.0.0
    no ip route-cache
    ip default-gateway 172.16.16.198
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    radius-server attribute 32 include-in-access-req format %h
    radius-server host 172.16.16.101 auth-port 1812 acct-port 1813 key 7 1427321938572903
    radius-server vsa send accounting
    bridge 1 route ip

    I did see those screenshots however that settings screen comes from selecting the Configure button next to the Authentication Method in the User Authentication section under Users.  In each of your screenshots, the RADIUS Server ID number is 1 so I would also ensure that I've configured RADIUS Server ID 1 which can only be configured by going to Users -> RADIUS Servers.
    All that said, I did see that your tests succeeded and I also don't understand the point of having RADIUS settings on the other screens and then having RADIUS ID info.  My thinking is that you would be able to configure RADIUS once in the Users -> RADIUS Servers screen and then select the RADIUS Server ID in all the remaining screens without having to enter the RADIUS info over and over again.  It would also think that you could skip the Users -> RADIUS Server screen and enter the RADIUS information over and over again and it should work...just like you set it up originally.  However, based on past experience of programmatic errors, I would recommend configuring the RADIUS Server ID 1 under Users -> RADIUS Servers if you haven't already...just in case. 
    Shawn Eftink
    CCNA/CCDA
    Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.

  • Bridging a WPA2 Enterprise Radius Server (Lion Server) to Apple TV

    Hello,
    I was wondering if anyone can help me out with this setup that I have with Lion Server. Recently I set up my Airport Extreme to use Radius and bind it to my Lion Server for Authentication. Radius works with most of my devices, except for my ATV2 (which is in a different room from the AIrport Extreme.) As most of you may know, ATV2 doesn't support WPA2 Enterprise networks.
    Ideally what I would like to do is have the Apple TV connect to my wireless network for all of my videos that are shared on a HD connected to my Lion Server. I was thinking about looking for a WPA2 enterprise wireless bridge with an Ethernet port so that I can connect the ATV to the bridge and have the bridge connect to my Airport Extreme. However, here is what I can not figure out. How can I get that bridge to authenticate to the Radius Server on Lion Server? From my understanding the Radius service on the Lion Server uses its own proprietary radius server to where I couldn't get the bridge to cnnect.
    Please let me know your thoughts. If it helps, I have a 1st generation TC that I can place in the other room. However, I couldn't see any functionality in Airport Utility that would allow me to bridge that box to the WPA 2 Enterprise network.

    Hello,
    I was wondering if anyone can help me out with this setup that I have with Lion Server. Recently I set up my Airport Extreme to use Radius and bind it to my Lion Server for Authentication. Radius works with most of my devices, except for my ATV2 (which is in a different room from the AIrport Extreme.) As most of you may know, ATV2 doesn't support WPA2 Enterprise networks.
    Ideally what I would like to do is have the Apple TV connect to my wireless network for all of my videos that are shared on a HD connected to my Lion Server. I was thinking about looking for a WPA2 enterprise wireless bridge with an Ethernet port so that I can connect the ATV to the bridge and have the bridge connect to my Airport Extreme. However, here is what I can not figure out. How can I get that bridge to authenticate to the Radius Server on Lion Server? From my understanding the Radius service on the Lion Server uses its own proprietary radius server to where I couldn't get the bridge to cnnect.
    Please let me know your thoughts. If it helps, I have a 1st generation TC that I can place in the other room. However, I couldn't see any functionality in Airport Utility that would allow me to bridge that box to the WPA 2 Enterprise network.

  • WPA2-Enterprise + EAP (PEAP) and 802.1x to authenticate to RADIUS server NPS

    I need to connect my iPhone and my iPad to the corporate wireless network using WPA2-Enterprise and 802.1x to authenticate against a RADIUS server with my corporate user. What is the procedure to configure the clients? Certificates is not necessary on the client. Radius server is a NPS of Microsoft and the WLC is a 5508 of Cisco.
    thanks !!!

    WPA and WPA2 are all actually interim protocols that are used until the standardization of IEEE 802.11i standard. Wi-fi appliance decided that ratification and standardization of 802.11i standards will take more time. So, they came up with WPA.
    Now, WPA2 is advanced version of WPA. WPA2 uses AES as encryption algorithm. Whereas, WPA use TKIP as encryption mode which in turn uses RC4 encryption algorithm.
    WPA and WPA2 are actually are of 2 types respectively.
    WPA/WPA2-PSK - This is mainly for small offices. This uses Pre-Shared Key for authentication.
    WPA/WPA2 -Enterprise - This uses a RADIUS Server for authentication. This is an extension to 802.1x authentication. But this uses stronger encryption scheme(WPA uses RC4 and WPA2 uses AES).
    Any authentication mechanism that involves a separation authentication server for authentication like ACS server is called 802.1x authentication.
    EAP stands for Extensible Authentication Protocol. It refers to the type or method of 802.1x Authentication by the RADIUS/Tacacs server. A RADIUS server can authenticate a wireless client with various EAP methods.
    LEAP is one type of EAP. It uses username and password for authenticating wireless clients. LEAP is cisco proprietory.
    There are also EAP types which uses other user credentials like Certificates, SIM etc for authentcation.
    The following document might clarify your doubts.
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_q_and_a_item09186a00805e8297.shtml

  • Free RADIUS/802.1X Service for WPA/WPA2-Enterprise

    Hi, just wanted to let everyone know that I recently started offering a Free Edition of our AuthenticateMyWiFi service, a hosted RADIUS/AAA service offering 802.1X authentication for use with WPA/WPA2-Enterprise encryption.
    The Free Edition features 1 user account, supports 1 AP, and includes: PEAP authentication for wireless and wired connections, web-based control panel, and activity logging.
    This is great for IT professionals wanting to experiment with 802.1X or to get enterprise Wi-Fi security in homes and small offices.
    For more info visit our site:
    http://www.nowiressecurity.com/service.htm
    - Eric Geier

    I recommend contacting Linksys support on the phone and ask them which model router has Radius or Enterprise WPA features. Some home class routers may not have this. Ask and see what is available. 

  • Creating a Configurator profile for ATV on WPA2 Enterprise?

    Alright, so I have a couple of Apple TVs (latest version) which I want to get up and running on our wireless network here at work. We have a WPA/WPA2 Enterprise network. Our access point is simply an Airport Extreme and the RADIUS server is running on OS X Server 10.6.
    I understand that I have to load the Apple TV with a profile to get it to connect to the wireless network but I can't for the life of me figure out what the correct settings are for my network. I'd ask our IT department but the problem is that I am the IT department.
    When I try to connect using the profiles I've created I get the error "There was a problem connecting to the network. Check your settings and try again. (-369033215).
    The first issue (I believe) is that I might not be choosing the right EAP types. In configurator I can choose TLS. TTLS, LEAP, PEAP, EAP-FAST, EAP-SIM, or EAP-AKA. I have no idea which one I should be choosing or how to figure out which types my network supports. Also some of them want me to enter an outer identity which again, I have no idea what to put there.
    The second issue may be the trusted certificates - I may not have the correct one(s). When I check the RADIUS server settings, it shows that I'm using a self-signed certificate that I generated quite a while ago (we don't have any actual certs, just self-signed ones - small office, not my area of expertise so I didn't want to waste company money without knowing what I was doing). So, what I did was I opened up Keychain Access, found that certificate, exported it, and imported it into Configurator. I imported it into Trusted Certificates but I didn't put anything in for Trusted Server Certificate Names - should I put anything in there?
    Any help is appreciated.

    Ok that part I put above would go in your SQL, not in the report properties - you also want to replace p.product_image with whatever your BLOB column is, and p.product_id with your employee_id column.
    The apex_util.get_blob_file_src basically does the same thing that you were doing but should be a little simpler to manage.
    http://download.oracle.com/docs/cd/E14373_01/apirefs.32/e13369/apex_util.htm#CHDICGDA
    So:
    1) Edit your sql and try using this function instead of just calling the BLOB column.
    2) Edit the column properties and put #PHOTO# as the link, and #EMPLOYEE_ID# (or whatever your primary key is called) as the Value.
    3) If that long string is still in the number/character format field, clear it out.
    4) If that still doesn't work, install the demo application that comes with Apex and look at Page 3. That is all I did.

  • WiFi WPA2 enterprise

    I’m encountering problem setting up a wifi wpa2 Enterprise on my Iphone 4s. I set it up using Iphone configuration utility and settings are correct. The problem is that the connection don’t works. I’m sure setting are correct because I set it up the same wifi also on the Airbook with Lion and parameter and certificates used for authentication are exactly the same. Any idea on why on the iphon it don’t work?
    Below some the log file.
    Thanks
    andrea
    Jan 11 16:14:18 Scoia-Aifone Preferences[558] <Warning>: -[VPNBundleController _vpnConfigurationChanged:] (0xde41320:<VPNBundleController: 0xde41320>): _serviceCount(1), serviceCount(1), toggleInRootMenu(1), RootMenuItem(1)
    Jan 11 16:14:20 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setDISASSOCIATE() [wifid]:
    Jan 11 16:14:20 Scoia-Aifone timed[679] <Notice>: (Note ) CoreTime: Not setting system time to 01/11/2012 15:14:20 from NTP because time is unchanged
    Jan 11 16:14:20 Scoia-Aifone eapolclient[680] <Notice>: en0 START
    Jan 11 16:14:20 Scoia-Aifone timed[679] <Notice>: (Note ) CoreTime: Not setting time zone to Europe/Rome from Location
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setASSOCIATE() [wifid]:  lowerAuth = AUTHTYPE_OPEN, upperAuth = AUTHTYPE_WPA_8021X, key = CIPHER_NONE    , 802.1X .
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANJoinManager::handleAssoc(): status = 2, reason = 0, flags = 0x0, authtype = 0, addr = 00:3a:98:7d:ee:30
    Jan 11 16:14:21 Scoia-Aifone wifid[29] <Error>: WiFi:[347987661.158384]: Processing link event UP
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANJoinManager::handleAssoc(): status = 2, reason = 0, flags = 0x0, authtype = 0, addr = 00:3a:98:7d:ee:30
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: [14591.399631250]: AppleBCMWLANNetManager::prepareToBringUpLink(): Delaying powersave entry in order to get an IP address
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLAN Joined BSS:     @ 0xc0bc4000, BSSID = 00:3a:98:7d:ee:30, rssi = -73, rate = 54 (100%), channel = 6, encryption = 0x4, ap = 1, failures = 0, age = 1, ssid[ 6] = "WIFI3D"
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: AirPort: Link Up on en0
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: en0: BSSID changed to 00:3a:98:7d:ee:30
    Jan 11 16:14:21 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore:startRoamScan(): 2843 Delaying RoamScan; because  Join Mgr Busy 0 isWaitingforIP 1
    Jan 11 16:14:22 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setCIPHER_KEY() [eapolclient]: type = CIPHER_PMK, index = 0, flags = 0x0, key lenght 0, key rsc lenght 0
    Jan 11 16:14:24 Scoia-Aifone mDNSResponder[47] <Error>: mDNS_RegisterInterface: Frequent transitions for interface en0 (FE80:0000:0000:0000:F2CB:A1FF:FECB:ED60)
    Jan 11 16:14:26 Scoia-Aifone UserEventAgent[12] <Warning>: Unable to cancel system wake for 2012-01-11 16:14:11 +0100. IOPMCancelScheduledPowerEvent() returned 0xe00002c2
    Jan 11 16:14:27 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::checkRealTimeTraffic(): set roam parameters: counters Rx:1204 Tx:22
    Jan 11 16:14:28 Scoia-Aifone eapolclient[680] <Notice>: en0 TLS: authentication failed with status 1
    Jan 11 16:14:28 Scoia-Aifone wifid[29] <Error>: WiFi:[347987668.238433]: Network WIFI3D Both autojoin and user join dates are NULL
    Jan 11 16:14:28 Scoia-Aifone wifid[29] <Error>: WiFi:[347987668.246099]: Processing link event DOWN
    Jan 11 16:14:28 Scoia-Aifone eapolclient[680] <Notice>: en0 STOP
    Jan 11 16:14:28 Scoia-Aifone eapolclient[681] <Notice>: en0 START
    Jan 11 16:14:28 Scoia-Aifone Preferences[558] <Warning>: -[VPNBundleController _vpnConfigurationChanged:] (0xde41320:<VPNBundleController: 0xde41320>): _serviceCount(1), serviceCount(1), toggleInRootMenu(1), RootMenuItem(1)
    Jan 11 16:14:28 Scoia-Aifone wifid[29] <Error>: WiFi:[347987668.683288]: Processing link event UP
    Jan 11 16:14:28 Scoia-Aifone UserEventAgent[12] <Warning>: Unable to cancel system wake for 2012-01-11 16:14:18 +0100. IOPMCancelScheduledPowerEvent() returned 0xe00002c2
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::handleDeauth(): status = 0, reason = 23, flags = 0x0, authtype = 0, addr = 00:3a:98:7d:ee:30
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setCIPHER_KEY() [eapolclient]: type = CIPHER_PMK, index = 0, flags = 0x0, key lenght 0, key rsc lenght 0
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::leaveNetworkAsync(): kDeauthdCurrNetwork already set. Skipping call to leaveNetworkASync
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLAN Left BSS:       @ 0xc0bc4000, BSSID = 00:3a:98:7d:ee:30, rssi = -77, rate = 54 (100%), channel = 6, encryption = 0x4, ap = 1, failures = 0, age = 8, ssid[ 6] = "WIFI3D"
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AirPort: Link Down on en0. Reason 1 (Unspecified).
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setDISASSOCIATE() [wifid]:
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setASSOCIATE() [wifid]:  lowerAuth = AUTHTYPE_OPEN, upperAuth = AUTHTYPE_WPA_8021X, key = CIPHER_NONE    , 802.1X .
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: [14598.930095541]: AppleBCMWLANNetManager::prepareToBringUpLink(): Delaying powersave entry in order to get an IP address
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLAN Joined BSS:     @ 0xc0bc4000, BSSID = 00:3a:98:7d:ee:30, rssi = -77, rate = 54 (100%), channel = 6, encryption = 0x4, ap = 1, failures = 0, age = 8, ssid[ 6] = "WIFI3D"
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AirPort: Link Up on en0
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: en0: BSSID changed to 00:3a:98:7d:ee:30
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore:startRoamScan(): 2843 Delaying RoamScan; because  Join Mgr Busy 0 isWaitingforIP 1
    Jan 11 16:14:29 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setCIPHER_KEY() [eapolclient]: type = CIPHER_PMK, index = 0, flags = 0x0, key lenght 0, key rsc lenght 0
    Jan 11 16:14:31 Scoia-Aifone eapolclient[681] <Notice>: en0 TLS: authentication failed with status 1
    Jan 11 16:14:31 Scoia-Aifone wifid[29] <Error>: WiFi:[347987671.532160]: Network WIFI3D Both autojoin and user join dates are NULL
    Jan 11 16:14:31 Scoia-Aifone eapolclient[681] <Notice>: en0 STOP
    Jan 11 16:14:31 Scoia-Aifone wifid[29] <Error>: WiFi:[347987671.542420]: Processing link event DOWN
    Jan 11 16:14:31 Scoia-Aifone UserEventAgent[12] <Warning>: Unable to cancel system wake for 2012-01-11 16:14:18 +0100. IOPMCancelScheduledPowerEvent() returned 0xe00002c2
    Jan 11 16:14:31 Scoia-Aifone eapolclient[682] <Notice>: en0 START
    Jan 11 16:14:31 Scoia-Aifone Preferences[558] <Warning>: -[VPNBundleController _vpnConfigurationChanged:] (0xde41320:<VPNBundleController: 0xde41320>): _serviceCount(1), serviceCount(1), toggleInRootMenu(1), RootMenuItem(1)
    Jan 11 16:14:31 Scoia-Aifone wifid[29] <Error>: WiFi:[347987671.974798]: Processing link event UP
    Jan 11 16:14:31 Scoia-Aifone UserEventAgent[12] <Warning>: Unable to cancel system wake for 2012-01-11 16:14:21 +0100. IOPMCancelScheduledPowerEvent() returned 0xe00002c2
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setCIPHER_KEY() [eapolclient]: type = CIPHER_PMK, index = 0, flags = 0x0, key lenght 0, key rsc lenght 0
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::handleDeauth(): status = 0, reason = 23, flags = 0x0, authtype = 0, addr = 00:3a:98:7d:ee:30
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::leaveNetworkAsync(): kDeauthdCurrNetwork already set. Skipping call to leaveNetworkASync
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLAN Left BSS:       @ 0xc0bc4000, BSSID = 00:3a:98:7d:ee:30, rssi = -77, rate = 54 (100%), channel = 6, encryption = 0x4, ap = 1, failures = 0, age = 11, ssid[ 6] = "WIFI3D"
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AirPort: Link Down on en0. Reason 1 (Unspecified).
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setDISASSOCIATE() [wifid]:
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setASSOCIATE() [wifid]:  lowerAuth = AUTHTYPE_OPEN, upperAuth = AUTHTYPE_WPA_8021X, key = CIPHER_NONE    , 802.1X .
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: [14602.222531083]: AppleBCMWLANNetManager::prepareToBringUpLink(): Delaying powersave entry in order to get an IP address
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLAN Joined BSS:     @ 0xc0bc4000, BSSID = 00:3a:98:7d:ee:30, rssi = -77, rate = 54 (100%), channel = 6, encryption = 0x4, ap = 1, failures = 0, age = 12, ssid[ 6] = "WIFI3D"
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AirPort: Link Up on en0
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: en0: BSSID changed to 00:3a:98:7d:ee:30
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore:startRoamScan(): 2843 Delaying RoamScan; because  Join Mgr Busy 0 isWaitingforIP 1
    Jan 11 16:14:32 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setCIPHER_KEY() [eapolclient]: type = CIPHER_PMK, index = 0, flags = 0x0, key lenght 0, key rsc lenght 0
    Jan 11 16:14:34 Scoia-Aifone eapolclient[682] <Notice>: en0 TLS: authentication failed with status 1
    Jan 11 16:14:34 Scoia-Aifone wifid[29] <Error>: WiFi:[347987674.708487]: Network WIFI3D Both autojoin and user join dates are NULL
    Jan 11 16:14:34 Scoia-Aifone wifid[29] <Error>: WiFi:[347987674.716635]: Processing link event DOWN
    Jan 11 16:14:34 Scoia-Aifone UserEventAgent[12] <Warning>: Unable to cancel system wake for 2012-01-11 16:14:21 +0100. IOPMCancelScheduledPowerEvent() returned 0xe00002c2
    Jan 11 16:14:34 Scoia-Aifone eapolclient[682] <Notice>: en0 STOP
    Jan 11 16:14:35 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::handleDeauth(): status = 0, reason = 23, flags = 0x0, authtype = 0, addr = 00:3a:98:7d:ee:30
    Jan 11 16:14:35 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANCore::setCIPHER_KEY() [eapolclient]: type = CIPHER_PMK, index = 0, flags = 0x0, key lenght 0, key rsc lenght 0
    Jan 11 16:14:35 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLANNetManager::leaveNetworkAsync(): kDeauthdCurrNetwork already set. Skipping call to leaveNetworkASync
    Jan 11 16:14:35 Scoia-Aifone kernel[0] <Debug>: AppleBCMWLAN Left BSS:       @ 0xc0bc4000, BSSID = 00:3a:98:7d:ee:30, rssi = -76, rate = 54 (100%), channel = 6, encryption = 0x4, ap = 1, failures = 0, age = 14, ssid[ 6] = "WIFI3D"
    Jan 11 16:14:35 Scoia-Aifone kernel[0] <Debug>: AirPort: Link Down on en0. Reason 1 (Unspecified).
    Jan 11 16:14:37 Scoia-Aifone mDNSResponder[47] <Error>: DeregisterInterface: Frequent transitions for interface en0 (FE80:0000:0000:0000:F2CB:A1FF:FECB:ED60)
    Jan 11 16:14:39 Scoia-Aifone UserEventAgent[12] <Warning>: Unable to cancel system wake for 2012-01-11 16:14:24 +0100. IOPMCancelScheduledPowerEvent() returned 0xe00002c2

    I did see those screenshots however that settings screen comes from selecting the Configure button next to the Authentication Method in the User Authentication section under Users.  In each of your screenshots, the RADIUS Server ID number is 1 so I would also ensure that I've configured RADIUS Server ID 1 which can only be configured by going to Users -> RADIUS Servers.
    All that said, I did see that your tests succeeded and I also don't understand the point of having RADIUS settings on the other screens and then having RADIUS ID info.  My thinking is that you would be able to configure RADIUS once in the Users -> RADIUS Servers screen and then select the RADIUS Server ID in all the remaining screens without having to enter the RADIUS info over and over again.  It would also think that you could skip the Users -> RADIUS Server screen and enter the RADIUS information over and over again and it should work...just like you set it up originally.  However, based on past experience of programmatic errors, I would recommend configuring the RADIUS Server ID 1 under Users -> RADIUS Servers if you haven't already...just in case. 
    Shawn Eftink
    CCNA/CCDA
    Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.

  • Can't change Airport Extreme settings using WPA2 Enterprise

    I have a 4th Gen Airport Extreme Base Station that is running 7.6.1 firmware and I've updated the Airport Utility to 6.0 and OS X Server to 10.7.3
    I use WPA2 Enterprise using the Radius Server set up from the Server admin tools in Lion Server. I am using my CA signed certificate for the server as my server-side cert. I can connect fine to the wireless network with all my idevices and my MacBook Pro, but whenever I use Airport Utility to amend settings of the Base Station e.g. Back to my Mac, I cannot make updates.
    Whenever I click 'Update' I get the following error - 'Invalid value' The value for "Password" is invalid. When I click Review Settings, it takes me to the Shared Secret settings for the connection, but as far as I'm concerned this never needs to be known or changed.
    Any ideas?

    I have the same problem.. Airport utility 6.0 on 4th gen airport extreme and server 10.7.4.
    DNS, Radius and Open Directory.
    Any update on Airport Util results in "'Invalid value' The value for "Password" is invalid"
    Only work around I've found like above is to set network mode to "off" under wireless tab. Update Airport Utility ... then remove/add my base station in Server admin under 'radius' 'base stations' ..
    Really very annoying because what I actually want to change is the WPA/WPA2 to WPA2 ONLY.
    By default when the base station is added in 'server admin' it sets it as WPA/WPA2 and there is no option to change or control this in 'server admin'... so basically I can not change this option.
    I thought maybe that 'invalid' characters (for the airport) where being used by server admin when it generates the 'shared secret' .. so have tried changing to a very simple shared secret in 'airport utility' ... but I still get the same error - "The value for "Password" is invalid"
    I will try downgrading to 5.6 but this really is very annoying especially as its a fault that has been allowed to rollover into 10.7.4 !!!!
    Sort it out Apple!

  • WPA2-enterprise WIFI can't connect after upgrading to 6.1 or higher

    Hi. Please help.
    We have a campus wifi with two ssids: one open for everyone and one closed with wpa2-enterprise (PEAP) security for staff. All iphones and ipads works just fine on ios version 6.01 but they can't connect to secured wifi network after updating to ios ver 6.1 and higher (tried 6.1.2). They still able to connect to open wlan ssid. Our WIFI equipment is: Extremenetworks WM3600 controllers and AP4600/AP4511 access points running WM5.4.1. WMM enabled.
    WM3600 controller use Windows2008 r2 NPS server + active directory for authorization (selfsigned certificates is 2048 bit length).
    WM3600 wlan staff configuration settings:
    wlan Staff
    description TOGU staff network
    ssid STAFF
    vlan 238
    bridging-mode tunnel
    encryption-type tkip-ccmp
    authentication-type eap
    no answer-broadcast-probes
    protected-mgmt-frames optional
    radius vlan-assignment
    no motorola-extensions symbol-load-information
    use aaa-policy Domain_aaa
    Here is the log from iphone configuration utility with connection error:
    Feb 20 17:18:00  kernel[0] <Debug>: en0::IO80211Interface::postMessage bssid changed 
    Feb 20 17:18:00  Preferences[132] <Warning>: -[VPNConnectionStore reloadVPN]: The active VPN configuration has changed from  to (null)
    Feb 20 17:18:00  Preferences[132] <Warning>: -[VPNBundleController _vpnConfigurationChanged:] (0x1edbea10:<VPNBundleController: 0x1edbea10>): _serviceCount(0), serviceCount(0), toggleInRootMenu(0), RootMenuItem(1)
    Feb 20 17:18:00  wifid[14] <Error>: WiFi:[383033880.387575]: Failed to associate with STAFF: -3900
    Hope to get any help.

    Yes. We tried to reboot iphone(s), tried also with ipads 6.1. We tried to reset network settings.
    We tried to add wifi profile to clean new iphone using iphone configuration utility.
    Wireless supplier can't help - they told it is an ios issue and I think this is true because all
    ipads/iphones works just fine on  ios5 or 6.0.1 but can't connect on 6.1

  • IOS 5 can't connect to WPA/WPA2 Enterprise Wireless Network

    After upgrading multiple iPhone 4 (CDMA versions) to IOS 5.0, I have not been able to get them to connect to our WPA/WPA2 Enterprise wirless network.  We use a Cisco Wireless LAN Controller.  The wireless network is capable of doing WPA or WPA2 Enterprise with PEAP.  These phones all connected to this network fine before the upgrade.
    When connecteding to the network, it prompts me for the username and password and when I tap join it sits for about 10-15 seconds then says "Unable to join the network" with a Dismiss button.
    It connects to non-Enterprise networks just fine.  I have tested it on WPA Personal and WPA2 Personal networks and it has worked on several without issue.
    I have tried "forget this network" with no success.
    Is anyone else having this problem?  I know of at least three Verizon iPhone 4's that have this exact same problem.  I haven't seen one working with this configuration yet.

    I have the same problem:
    Cisco WLC's -> WPA2 Enterprise AES + EAP-PEAP 802.1x with CCKM
    Pre 5.0 - all worked fine
    Post 5.0 - it tries to connect and after few moments i get error - couldn't connect.
    Info from controller:
    10/17/2011 12:16:37 CEST           INFO           172.16.16.X           Sending EAP request to client from radius server. 6.f. ..l
    10/17/2011 12:16:38 CEST           ERROR           172.16.16.X           Retransmitting EAP-ID request to client,retransmission timer expired. 5.y. ..l
    10/17/2011 12:16:39 CEST           ERROR           172.16.16.X           Retransmitting EAP-ID request to client,retransmission timer expired. 5.y. ..l
    10/17/2011 12:16:40 CEST           ERROR           172.16.16.X           Authentication failed for client as EAP ID request from AP reached maxmium retransmissions. 5.yp ..l
    10/17/2011 12:16:40 CEST           ERROR           172.16.16.X           De-authentication sent to client. 5.oP ..l
    10/17/2011 12:16:40 CEST           ERROR           172.16.16.X           5.yp ..l
    10/17/2011 12:16:40 CEST           ERROR           172.16.16.X           EAPOL-key is invalid, scheduling client for deletion. 5.yp ..l
    On the Radius server i don't see any activity regarding this device.
    I had this network configured on my iPhone - after upgrade and restore it remembered it. Every time i was in vicinity of my Enterprise WLAN it tried to connect - resulting int express battery drain - 6-7 hrs and battery was empty from 100%

  • Can't create a WPA2-Enterprise wireless connection; missing Microsoft: PEAP

    OS: Windows 7 64-bit Enterprise
    Hardware: Lenovo T410S w/Intel 5300 ABGN Wireless
    If I try to build the wireless connection manually and choose WPA2-Enterprise, then click next, I get 'An unexpected error occurred.' and no options to configure; just close.
    I then tried to create a Preshared Key WPA2 connection. This worked fine. When I go to edit the connection, I have the ability to select the WPA2-Enterprise options, however in the list of Network Authentication methods (under Security Tab), I don't have
    the Microsoft: PEAP or SmartCard options. I only have Cisco: LEAP,PEAP,EAP-FAST and Intel: EAP-SIM,EAP-TTLS,EAP-AKA (6 entries).
    It's my theory that because the Microsoft options are missing, the wizard gets the unexpected error. I'm wondering how I get the MS ones back.

    Hi,
    Thanks for posting in Microsoft TechNet forums.
    Do you have Symantec installed? It is said the issue could be due to conflict with Symantec Endpoint Protection. Please uninstall\reinstall Symantec
    if it is there.
    Best Regards
    Magon Liu
    TechNet Subscriber Support
    in forum. If you have any feedback on our support, please contact
    [email protected]
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

  • WPA2 Enterprise setup question

    I have been trying to complete a WPA2 Enterprise setup, and I have hit a wall in troubleshooting. The current setup has two SSIDs, but the users only use one of these SSIDs, and that one is setup as WEP (I know...I know). I have been tasked with getting the users on a stronger security setup, and I thought that the best way would be to have them use WPA2 Enterprise, and they would authenticate to the network using their Active Directory user name and password. 
    I have been trying to get the secondary SSID converted over to do this, but I am stuck. I have setup the access point (Cisco 1140) the way that I believe should work, and I have also went through the Radius server (Microsoft Server 2008 R2) and set it up with some suggestions I have ran while researching.
    I am hoping someone can see what I am doing wrong, or guide me to setup a more secure connection. My networking/Cisco skills are intermediate so there are things that I miss or could improve on at times. 
    I am attaching the config on the access point, and some screen shots off of our Radius server.
    The radius server is  10.90.9.9
    SSID that I am trying to configure is AAA
    AP IP address 10.90.6.6
    Please let me know if there is any information that I am missing. I will get it to you right away.
    Edit - One thing I didn't include was that we don't have a certificate for this. Preferably I would like to set this up without a cert, and just have them authenticate with the user/pass from AD. If a cert is needed though, I can get one. Thanks :)
    Thanks.

    Hi Brent,
    Here is a working configuration for similar requirement using ACS as RADIUS server. Hope it is useful for you to get this working.
    http://mrncciew.com/2013/11/14/autonomous-ap-with-external-radius/
    Pls do not forget to rate our responses if it is useful to you.
    HTH
    Rasika

  • WPA2 Enterprise connections don't work

    Hi everyone,
    Configuration: MacBook Pro 7,1, 2,4GHz, Mac OS X 10.6.5.
    Three user accounts (one for me, two for friend's backup), two of them have admin rights. I'm using one of these accounts.
    I'm having a strange issue with *WPA2 Enterprise*-based access points, namely, the private one on my university's campus, and the eduroam one. Eduroam is, roughly, a SSID that is available in participating institutions worldwide, and allows connection from personnel registered in any of these institutions without having to ask for a guest access.
    On eduroam, one is supposed to select the eduroam SSID in the list of network available, select "Security: WPA2 Enterprise", and type his institutional email address as a username. "Password" should remain blank for now, and in front of the "802.1X", select "Auto". On clicking the "Connect" button for the first time, a "Check certificate" dialog should appear with three buttons, "Display", "Cancel", "Continue", where one would click "Continue". Finally, a "802.1X authentication" dialog would appear, when a user would put his email address as username, and type in his institutional password to log in. Then, the user would be online without further fuss.
    On my university network, it's even simpler. One should select it, type in the IT login, then the corresponding password, before being allowed to be online.
    On my normal user account, I never get the "Check certificate" dialog for eduroam, an on the uni's network, it never seems to connect. Ultimately, I get the exclamation point over the wireless waves, meaning that the card self-assigned an IP. Then it tries to connect again (the icon is waving), then fails again. No other authentication is affected, and a quick look in the logs doesn't show anything salient.
    On the other user account, the connection to either of these SSID works as written, on the first try.
    So it's no hardware issue.
    I first tried to create a new wireless profile, and recreate the connection. It failed, once again, for both networks.
    So to the Genius Bar I went. Since it's a login issue, we deleted the ~/Library/Keychans/login.keychain item, rebooted. Since the issue couldn't be reproduced in store, he advised me to delete the "session" keychain and reboot if the problem persisted. He asked me if the computer crashed while I was logged in anywhere in the past (before 10.6.5), and yes I said, adding that I let AppleJack do the automated repair. He checked with a colleague, on a tech forum, spent 30 min with me, but came back with the dreaded conclusion that, at least in that store, they ended up doing what he named "partial restore" to correct a similar issue, in contrast to "archive and install".
    Off to the uni I went, and recreating the connection failed again. In the Access Keychain, I then removed the session keychain, with both the references and files (default is reference only), since they referred to passwords I already knew, rebooted, logged in, and tried to connect, to no avail. The other user account still works.
    What else should I try? Ironically enough, I reinstalled OS X more times in two years than I did Windows in eight, and want to avoid the time-consuming step of reinstalling applications, and the very tricky part - ownership issues - of manually importing documents and only selected settings.

    I was chasing a similar authentication issue on OS X ≥ 10.5.8 for quite some weeks. My setup does use MS 2008 Server (AD, NPS, Radius) and SonicWall SonicPoint (multi SSID on VLAN).
    When I started evaluating the different options, I didn't realize such issues But when it came to the final usage guidelines I had serious issue connecting with Mac OS X to the WPA2 Enterprise Network (BlackBerry and iOS was never an issue)!
    I finally did work out, that you can only authenticate once successfully if you use the "Ask to join networks" popup - instead I had to select the network manually from the airport, provide my credentials and select "remember this network"to store the network and it's radius profile! I guess this behavior may have something to do with the credentials stored/reused in/from the keychain for the second login.
    Also, I did notice you have to make sure you quit your system preferences each time you expect a change due to newly stored networks or radius profiles!
    Hope this may help other users to troubleshoot similar issues!

  • WPA2 enterprise, Can not authenticate with ACS

    Hi, I am setting up WPA2 enterprise for wireless users with PEAP authentication, but can not get authentication server to authenticate them, and failed reason is generic "EAP-TLS or PEAP authentication failed during SSL handshake"
    The AP I am using is 1240AG running 12.3(8)JA, Radius server is ACS 4.0, I don't have any problem to get dot1x with PEAP authentication working for wired access, and I have almost identical client side configuration for wired and wireless user.
    From ACS's point of view, it should not be aware of any difference between wired and wireless user, but ACS log shows otherwise:
    1)AP is connected to a cat4k switch, I suppose AP should be the authenticator for wireless users, but ACS "failed attempts" log for attempted wireless user shows that the NAS IP is cat4k in stead of AP, why?
    2)I am using the same laptop for both wireless/wired testing, ACS "failed attempts" log shows that for wired user, it correctly interpreted cached domain\login name, but for failed wireless user, the user-name field is totally different, yet debug on AP clearly shows that correct domain\login has been received by AP.
    Debug output on AP is attached, hope experts here can quickly identify the problem.

    Got it working by adding radius server configuration under GUI generated configuration:
    aaa group server radius your-AAA-group-name
    server your-radius-server#1-IPaddress auth-port 1645 acct-port 1646

  • IPad can't get in the internet via a WPA2 Enterprise setup

    I've seen some similar posts and no real answers. My Office just got set up with Wireless, it's cisco gear and using RADUIS to authenticate. What they told us to do on the windows boxes was this:
    Connect to the SSID
    use WPA2 Enterprise Authentication
    TKIP Encryption
    Use PEAP Authentication
    Uncheck the "Validate Server Certificate"
    Authentication Method is EAP-MSCHAP v2 on the PEAP properties screen
    Following these instructions on Windows 7 I can get on the network.
    I tried this on my iPad:
    connected to the network
    selected WPA2 Enterprise
    It Prompted my for my login/password
    I entered them....
    Then I got a certificate and it asked me to accept/install it, and I did
    Then it connects to the access point and gets a signal
    Even though I am connected and authenticated I can't get on the internet, and I get no IP address. Not a DHCP issue since other devices work.
    Any ideas on alternate configurations, or what I'd need to do with the iPhone Configuration Utility to get this working?

    "Unsupported" device - I've heard that before, too many times... =)
    So after thinking on everything you've tried, it's safe to say that your AP is running PEAPv0 with EAP-MSCHAPv2 for Authentication. This is good news - as it is probably the most widely used Enterprise WiFi configuration, iOS devices should absolutely be compatible with this. Getting a non-domain XP PC connected was a great idea, as I have discovered that Windows XP is kind of "loose" in the way it handles PEAP certificates - it will accept any certificate given to it by a RADIUS server without question. Undoubtedly a big security hole, but it does have the advantage of being "user friendly." I don't think Apple's implementation is quite as loose, so even though you are manually accepting one certificate, you probably need more to complete the chain of trust required for your device to authenticate the server. This is a requirement for PEAP to function.
    So at this point, I think your best bet would be to migrate over to the Credentials tab. If you're running the iPhone Config Utility on a PC which connects to the AP, you already have the certificates in your trusted certificate store - so simply hit the add button and add any relevant certificates. For example, if your domain is named "corporate", import any certificates bearing that domain. Once you've done this, head over to the Trust tab under WiFi and check off your newly imported certificates as being trusted for your connection.
    In addition, if you can figure out what the name of the RADIUS server on the other end of the AP is doing the authentication, add it under "Trusted Certificate Names" - if you don't know it, you can also add a wildcard like "*.corporate" to trust any servers in your domain. This shotgun approach is probably your best bet for making it go initially.
    You will know this is all working when you no longer get the dialog on your iPad to accept the certificate, and hopefully, you get an IP address.
    We're truly in the thick of it now, and this is my last idea - so if this does not work, we will need to call on those stronger than I with iOS networking... or, you can call up your IT department and start the conversation off with the words "I bet you can't figure this out" - that always gets IT people going =)
    Best of luck!
    Sources:
    http://howto.techworld.com/mobile-wireless/3451/use-peap-for-wireless-authentica tion/
    http://images.apple.com/ipad/business/pdf/iPadDeploymentScenarios.pdf

Maybe you are looking for

  • Dvd to ipod

    Is there a good (free would be better) software for watching a dvd on the ipod? I have capability to copy my dvds for back ups but haven't found a good converter to make 1 video file. If they make such a thing kurt

  • Crash on Get Info

    Finder crashes when selecting "Get Info" on any file or folder. Jun 22 23:52:04 preon [0x0-0xc50c5].com.apple.finder[2668]: dyld: lazy symbol binding failed: Symbol not found: __FSPermissionArrayCreateWithPermissionInfoWithVolume Jun 22 23:52:04 preo

  • Not working t:inputCalendar in facelets

    This is my code : ====================================================== <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"           xm

  • Podcasts created on a PC won't download to my Mac

    I'm turning to the discussions in desperation. I thought of replying to the topic "Podcasts and the dreaded exclamation point" because I have similar frustrations but this is really a new topic. My website developer, using a PC, has created a podcast

  • Lightroom 4 Basic Panel in Dev Module has disappeared!

    How do I turn on and off the Baisc Control Panel  ( color Temp, exposure, contrasts, shadow, Higlight, white, blacks, etc) ?    Somehow I have managed to turn it off, so it is not in the  Right hand side panel  under the Histogram.  Insteasd the firs