WLAN USER AUTHENTICATION FAILURE

Hello All,
I have an enterprise WLAN which users are authenticating with the AAA server (CISCO ACS 4.2).
We recently migrated this WLAN from autonomous mode to lightweight mode by introducing a wireless LAN controller and changed the AAA server device to CISCO ISE with base license.
The challenge now is that some wireless users are connecting to this new controller based WLAN while other users are not authenticating.
Hint: On the ISE, we implemented PEAP authentication. I noticed that some of end wireless devices (Laptops) are configured for LEAP instead of PEAP. I have made these changes but the issues still persists.
Any help please.
Regards,
Ethelbert Ezeaputa

Hi
The description of your problem is vague. What are the authentication error logs on ISE? What state are clients on WLC? Could also post the debug client Mac address
Sent from Cisco Technical Support Android App

Similar Messages

Go URL - User Authentication Failure

Hi,
I am trying to use a 'Go URL' in web application and I see some issue with authentication mechanism.
I was able to login and view the dashboard whenever the username used in the 'Go URL' is from the console. But if the user who is from Active directory is used in the 'Go URL' link, then I get the login page saying 'Invalid username or password'. When I check the log file, it says ' [53012] User Authentication Failure'.
Also the AD user can login from the login page, but not thru 'Go-URL' link.
Can anyone let me know whether I am missing any step?
Thanks

969211 wrote:
I was able to login and view the dashboard whenever the username used in the 'Go URL' is from the console. But if the user who is from Active directory is used in the 'Go URL' link, then I get the login page saying 'Invalid username or password'. When I check the log file, it says ' [53012] User Authentication Failure'.
Also the AD user can login from the login page, but not thru 'Go-URL' link.
Can anyone let me know whether I am missing any step?Check the usage of Go URL first : http://docs.oracle.com/cd/E21043_01/bi.1111/e16364/apiwebintegrate.htm
If you dont user NQUser and NQPassword then they will be prompted for a password. you need to http://<hostname.domain>:9704/analytics/saw.dll?Dashboard&PortalPath=<your GO URLpath>*&NQuser=USERNAME&NQPassword=PASSWORD*
You should not access if URL without logging in.
Also on different note:
Rupesh Shelar wrote:
Make sure your BISYSTEM password
Go to weblogic console, http://IP address:7001/console
Home >Summary of Security Realms > myrealm > Users and Groups > BISystemUser
And then go to your EM (http://IP address:7001/em)
expand weblogic domain > bifoundation_domain > Security > Credentials > oracle.bi.system ? system.user
Just retype a new password then Restart BI All Services then test it.How is BISystemUser even related to Go URL .or this issue .?
Hope this helps.
Let me know the updates. Mark if it answers!
Thanks,
SVS

"Remote Apple Events" User Authentication failure

I will send some Remote Apple-Events from a local machine to a remote Mac Mini (OS X Server 10.5.4) with "eppc://admin:[email protected]". But i get the error message "User Authentication failure -927".
Mounting the remote Volume is no problem with the same user and password strings "afp://admin:[email protected]" so i think that the user and passwort is correct.
I have reset the Keychains and have no further ideas. Any hints?

Have you checked that the account you're using is allowed to send AppleEvents?
(System Preferences -> Sharing -> Remote Apple Events)
I set the access for AppleEvents for all Users on the local machine as well on the remote server. Send AppleEvents from server to the local machine seems working.
Are there special settings on OS X Server for user privileges in the "Workgroup Manager", i'm not very skilled with UID and GID?

ISE internal user authentication failure - user not found

Hi Forumers'
I trying to do wireless 802.1x, where identity store using intenral user.
But i found this error message when i trying to connect
Authentication failed :
22056 Subject not found in the applicable identity store(s)
My authrorization rules is built like this
identity groups = user identities group / " mygroup"
condition = no setting
permissions = standard / PermitAccess
Question 1
Any troubleshooting step to do on this?
Question 2
For the Authorization rules, what's the condition should set for using Internal User as Identity store?
Thanks
Noel

The error is caused to an authentication failure and is not an issue with authorization
You need to look at your authentications policy (Policy->Authentications) and see which identity store was authenticated against
In addition can do the Live Authentications page (Monitor->Authentications) and for the failing record click on the icon under details. This will give you the full details of the requets processing and you can see which rule was matched in the identity policy (Identity Policy Matched Rule) and "Selected Identity Stores".

Anyconnect 3 NAM Profile user authentication failure

Hello,
I use Cisco Anyconnect as a supplicant for my 802.1x enabled network, we use EAP-TLS. I created a wired profile with the standalone profile manager and deployed it to my clients. Machine authentication works fine, but as soon as i log in to the device the user authentication is not working and the anyconnect falls back to an open wired network.
I don't see any logs in my ACS.
But when i create a profile on the device itself the EAP-TLS authentication works without any issues.
any ideas?
regards
alex

Hello Luke-
I have faced the same issue with MAR (Machine Access Restriction) in the past. It all worked great while we had wireless authentication only but things went out of control once we started to roll out wired
I have been working with ISE for a little bit now and I can tell you that the same issue is still present. It would be pretty nice if they can "fix" this but as of right now you would face the same exact issue. So if you want to do user+machine authentication, you have a couple of options that were recently discussed in this thread:
https://supportforums.cisco.com/message/3775027#3775027
To answer your other question:
So is there a trick to get NAM to trigger machine re-authentication without having to reboot?
Back when I had this issue I was able to "trick" the native windows client to perform machine authentication again by going to "Start Menu > Shut Down > Switch User." In the new window it is important not to click on the already logged user but to select "New/Different User." There you can still type the same credentials for the already logged user. This seemed to force the machine to pass its machine credentials again without having to reboot the machine which is till not ideal and not user friendly at all but that is all I have Also, do keep in mind that I have not tested this with the AnyConnect client so results may vary.
Thank you for rating!

Mail user authentication failure

My site has been suffering from a problem with access from Macs running Mail to POP3 mailboxes hosted on Snow Leopard server mail from at least 10.6.3 upwards (including the latest build of 10.6.5). It manifests itself as the notorious failed connections with Snow Leopard Mail, but the cause appears fairly clear.
If I look at the Mail Server logs (Mail Access) I can clearly see that the connection was rejected with the error message "unable to lookup user record ". If I then look at the Password Service Server Log it is clear that this server did not receive the authentication request, as it is not present in the log even though many successful authentications both prior to and subsequent to the failed one are present.
So somewhere between the Mail Server and the Password Server some authentication requests are going astray. It is only a very occasional occurrence but it appears to be totally random in nature - authentication will carry on correctly for hours and sometimes days, but then all of a sudden an authentication request will fail and Mail trips out on the client system. Once you reset Mail things again proceed fine but it is a nuisance that this happens at all.
I would like to see Apple address this in one of two ways - either sort out why the occasional authentication request fails, or alternatively make Mail not be quite so pedantic. If a connection fails then tolerate it - this does happen occasionally, for many different reasons, and it is a big nuisance having to calm Mail down when it does. Why not just have an error window like Entourage which you can look at if you want to see when errors have occurred?
In the meantime, if anyone has any good ideas about why the authentication requests fail on occasion I would be delighted to hear. This didn't happen at all originally for many iterations of the server software until suddenly it did start occurring, so it must be possible to make it work reliably!

Unfortunately changing the access setting was not possible on my system - it is already set that way and the problem is still occurring.
In order to see this happening in the logs, using Server Admin, firstly check in the Mail Access log for the Mail server for an unsuccessful (rejected) connection by a user that can normally access without problems. Check the exact datestamp.
Then take a look at the Password Service Server Log in Open Directory at that datestamp and you will find that there is no entry, whereas there will be entries for all the successful logons. There won't be anything in the password server error log.
Taken together this suggests to me that the request from the mail server to the password server is just getting lost between the two for some reason and never reaches the password server.
It would be great to hear from others that they are also experiencing this same cause for their logon unreliability problems. As I say above, I think the problem is a combination of the fault with the two components on the server coupled with Mail's unnecessarily pedantic handling of failed logons. Both should be fixed pronto, but I would settle for Mail being cured of its ridiculously over the top panicking over something that can happen even on more reliable mail servers.

User authentication failure: BISystemUser.

Hello All,
Created an AD authentication and faced the above error. Backed out the AD and still getting the above error. in BI Server logs and the Presentation Server does not start.
Did you guys face this issue before, if so what was your resolution ?
Thanks !
Rush

Do I need to re-innstall the environment ? Changed the password for BISystemUser and changed the same in credential Store, but still the issue persists. Also refreshed the GUIDS..
Thanks

Wlan user authentication

hi there,
is that possible that with EAP PEAP MSCHAP V2 protocol integrated with MS AD
and clients do not require any setting on their computer's windows (XP,7)??????????

thanks for your reply Surendra,
but on Win 7 also it does not connet without configur profile when we use 802.1X EAP PEAP MSCHAP V 2 authentication method.
any suggestion please

Prime 2.0: User Auth Failure Count

Hello
In Prime 2.0, on the Home page> General, you can view dashlets showing various bits of information.
One of those available is User Auth Failure Count and I am trying to establish what this table is showing me and if I can get this information out of Prime in a CSV format for example, in order to do some correlation with RADIUS logs.
I want to establish whether the users being reported as having an auth failure are actually managing to get onto the network eventually, or whether we have an authentication problem we need to tackle.
The only reference in Cisco documentation I have found to date says the following, which is not helpful to me:
"User Auth Failure Count
This dashlet displays a chart which shows user authentication failure count trend over time. "
Does anyone know if this information is exportable somehow?
thanks
Bryn

Hi Scott
I agree with your point that the historical data is available via MSE, but I now come round to my first question, which is how do I get to the data from Prime?
I cannot find a report to run to get the Failed Auth User Count data, although it must be there for the information to be populating the dashlet
I think I will have to try our Cisco contact
thanks
Bryn

Cisco ISE Failure: 24408 User authentication against Active Directory failed since user has entered the wrong password

Hi,
Since we implemented Cisco ISE we receive the following failure on several Notebooks:
Authentication failed : 24408 User authentication against Active Directory failed since user has entered the wrong password
This happens 2 or 3 times per Day. So basically the authentications are working. But when the failure appears, the connection is lost for a short time.
The Clients are using PEAP(EAP-MSCHAPv2) for Authentication. We've got a Cisco Wireless Environment (WLC 5508).
Why is this happening?
Thanks,
Marc

The possible causes of this error message are:
1.] If the end user entered an incorrect username.
2.] The shared sceret between WLC and ISE is mismatched. With this we'll see continous failed authentication.
3.] As long as a PSN not receiving a response from the supplicant within this limit during an EAP conversation, it will throw this error code. In majority of cases it says eap session timed out.
In your cases, the 3rd option seems to be the most closest one.
Jatin Katyal
- Do rate helpful posts -

OAM certificate Authentication failure redirection with no user certificate

Hi,
I am using Certificate authentication. I need to do an authentication fail redirect.
When I have valid certificate in my browser - authentication is successful. This is fine.
When I have invalid certificate (credential mapping failure) it redirects me to the intended url.
The problem is when I do not have a user certificate in my web browser. It does not redirect to the url.
Anyone has a solution? any suggesstion?
Please let me know. Its an urgent requirment.
Thanks.
Himadri

Hi Himadri,
It's some time since I have tested this, but I believe that what you have discovered is unavoidable behaviour, and you will need to handle this condition somehow in the configuration of the web server. The behaviour is:
- user presents certificate that is accepted by web server, but not OAM, then the OAM authentication failure redirect takes effect ;
- user presents certificate that is not accepted by web server (or no certificate as you discovered) then the web server handles the failure without giving the WebGate the chance to intervene.
Sorry I'm not sure how to do this in the web server.
Regards,
Colin

Need help tracking WLAN USER

In my trap logs, I'm seeing this message over and over: AAA Authentication Failure for UserName:[email protected] User Type: WLAN USER
The user in question no longer works with the company. How do I track were this authentication attempt is coming from? I tried looking at the syslogs but couldn't find any information that would help.
I'm running a WLC 5508 with 7.2.103.0. Thanks.

If the client is online you can do a client debug and see what ap its asscoiated to. If its not online, you will not be able to track it without WCS/NCS.
Are you using radius for authenctation ? If so there should be some information like time and attempts in the logs ..

N80 "WLAN: WPA authentication failed"

I have a N80 at 4.0623.0.41 (26/07/2006, RM-92, Nokia N80 63.01) branded (TIM-Italy). No further firmware upgrades are available (on 12-09-2007)
I would like to connect to my 802.1x academic network that uses certificate
I installed the certificate set up its reliability.
Then, I followed the indications found in this forum for EAP-PEAP setting up
Data Bearer: Wlan
Network status: Public
Network Mode: Infrastructure
Security mode: 802.1x
Security Settings:
WPA/WPA2: EAP
EAP Plug In Settings:
1. EAP-PEAP
(other options disabled)
EAP-PEAP:
Personal Certificate: Not Defined
Authority Certificate: IC root CA
Username in use: User Defined
Username: *****
Realm in use: From certificate
Realm: [blank]
Allow PEAPv0: Yes
Allow PEAPv1: NO
Allow PEAPv2: NO
EAPs:
1:EAP-MSCHAPv2
EAP-MSCHAPv2:
Username: [entered correctly]
Prompt password: Yes
Password: [Entered correctly]
When I try to connect with these settings I get the following error message:
" WLAN: WPA authentication failed "
I tried also other unsuccessful variations such
Allow PEAPv0: Yes
Allow PEAPv1: YES
Allow PEAPv2: YES)
The system admistrators suggested that the problem could be the certificate that is home-made and maybe it is not completely recognized by Symbian v9.1. But they don’t know how to fix the problem
Indeed I found two certificates from my institution (Root and Server), apparently identical, but the Root one is recognized while the other no.
Do you know what I should check inside the certificate to gain insights about the reasons of the authentication failure?
Is there any symbian network utility that could help to understand which step block the authentication?
I will appreciate any suggestion
Thank you in advance

WPA and EAP works great with the N80 - dont worry
I have tested and runs alot og Nokia Phones with WiFi and EAP etc.
I currently uses a N80 fw 4.0707.0.7, and there are a v5 fw also.
I sugguest you get the 4.07
You subject informs about WPA but you have set your Security mode: 802.1x
Change this to:
Security mode: WPA/WPA2
Then you should be good.
Also verify the status: hidden/public this is important
If you can see the SSID in the WLAN Wiz then its public SSID.
Try clearing the username in the certificate setup/PEAP
also try different comination of DOMAIN/USERNAME, DOMAIN\USERNAME, DOMAIN@USERNAME etc
But I would think that you do not need username in the GENERAL page under EAP-PEAP
You need username under EAP page/EAP-MSCHAPv2
I assume you have the certificate installed on the handset.
HTH

AAA Authentication Failure

I just moved from a windows 2003 IAS server over to window 2008 NPS and I am getting this message on the WLC. AAA Authentication Failure for UserName:VESLABCT10_15DO\Administrator User Type: WLAN USER. this is a test user. I double checked the password both for NPS and WLC. It worked great under windows 2003 IAS. I installed certifcates services on the windows 2008 and exported the certificate and install the certificate on the client. Any suggestions

Maybe check on the NPS logs the reason of the failure ? WLC is just a forwarder in this case :-)

Intermittent AD Authentication failures in ISE 1.2

Starting today I was getting intermittent authentication failures in ISE. It would say that the user was not found in the selected identity store. The account is there though. At one point I ran a authetication test from the external identity source menu and I got a failure and then the next time a pass. I have no idea why this is happening. I just updated to ISE 1.2 the other day. I'm also seeing what looks like a high level of latency on both of my PSN's. Is this normal? Any ideas?
Thanks
Jef

Interesting. I have one location that is not having this problem at all. The other is having it somewhat frequently. The PSN's for each location are tied to the local AD servers. I have not had this until we started getting 300-380 PC's connecting. We are a school so we are slowly getting started. It's real random. One user will work then another time they won't. Happens with admin and user. I have notices that with this new version of ISE it is complaining that it is getting accounting updates from the NAS too often, but I have not looked into this because I just installed 1.2 about 3-4 days ago and haven't had time to look into it.
When you say Multicast to you AD...how did you check that? We do use multicast.

WLAN USER AUTHENTICATION FAILURE

Similar Messages

Maybe you are looking for