topic Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer. in Aerohive Migrated Content

I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Fri, 29 Nov 2019 04:57:48 GMT

We currently have 10 schools in our division that each have their own file/DHCP Server with miltiple AP's. We are using the same two SSID's (one for Staff with network resources available and one for Student with internet access only) across all locations so any staff member from any location will be able to connect to the wireless network anywhere within our organization. Currently, we are using WPA/WPA2 PSK (Personal) with a passphrase that has been shared with students or students have been able to get it from their teachers device. Regardless, we are now considering setting up a Radius Server, and I am looking for some basic info to justify selling this to my boss, but I am also in need of some guidance as to how this can be set up and deployed across multiple locations. Will I need to configure an AP to act as a Radius Server at each location (subnet)? or will I hav e to maybe configure multiple AP's to act as Radius Servers at each location if there is a chance of say 300 + connected devices at any time? Where is a good place to start with this project? We currently have just over 100 AeroHive AP's.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Sat, 30 Nov 2019 01:58:13 GMT

You'll need one AP acting as a Radius server per subnet. All the APs on the same subnet will reach out to that AP with the Radius requests, so picking a newer model AP that doesn't have as much client traffic to pass in addition to processing the Radius requests would be good. You only need one Radius server per VLAN, it should be able to host 300+ clients without issue.

This guide reviews how to set up a Radius server in ExtremeCloud IQ (formerly HiveManager NG): https://thehivecommunity.aerohive.com/s/article/Radius-SSID-in-NG

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Fri, 06 Dec 2019 03:46:46 GMT

Thank you for the reply. Very much appreciated. I am just left a little confused now. I am trying to figure out which version of HiveManager I have. I am currently using the cloud based HiveManager Version 8.2r2e. Would the instructions you linked to above referencing HiveManager NG be the same step by step procedures for the version of HiveManager I am using?

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Fri, 06 Dec 2019 03:51:42 GMT

My apologies, you're using HiveManager Classic. This guide reviews how to set up Radius on an AP in Classic: https://thehivecommunity.aerohive.com/s/article/Radius-Server-hosted-on-an-AP

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Fri, 06 Dec 2019 04:15:27 GMT

Thank you very much. Hoping to have a test site up and running for the Christmas Break.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Fri, 03 Jan 2020 22:42:30 GMT

Well, today is my big roll out day. But I have one more question. In regards to the Radius Clients/NAS settings.............................. Is this supposed to be the list of AP's in the building that will be able to contact the AP acting as the Radius Server for authentication? I am just a little confused.

I appreciate any further assistance you can provide.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Fri, 03 Jan 2020 23:47:16 GMT

The NAS list is a list of APs that can contact the Radius AP with authentication requests. By default, all Aerohive APs are on the NAS list, so you wouldn't need to configure that part unless you have non-Aerohive devices requesting Radius access on behalf of client devices as well.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 02:16:52 GMT

Hi again. I seem to be having some authentication issues with my Radius Server. The open guest SSID using policy acceptance and CWP seem to be working as expected. However, I am not able to connect to the staff SSID using AD Authentication. The Radius AP I have designated does have the Radius symbol next to the Host Name under the Monitor Tab. I believe all the AD Binding Configuration settings are correct, including the AD Server and DNS. But I do not know where to start to try and solve this problem. Can you please provide some assistance as to where I should be looking to correct this?

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 02:28:09 GMT

When attempting to connect to the staff SSID, it does prompt me to enter domain credentials. however, it does not seem to want to accept the credentials and denies connection.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Sat, 04 Jan 2020 02:39:49 GMT

Could you let me know your VHM ID so I can take a look at your configuration to see if any issues jump out to me? If you'd rather share this directly, my email address is communityhelp@aerohive.com.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 02:41:56 GMT

VHM-W8S1ZP

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Sat, 04 Jan 2020 02:42:48 GMT

Thank you for that VHM ID. Which Network Policy should I take a look at?

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 02:44:44 GMT

SFXRadius

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Sat, 04 Jan 2020 02:52:07 GMT

Thank you for letting me know. The configuration looks good so far. Do you have access to the Radius server? If you do, can you tell if any authentication rejection or error messages are showing in the Radius server? Also, would you be able to run a Radius test by going to Tools> Server Access Tests> Radius Test and let me know what the results are?

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 02:59:13 GMT

How do I tell if there is any authentication rejection or error messages? Do I need physical access to the AP/Radius Server?

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Sat, 04 Jan 2020 03:00:51 GMT

Sorry, I meant your external user database, the Active Directory server we're using to host the usernames and passwords. There should be a log in the Active Directory that would display rejection messages or error messages.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 03:04:12 GMT

Thanks. I will check on this shortly and get back to you.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 04:21:25 GMT

Correction..... There are no indications of any errors regarding authentication in the logs of the AD Server that I used to bind the Radius Server to.

When I attempt to run the Radius Test, the results tell me that the server connection timed out. I then ran an AD Test to "Test Aerohive device credentials for Active Directory integration". This test also fails and tells me NT_STATUS_NO_SUCH_USER: No such user (0xc0000064). Then I ran the test to "Test joining the Aerohive device to an Active Directory domain" using my domain admin credentials, which are the same credentials I used to bind the Radius Server to the AD with. This test comes back and says (NT_STATUS_OK)HiveAP SFX-GYM successfully joined the Active Directory domain p****b.ca.

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

samantha_lynn — Sat, 04 Jan 2020 05:23:22 GMT

Thank you for checking those logs for me and for keeping me updated on your other testing. I'd like to see if a client monitor gives us any clues, would you be able to run a client monitor and attempt to connect to the Radius SSID again? If you just let me know when that's finished, I can check the results in your VHM from my side. This guide reviews how to set up and run a client monitor in Classic- https://thehivecommunity.aerohive.com/s/article/Client-Monitor

Re: I am interested in possibly setting up a radius server. however, I am still fairly new to this and I will offer what I hope is the relevant info to get an informed answer.

AnonymousM — Sat, 04 Jan 2020 05:32:49 GMT

I have started the monitor on the Radius Server/AP, attempted a few connection attempts, then I stopped the test. Please let me know if there is anything else I can do on my end.