topic Re: Monitoring authentication events in ExtremeCloud IQ

Monitoring authentication events

HHRINetwork — Wed, 03 Mar 2021 03:15:08 GMT

AP650s, using ExtremeCloud IQ. I have MAC authentication on one SSID, using one of the AP650s as RADIUS. One iPhone user is having trouble connecting, even though I’ve entered her MAC address in the user base and she says she’s entering the password correctly (there’s a pre-shared key so that the SSID isn’t open, and then MAC authentication takes over).

So, it should work, but isn’t, and I want to look at authentication logs to see if I can find errors relating to that MAC address - something like “xx:xx:xx:xx:xx:xx tried to authenticate and failed.” But, I don’t see anything like that in the logs that I can see (at Manage/Events and Manage/Tools). Am I looking in the wrong place?

Re: Monitoring authentication events

SamPirok — Wed, 03 Mar 2021 03:18:17 GMT

I’d recommend setting up a client monitor for that device so you can start collecting the authentication logs. The client monitor should tell us what step of the authentication process is failing, which will tell us where to troubleshoot. This guide reviews how to set up a client monitor in ExtremeCloud IQ: https://extremeportal.force.com/ExtrArticleDetail?an=000056843&q

If you’d like help reading the results, please feel free to email an export of the client monitor to me at community@extremenetworks.com so I can take a look for you.

Re: Monitoring authentication events

dpanev — Wed, 03 Mar 2021 03:24:39 GMT

Click on the AP and on the left you can see under monitor “event”.

Re: Monitoring authentication events

HHRINetwork — Wed, 03 Mar 2021 03:48:04 GMT

Thanks for the quick replies. So, I set up a client monitor for her MAC address on the one AP that she would connect to. Told her to connect, she tried and it failed - but the monitor picked up nothing at all.

I’m working from home, so not looking over her shoulder, so I can’t guarantee she’s doing what she says she is. But she’s generally a smart user. But that sure sounds like she’s not even trying to connect to the right AP, right?

Re: Monitoring authentication events

SamPirok — Wed, 03 Mar 2021 03:50:18 GMT

That’s what it sounds like to me too. Are there any near by APs she could be roaming to that we could try to see with a client monitor? Also, does she have any other devices she can try to connect with to see if it’s an issue isolated to one device or not?

Re: Monitoring authentication events

HHRINetwork — Wed, 03 Mar 2021 04:24:52 GMT

Only one AP on her floor, no other devices handy, but I had her connect to the guest network and found that her iPhone reported a different MAC address.

Of course, once I put that into the user base, it still failed. Kind of stuck now, but when I’m in the office later this week I’ll try again.

Re: Monitoring authentication events

HHRINetwork — Wed, 03 Mar 2021 04:55:13 GMT

Figured it out! It’s Apple #&$^&%^ Private MAC address. See https://support.apple.com/en-us/HT211227 for details. By default, the iPhone sends a fake MAC to each AP it connects to, so doing MAC authentication by the real one won’t work. You can turn it off per SSID. Once we did that, she connected.