topic Re: NAC / XMC as Radius - not passing 802.1x authentication in ExtremeWireless (Identifi)

NAC / XMC as Radius - not passing 802.1x authentication

PGCourtois — Fri, 26 Feb 2021 05:26:05 GMT

Hi Team,

I have Extreme Management Center (XMC), Extreme NAC and Extreme Wireless (V2110) configured in my environment. XMC is acting as a Radius and it is successfully authenticating users. My issue is with configuring 802.1x (PEAP) authentication on an SSID. I configure 802.1x and set the Radius server options. When I test the Authentication server within the wireless controller I get the following error:

Not sure where to go from here. Thanks. - Paul

Re: NAC / XMC as Radius - not passing 802.1x authentication

Miguel-Angel_RO — Fri, 26 Feb 2021 05:30:04 GMT

Hi PG,

Go to the NAC/Access Control/Engine Groups/[Group Name]/End-Systems.

Locate the failing authentication and right click on it to execute the Configuration evaluation tool.

If it is not clear, please share the result for comments.

Mig

Re: NAC / XMC as Radius - not passing 802.1x authentication

LeoP1 — Fri, 26 Feb 2021 05:31:08 GMT

Hello,

AFAIK (or remember) the RADIUS test for 802.1x on V2110 always returns ACCESS DENIED…

I think you should test connecting a real device.

Best regards,

-Leo

Re: NAC / XMC as Radius - not passing 802.1x authentication

StephanH — Fri, 26 Feb 2021 05:47:21 GMT

Hello,

for the test here "Access Rejected" is good.

The test button in the WLAN Service is only for a communication test to Radius and not authenticate a user. There are no credentials passed to radius only a test user name therefore the Radius can’t authenticate your user.

=> After your test you know the communication between Controller and Radius is working.

Normally you should see a authentication session in “End Systems” on XMC->Control if you try to connect an client to the SSID you are using with PEAP.

Re: NAC / XMC as Radius - not passing 802.1x authentication

StephanH — Fri, 26 Feb 2021 05:50:02 GMT

Oh,

I see I am a little late. If you see the client in End Systems as I mentioned you can go futher with the steps Mig described.

Re: NAC / XMC as Radius - not passing 802.1x authentication

Miguel-Angel_RO — Fri, 26 Feb 2021 05:52:24 GMT

And as mentioned by @Leo1 and @StephanH a reject on a 802.1x SSID is normal.

Here from the doc:

Mig

Re: NAC / XMC as Radius - not passing 802.1x authentication

PGCourtois — Fri, 26 Feb 2021 06:23:10 GMT

Thanks to everyone for the input. I see no authentications in the “End-Systems”. I have a system that I try to access the 802.1x configured SSID. It prompts me for a password or “Connect using a certificate”. Windows auth doesn’t pass me through and I don’t have a Cert configured. Also, the AP’s have a PEAP configuration. Do I configure both the SSID and AP?

*Note: I am a wireless newby. My terminology/verbiage may not be correct. I appreciate your patience with me on this.

Re: NAC / XMC as Radius - not passing 802.1x authentication

StephanH — Fri, 26 Feb 2021 13:59:04 GMT

Hello,

here are some guides. I hope these help you for a better understanding:

https://www.securew2.com/blog/eap-tls-vs-peap-mschapv2-which-authentication-protocol-is-superior#:~:text=With%20PEAP%2DMSCHAPv2%2C%20the%20user,TLS%20utilizes%20certificate%2Dbased%20authentication.

https://www.uwsp.edu/infotech/Pages/Tutorials/Wireless/Windows-10-Wireless-Setup.aspx#:~:text=Click%20the%20Change%20connection%20settings,(PEAP)%20and%20choose%20Settings.&text=Uncheck%20the%20Automatically%20use%20my,)%20box%2C%20and%20click%20OK.

https://extremeportal.force.com/ExtrArticleDetail?an=000093300

https://extremeportal.force.com/ExtrArticleDetail?an=000061949&q=peap%20nac

Re: NAC / XMC as Radius - not passing 802.1x authentication

PGCourtois — Sat, 27 Feb 2021 01:50:50 GMT

@StephanH - Thank you for the input. I’ll go over the guides and update as I progress. I also have a case in with Extreme Support. I will provide a solution once reached.