topic radius configuration on AP7522 in ExtremeWireless (WiNG)

radius configuration on AP7522

Akalzed — Thu, 04 May 2023 12:26:24 GMT

Hi.

I'm doing an intership and I'm trying to configure un radius server on a AP7522. My server is all set on a Windows server 2019. I'm trying to configure the wifi AP (AP7522) and frankly I'm lost. I've tryed every ressource I could think of (I've even asked chatGPT, it shows how desperate I am) with no success.

So, I'm open to every suggestion you may have 🙂

Re: radius configuration on AP7522

Rodrigo_Cortes — Thu, 04 May 2023 12:39:40 GMT

Hi!

only search EAP-TLS for create de NPS in windows server and put the the shared key in the AP, if remember in the site exist a parcial doc for EAP with wing.

🙂

Re: radius configuration on AP7522

Akalzed — Thu, 04 May 2023 12:45:29 GMT

I've installed and configured NPS an Windows server 2019. My problem is the Ap configuration. I've entered the share secret when I created the AAA policy but it doesn't work. I'm probably missing something.

Re: radius configuration on AP7522

fbarta — Thu, 04 May 2023 13:18:41 GMT

802.1x can be tricky, as the problem could very well lie in your client config/NPS config and not with the AP/WiNG specifically.

Within WiNG, to use an external RADIUS server for WLAN Authentication, you would want to set the SSID to authentication-type eap and tell it to use the aaa-policy you created. The AAA-policy just needs to be fed the server IP and the secret.

ex.
aaa-policy LabTest
authentication server 1 host <ipadr> secret 0 <secret>
wlan LabTestWLAN
ssid LabTest
encryption-type ccmp
authentication-type eap
use aaa-policy LabTest

At this point, the AP is configured to act as an 802.1x authenticator. The AP would then need to be set as a valid RADIUS client within NPS, having the correct secret isn't enough there. eg. Configure RADIUS Clients | Microsoft Learn

Once that's all in place, you then need to start thinking about EAP methods and your client configuration with regards to certificate validation. You could have everything from the above paragraph's setup properly, but if your client device is set to validate server certificate trust and the cert being offered by your NPS is not trusted by the client, the client will never proceed to send it's credentials to authenticate.

Re: radius configuration on AP7522

Christoph_S — Thu, 04 May 2023 14:50:32 GMT

Here are a couple of articles that may help:

https://extremeportal.force.com/ExtrArticleDetail?an=000082131

https://extremeportal.force.com/ExtrArticleDetail?an=000082477

In short:

Create aaa policy pointing to external radius and designating the AP as proxy
Map aaa policy to WLAN
Add the AP to friendly devices on your Radius server

I hope this helps,

Re: radius configuration on AP7522

Akalzed — Thu, 04 May 2023 13:32:57 GMT

Thank you for your response. Could you eaborate the last paragraph about my client not set to validate server certificate, please?

Re: radius configuration on AP7522

Akalzed — Thu, 04 May 2023 13:43:21 GMT

I meant : "set to validate server certificate trust and the cert being offered by your NPS is not trusted by the client, the client will never proceed to send it's credentials to authenticate. "

I didn't really understood that part, but your response helped a lot. 🙂

Re: radius configuration on AP7522

rmu — Thu, 04 May 2023 20:06:59 GMT

you can debug the authentication process, when you connect your client with this command:

#remote-debug wireless rf-domain <your-rf-domain> clients <client mac address>max-events 10000 duration 600 events eap radius wpa-wpa2

this will show you the handshake on the eap side (client <>ap) as well as on the radius side (ap <> nps).

if you want to see other frames you can vary the options from events. (use ? for possible options)

can you post such a debug from connecting a device?

also there should be some log messages on the nps side you can check.

rmu