There is no RADSEC proxy enabled for the network, though port 2083 test is successful. Is there anything else need to be allowed from Firewall or in hivemanager for PPSK to work?

[akshara_agarwal]

There is no RADSEC proxy enabled for the network, though port 2083 test is successful. Is there anything else need to be allowed from Firewall or in hivemanager for PPSK to work?

[akshara_agarwal]

2019-09-10 14:45:46 info  ah_cli: security: admin:<exec aaa idm-test radsec-proxy >

2019-09-10 14:44:32 info  ah_cli: security: admin:<exec aaa idm-test radsec-proxy >

2019-09-10 14:44:25 info  ah_cli: security: admin:<exec aaa idm-test radsec-proxy >

2019-09-10 14:43:18 info  sshd[31258]: aaa: ah_tpa_radc_conf_fetch: fetch the config for IDM_GLOBAL failed

2019-09-04 14:35:09 err   ah_capture: application: [IDM-PPSK] Fetch PPSK password from IDM failed, error code = -11

2019-09-04 14:35:09 err   ah_capture: application: [IDM-PPSK] Fetch PPSK password from IDM failed, error code = -11

[akshara_agarwal]

Hi, Customer tried rebooting AP several times, reset AP, different FW, still the same. current version is HiveOS 8.2r4 build-207023

[ashley_finch]

All looks normal except from the show idm which shows the IDM proxy IP as itself but the proxy status is disabled. If you push a complete upload or reboot the AP does it change at all? Which firmware version are you on?

[akshara_agarwal]

show clock

2019-09-10 14:45:33 Tuesday

P-1-01#exec aaa idm-test rad

AP-1-01#exec aaa idm-test radsec-proxy 

The Aerohive device establish a TCP session with the ID Manager auth gateway successfully.

AP-1-01#

AP-1-01#_show radsec elct-pool

DA IP address: 10.1.199.107

MGT0 IP address: 10.1.199.105

current device is DA: No

Radsec proxy function is running: No

Auto-election pool is valid: No

P-1-01#show idm

IDM client: Enabled Per SSID

IDM Proxy IP: 10.1.199.105

IDM proxy: Disabled

RadSec Certificate state: Valid

RadSec Certificate Issued: 2019-09-09 15:48:44 GMT

RadSec Certificate Expires: 2020-09-08 15:48:44 GMT

any suggestions please ??

[ashley_finch]

exec aaa idm-test radsec-proxy would probably be the best command to use to verify if it can reach the service.

What is the output from 'show idm' and '_Show radsec elct-pool'

Additionally if you do a "show clock" command, is the time on the AP correct?