Hi,
This one is probably simple, but just can’t see it.
Have configured an internal captive portal on the EWC with the following authentication settings:
Whenever I try to use the ‘Test’ function with an AD account I know is valid, I get the below:
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 PASSED: The Authentication Type of: "MsCHAP" passes the any criteria evaluation.
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 PASSED: The Device Type of: "MAC Address: 00-00-00-00-00-00, IP Address: null, Host Name: null" passes the any criteria evaluation.
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 retrieveLdapAttrsFromServer, searching for: mflammia
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 Unable to retrieve LDAP attributes because one or more of the following attributes are null:
LDAP config: is *null*
User Name: is not empty
LDAP Attribute Names: is not empty
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 forward to parent evaluate for passes
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 No attribute list to evaluate against.
2020-04-06 23:07:46,910 DEBUG [NacEndSystemAccessRequest] ESDMAC:00-00-00 FAILED: The User: mflammia does not have LDAP attributes:
that match the ones defined in LDAP User Group: AD_Users:
It seems to be failing evaluating the username against the LDAP user group ‘AD_Users’. If I evaluate that same username against the same user group in NAC it passes fine:
The version of EWC is: 10.51.10.0006
The version of NAC is: 8.1.3.65
I think the issue could be related to the authentication type / method not passing the credentials as it is expecting it, but not sure where I could be going wrong in the configuration?
Many thanks in advance.
1 ACCEPTED SOLUTION
Managed to work this out.
I incorrectly set the AAA authentication rule with an authentication type of 802.1x, the answer was showing in the logs above where it needed to set to MsChap, see below where I added eh MsChap rule:
After this it then worked.
Managed to work this out.
I incorrectly set the AAA authentication rule with an authentication type of 802.1x, the answer was showing in the logs above where it needed to set to MsChap, see below where I added eh MsChap rule:
After this it then worked.
