Test wlan that will uses eap ms-chapv2 self-controller to authenticate

[Phil_storey]

I have created on onboard Radius and role based firewall, ( sort of )
so this is what I have done so far,

from the CLI
#conf
# radius-server-policy RADIUS
# commit write
#radius-group Guest
#guest
#..
radius-group Corp
#..
radius-user-pool CORP-USER
User UKROI password #976301234 group corp
#commit write
#profile rfs7000 default-rfs7000
#use radius-server--policy RADIUS
#commit write

# role-policy RBFW
#user-role Guest precedence 1
#assign vlan 999
#ssid contains Guest
#..
#user-role Corp precedence 2
#assign vlan 1000
#group exact Corp
#commit write
#aaa-policy INTERNAL-AAA
#authentication server 1 onboard-controller
I have created a wlan and assigned the aaa-policy INTERNAL_AAA

then in the ap profile under settings I have added the RBFW in the wireless client role policy

The problem I have
I only have two prodution vlan's so I can not put the AAA server to these, but I need to get to a server on the main VLAN

I can see the Dot1x wlan that is part of the test, If I use my mobile phone and try to connect it prompts for a usernsme and a password as it should, I then put thses details is
select the ms-chapv2, then you have an option about certificate he I select none
then under the username it show anonymous
then drop to password enter this
then it shows connecting then gives up.
Now I think its due to the fact that Vlan 999 & 1000 do not have any dhcp server to give the device and IP

So can I setup a dhcp server on the RFS7k ( wing 5.8.5 ) that will only dish out addresses on the dot1x wlan ? then route off to our main vlan to attach to atest server

Lot of information and questions - but any help appreciated

[Andrew_Webster]

Phil,

It appears as if you've set the aaa-policy to use onboard controller or onboard centralized-controller, but perhaps the controller isn't "using" the radius server policy hence the timeouts.
Perhaps debug the controller side to see what its doing with the radius requests.

Can you post a show running-config...

[Phil_storey]

This is the DEBUG

[ap7532-82BCF4-eap] 08:47:11.27: mgmt:rx auth-req from 20-14-B0-7E-22-11 on radio 0 (mgmt.c:3872)
[ap7532-82BCF4-eap] 08:47:11.27: mgmt:tx auth-rsp to 20-14-B0-7E-22-11 on radio 0. status: success (mgmt.c:1302)
[ap7532-82BCF4-eap] 08:47:11.31: mgmt:rx association-req from 20-14-B0-7E-22-11 on radio ap7532-82BCF4-eap:R1 signal-strength is -45dBm (mgmt.c:38
[ap7532-82BCF4-eap] 08:47:11.31: client:MU 20-14-B0-7E-22-11 panBU enab_cap=00 00 00 00, supp_cap=00 00 00 00 (mgmt.c:3112)
[ap7532-82BCF4-eap] 08:47:11.31: client:using cached vlan 1 for wireless client 20-14-B0-7E-22-11 (mgmt.c:3347)
[ap7532-82BCF4-eap] 08:47:11.31: mgmt:Client 20-14-B0-7E-22-11 negotiated WPA2-EAP on wlan (Group-1-DOT1X) (mgmt.c:3412)
[ap7532-82BCF4-eap] 08:47:11.31: mgmt:tx association-rsp success to 20-14-B0-7E-22-11 on wlan (Group-1-DOT1X) (ssid:RKOI) with ftie 0 (mgmt.c:3467
[ap7532-82BCF4-eap] 08:47:11.31: client:no pmkid from client 20-14-B0-7E-22-11 (mgmt.c:1197)
[ap7532-82BCF4-eap] 08:47:11.31: client:state MU_STATE_DOT1X for client 20-14-B0-7E-22-11 (mgmt.c:1206)
[ap7532-82BCF4-eap] 08:47:11.31: client:wireless client 20-14-B0-7E-22-11 changing state from [Roaming] to [802.1x/EAP Auth] (mgmt.c:622)
[ap7532-82BCF4-eap] 08:47:11.31: eap:sending eap-code-request code 1, type 1 to 20-14-B0-7E-22-11 (eap.c:963)
[ap7532-82BCF4-eap] 08:47:11.31: eap:sending eap-id-req to 20-14-B0-7E-22-11 (eap.c:990)
[ap7532-82BCF4-eap] 08:47:11.31: client:transmitting roam notification for 20-14-B0-7E-22-11 (mgmt.c:345)
[ap7532-82BCF4-eap] 08:47:11.32: client:os-info in credcache for 20-14-B0-7E-22-11 (OS:Unknown/Browser:Unknown/Type:Unknown) (credcache.c:915)
[ap7532-82BCF4-eap] 08:47:11.32: client:user-info in credcache for 20-14-B0-7E-22-11 (loyalty_app:0) (credcache.c:956)
[ap7532-82BCF4-eap] 08:47:11.39: eap:rx eap id-response from 20-14-B0-7E-22-11 (eap.c:696)
[ap7532-82BCF4-eap] 08:47:11.39: radius:aaa-policy INTERNAL-AAA user: DT-355856050632419 mac: 20-14-B0-7E-22-11 server_is_candidate: 1 0 0 0 0 0 (
[ap7532-82BCF4-eap] 08:47:11.40: radius:access-req sent to wireless controller to be proxied to 127.0.0.1:1812. (attempt 1) for 20-14-B0-7E-22-11
[ap7532-82BCF4-eap] 08:47:14.54: radius:access-req sent to wireless controller to be proxied to 127.0.0.1:1812. (attempt 2) for 20-14-B0-7E-22-11
[ap7532-82BCF4-eap] 08:47:17.75: radius:access-req sent to wireless controller to be proxied to 127.0.0.1:1812. (attempt 3) for 20-14-B0-7E-22-11
[ap7532-82BCF4-eap] 08:47:20.94: eap:sending eap-failure to 20-14-B0-7E-22-11 (eap.c:1006)
[ap7532-82BCF4-eap] %%%%>08:47:20.94: radius:no response from radius server INTERNAL-AAA:1 for wireless client 20-14-B0-7E-22-11 (eap.c:373)
[ap7532-82BCF4-eap] %%%%>08:47:20.94: radius:alarm num_eap_s_tout ++ 1 (eap.c:394)
[ap7532-82BCF4-eap] 08:47:20.94: mgmt:tx deauthentication [reason: radius server timeout (code:23)] to 20-14-B0-7E-22-11 (mgmt.c:1836)

Hope this means somthing to someone

[Phil_storey]

I have been looking at the event history on the AP that I'm trying to connect too
in the message i get
Client "20-14-B0-7E-22-11" disassociated from wlan "Group-1-DOT1X2 Radio "ap7532-82BCF4-eap"R1" authentication rejected by radius server timeout (reason code:23 )
the device associates then fails on the timeout authenticating.

If anyone has a simplified guide to setting this this up, I would be very greatful, stating from scratch for just one user to test that eap works and that it can connect to the test server on vlan 1
thanks

[Phil_storey]

Could someone offer advice to get this working ?

[Phil_storey]

Hi
This has raised its head again, I have gone through my notes and a guide from a student lab ( although this refers to the VX900 controller ) I'm using the RFS7k with wing 5.8.5. In the guide I have it "Onboard Radius & Role Based Firewall "
anyway when I try and connect I get a radius timeout

I have missed somthing but not sure what ?
any advise / help please