Solved

NPS An Access-Request message was received from RADIUS client with a message authenticator attribute that is not valid.

Posted on 2013-02-04
6
4,700 Views
Last Modified: 2013-02-07
Hi all,

Im trying to authenticate wireless clients using EAP-TLS, ive got the access-point to send the authentication message to the RADIUS server and have captured the packets (see pic) but the radius server is throwing an error

"An Access-Request message was received from RADIUS client x.x.x.x with a message authenticator attribute that is not valid."

Ive attached screens of my polices and my wireless profile, pretty much everything i can think of, hopefully someone can point me in the right direction.

Thanks
profile.PNG
settings.PNG
settings.PNG
wire.PNG
client.PNG
Connection-Reqs.PNG
Network-Pol.PNG
0
Comment
Question by:awilderbeast
  • 3
  • 3
6 Comments
 
LVL 39

Accepted Solution

by:
footech earned 500 total points
ID: 38851662
The first thing I would check is the shared secret.  Make a new one and paste it into the config of both your NPS and NAS (WAP).
0
 
LVL 39

Expert Comment

by:footech
ID: 38851931
Also, I believe you may run into issues authenticating wireless clients with your Network Policy, specifically with the attribute Service-Type: Login.  I believe this should only be set on a policy that you are configuring to handle authentication requests to login to the RADIUS client (i.e. WAP).
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 38864603
ok ive checked the shared secrets they definitely match
Ive removed service-tye:login from the radius server, im still getting the same error though

any ideas?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 1

Author Comment

by:awilderbeast
ID: 38864668
Hold that, its working, i changed the radius key, i had a $ in the password, removed that and it works!

thanks
0
 
LVL 1

Author Closing Comment

by:awilderbeast
ID: 38864671
no $ in password was needed
0
 
LVL 39

Expert Comment

by:footech
ID: 38865117
Glad you got it working.
I've never seen that as a requirement.  I know NPS supports the $ character.  I wonder if it's a limitation of your RADIUS client.  I haven't seen any mention of it in Cisco docs.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ADFS for O365 login page 2 50
RDS2012 vs RDS2008 4 38
Good external ports and external device scanner 6 29
SBS2008 and windows updates 2 14
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question