Solved

NPS An Access-Request message was received from RADIUS client with a message authenticator attribute that is not valid.

Posted on 2013-02-04
6
4,874 Views
Last Modified: 2013-02-07
Hi all,

Im trying to authenticate wireless clients using EAP-TLS, ive got the access-point to send the authentication message to the RADIUS server and have captured the packets (see pic) but the radius server is throwing an error

"An Access-Request message was received from RADIUS client x.x.x.x with a message authenticator attribute that is not valid."

Ive attached screens of my polices and my wireless profile, pretty much everything i can think of, hopefully someone can point me in the right direction.

Thanks
profile.PNG
settings.PNG
settings.PNG
wire.PNG
client.PNG
Connection-Reqs.PNG
Network-Pol.PNG
0
Comment
Question by:awilderbeast
  • 3
  • 3
6 Comments
 
LVL 40

Accepted Solution

by:
footech earned 500 total points
ID: 38851662
The first thing I would check is the shared secret.  Make a new one and paste it into the config of both your NPS and NAS (WAP).
0
 
LVL 40

Expert Comment

by:footech
ID: 38851931
Also, I believe you may run into issues authenticating wireless clients with your Network Policy, specifically with the attribute Service-Type: Login.  I believe this should only be set on a policy that you are configuring to handle authentication requests to login to the RADIUS client (i.e. WAP).
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 38864603
ok ive checked the shared secrets they definitely match
Ive removed service-tye:login from the radius server, im still getting the same error though

any ideas?
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 1

Author Comment

by:awilderbeast
ID: 38864668
Hold that, its working, i changed the radius key, i had a $ in the password, removed that and it works!

thanks
0
 
LVL 1

Author Closing Comment

by:awilderbeast
ID: 38864671
no $ in password was needed
0
 
LVL 40

Expert Comment

by:footech
ID: 38865117
Glad you got it working.
I've never seen that as a requirement.  I know NPS supports the $ character.  I wonder if it's a limitation of your RADIUS client.  I haven't seen any mention of it in Cisco docs.
0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

A procedure for exporting installed hotfix details of remote computers using powershell
There are many Password Managers (PM) out there to choose from. PM's can help with your password habits and routines, but they should not be a crutch you rely on too heavily. I also have an article for company/enterprise PM's.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question