Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 366
  • Last Modified:

Cisco Wirless 561 RAdius athentication on 2012 server

I have 5 Cisco Wireless 561 AP's ( Small business ) . The can form a cluster without a controller.  I would like my users to authenticate using their Active directory credentials. I followed some online instructions in seating up NPS ,but I still can't connect to wifi using AD credentials. On the cisco AP, there is no way of testing authentication and in the 2012 server, I don't see any logs in event viewer on anything failing.  I am not sure if I need a certificate server on runing on my 2012 server on not. Thank you for your help.
0
netcomp
Asked:
netcomp
  • 4
  • 3
1 Solution
 
Craig BeckCommented:
Check the custom logs in the event viewer on the server.

If you still can't see anything check...

1] The APs are configured to send RADIUS to the correct IP.

2] The shared secret is correct.

3] The firewall on the server is allowing RADIUS (TCP/UDP 1812 and 1813).
0
 
netcompAuthor Commented:
Great. Under the custom logs I am no seeing the following error. On the cisco I have the following options: WPA, WPA2, Enable pre-authentication , Cipher Suites:        TKIP       CCMP (AES) .   What is NOT check is  WPA2 and Pre-authentication . The rest are checked.  When I uncheck WPA and check WPA2, it tells me unable to join network, but when I have WPA checked and WPA unchecked, I get a loin error. ( on the mobile device or computer)



The client could not be authenticated  because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          1/13/2015 3:32:05 PM
Event ID:      6273
Task Category: Network Policy Server
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      GERDC.Gelect.local
Description:
Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:
      Security ID:                  GELECT\testtest
      Account Name:                  Gelect\testtest
      Account Domain:                  GELECT
      Fully Qualified Account Name:      GELECT\testtest

Client Machine:
      Security ID:                  NULL SID
      Account Name:                  -
      Fully Qualified Account Name:      -
      OS-Version:                  -
      Called Station Identifier:            18-9C-5D-3C-B6-C1:GERRD
      Calling Station Identifier:            78-FD-94-0C-8B-6E

NAS:
      NAS IPv4 Address:            192.168.13.50
      NAS IPv6 Address:            -
      NAS Identifier:                  -
      NAS Port-Type:                  Wireless - IEEE 802.11
      NAS Port:                  0

RADIUS Client:
      Client Friendly Name:            WPA561B
      Client IP Address:                  192.168.13.50

Authentication Details:
      Connection Request Policy Name:      Secure Wirless WAP561
      Network Policy Name:            Secure Wirless WAP561
      Authentication Provider:            Windows
      Authentication Server:            GERDC.Gelect.local
      Authentication Type:            EAP
      EAP Type:                  -
      Account Session Identifier:            -
      Logging Results:                  Accounting information was written to the local log file.
      Reason Code:                  22
      Reason:                        The client could not be authenticated  because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.
0
 
Craig BeckCommented:
OK have you got a certificate on your server?  If not you can't process EAP-style logins.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
netcompAuthor Commented:
No , I don't have a certificate on my server. How could I get on on their. Do I have to buy one from Godaddy or can it be installed on the server using the Certificate authority program? Any help with configuring the certificate would be helpful.  
One another note, management would like to know who is connecting to wifi and from what device. Is there any way to accomplished that via NPS or on the Cisco AP? Thank you,
0
 
Craig BeckCommented:
If you have your own Certificate Authority running on your domain you can issue a cert to your NPS server (it's just a computer certificate).  That will let the NPS process EAP-style logins.  If you don't have a CA on your domain you can install a self-signed certificate on the NPS, or you can purchase a 3rd-party cert, but that will only let you use PEAP-MSChapV2, not EAP-TLS (so no computer authentication via certificate - just AD user logins).

Here's a great link to help you get things going...

http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/115988-nps-wlc-config-000.html

There's a bit about Wireless LAN Controllers, but you can ignore that.

With what you've got now you 'can' pull some useful info from the logs about who is logging in to the network, but not from what device.  For that you'd need something that profiles devices upon connection, or a proper MDM solution.
0
 
netcompAuthor Commented:
I am not sure what is the difference between certificate login ( EAP-TLS) and PeA-MSchapv2. I assume that authenticates users based on the account that is already logged into their PC. I actually want the users to enter their username and password because I would even use this on their mobile devices ( iphone/Ipad).   Do I still need to install the cert authority.
0
 
Craig BeckCommented:
No you can use self-signed or 3rd-party cert on NPS then.

EAP-TLS is where the computer itself authenticates using a certificate from your own CA.  This is a good idea if you want computer GPOs to apply to a machine before the user logs in.

PEAP-MSChapV2 is the user/pass type where the computer doesn't get a network connection until the user logs in.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now