nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Setup 802.1x on WiFi network using Ruckus Cloud

unknown

Hi all,

I am trying to get 802.1x working on our ICX switches and on our WiFi.

All switches and APs / WiFi networks are managed in Ruckus Cloud.

I have configured a test wireless network for Enterprise AAA (802.1x), and have a RADIUS server setup (Windows 2019 with the NPS role).

When I try to connect to the WiFi network, I get prompted for my username and password, but I don't get past that, and cannot connect.

I am completely new to this; Is there any testing tool or tips that might help?

I have added all our APs as RADIUS clients in the NPS server, and have double checked the shared secret.

I have created a basic Network Policy in the NPS server; grant access to domain users, Microsoft PEAP w/ MS-CHAP-v2. Nothing special... just trying to get username/password auth to connect to the WiFi.

When trying to connect from a laptop, I get prompted for username and password, but cannot successfully auth. Pretty much same behavior if trying from a domain joined laptop or a non domain joined laptop.

Any tips are much appreciated!

Find more posts tagged with

Accepted answers

unknown

So, a little embarrassing, but it looks like stuff started working once I set the local Windows firewall on the NPS server to allow all incoming connections.

This is strange because - when installing / configuring the NPS role - the corresponding allow rules were automatically created (I had double checked that a few times while working through this process). So, maybe there is some port requirement other than UDP 1812, 1645, 1813, 1646... and TCP 135 and RPC Dynamic Ports...

Image_ images_messages_60954a4e131c1e0a9578d940_0899f232ad20d20bcc98a9aba8e70fe8_NPSfirewallrules-f23f1493-5d4b-4a05-9512-f5881d02457f-1987452671.png

Anyone run into this before?

Thanks!

All comments

unknown

Hello,

You probably already checked this document

https://docs.cloud.ruckuswireless.com/GUID-9A510A48-02AA-4A4C-AE75-9EED90BC7A4C.html

Gives a extended walkthrough on the where and why

Below video also gives a decent step by step on the Ruckus side

https://www.youtube.com/watch?v=vjecA51ySq0

As for the NPS side, I am sorry, not sure...

unknown

Yes - I am going off of that document and video as well... no joy yet though...

Thanks!

phal_nanda

What is the client troubleshooting showing, in the Analytics section? In .1x scenario, the AP acts as the authenticator/proxy and the auth flow does not travel to the cloud controller. Are the APs IPs allowed by the radius server? Cheers - Phal

unknown

Thanks - I hadn't thought of looking at the Analytics in Ruckus Cloud...

I am there now, but apparently there is an issue with Analytics.... none of the widgets are loading... getting:

"Network error: Response not successful: Received status code 500"

on all widgets.

syamantakomer

Hi Devid,

Please check and make sure auth method (EAP - PEAP) has a certificate mapped to it, else auth will not work.

Image_ images_messages_6093e95f758f933b8d563564_f45113afe0a5c774c7dcf67567adc461_cap2-efc6a7bf-5850-4b0e-8a00-d96003c55ae7-112802341.png

If still facing issue, check event viewer >> Customer Views >> Server Roles >> Network Policy And Access Service >> Review the most recent authentication attempt. It will give you more info like if request is even reaching the server and hitting the correct policy, and what is the reason for auth failure, etc.

Image_ images_messages_6093e95f758f933b8d563564_52c5db891cd199f34e84b856f4ed8e34_cao1-cb2da4ed-7174-4d0c-bcbe-15c951dcc126-142386789.PNG

To see the complete picture, we need to review and collect information from below points.

Radius policy should be configured correctly with a certificate in auth method.
Radius server profile on Cloud should be configured correctly.
Make sure shared secrete is same on both sides, on Cloud and on Radius server.
Make sure AP IPs are added to radius client list on Radius Server.

For troubelshooting:

Setup packet capture on the AP where test client is connecting.
- Select AP on cloud GUI >> Click on More Action >> Test Connection >> Packet Capture >> Set "Capture Interface" to "Wired" and start capture when client is ready to connect.
Setup and run wireshark on NPS server, and set the filter for AP IP address to filter the traffic coming from radius server.
Now connect the client and try 2-3 times so that you have more captures for review.
Post 2-3 failure, stop captures on AP and on radius server side.
Save captures from AP, radius server and review all to see the connection flow.
- AP capture
- Server capture
- Server event logs.

Parallelly, if Cloud Analytics is working, it can also show you complete client connection flow and can pin point the failure.

If still facing issue, open a case with support for further help.

unknown

Thanks for the detailed reply;

Regarding the first part - yes - there is a certificate mapped for PEAP

Image_ images_messages_6093fe85758f933b8d56363c_bb6e7888440e2c6ef7ba962c73dfc46c_npsconfig-da719bed-881a-4faa-b2b6-d07100c4763c-297787602.png

When looking at the NPS Event Log, I only see some logs from when I was initially trying to add the APs (had initially deployed windows server standard, and was trying to add APs using cidr... had to upgrade edition to Datacenter to do that )

I don't see any authentication attempts in the NPS event log at all.

As for making sure the RADIUS server is configured correctly in the Cloud, there is nothing else aside from defining it in the WiFi network setup, correct?

Image_ images_messages_6093fe85758f933b8d56363c_04b397621ff65ca6cdafa6f525a90109_WiFitest802.1x-edef2811-ec15-4dea-9cf5-8d46a139b8e5-760113917.png

Shared secret is the same, and all AP IP addresses have been added. Again, added using cidr, but maybe I will try adding individually see if that makes a difference.

I was looking around in Analytics, but I don't see any reference to the failed connection / auth attempts from my laptop and another test laptop I have. So, not sure if I am not looking where I should be.

I will look at doing a packet trace also.

Thanks,

syamantakomer

If you are not seeing any logs in event viewer, check the connectivity between AP to radius server.

For server config on Cloud, it is only available under WLAN settings.

On Analytics, you will see a search box on top, just put the failing client MAC address and search for it.

syamantakomer

Hi David,

If you can please open a support case and confirm the case number, we will be happy to assist you.

Could you please enable support on your Cloud account.

unknown

So, a little embarrassing, but it looks like stuff started working once I set the local Windows firewall on the NPS server to allow all incoming connections.

Anyone run into this before?

Thanks!

syamantakomer

Hi David,

Good to know that its working now!

I have not seen similar issue, may be windows server experts can give more insights on this.

For Cloud Analytics, are you still getting error? If yes, could you please try to create a new test venue and see if error goes away on Analytics?

unknown

Analytics is working - and finding client info helped - I was able to see my test laptop connect and try to do PEAP, and that the RADIUS server was not responding.

However it seems that there is some delay in when data is visible in analytics... is this normal? 12-24 hours?

Thanks,

syamantakomer

Hi David,

I am glad to know that both the issues has been fixed!

Yes, on a new account, there could be some delay but not 12-24 hrs.

Wait for some time as Analytics seems started getting data recently (you were getting error yesterday on GUI and that was mostly because connection profile was not created correctly).