nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

RADIUS not working with new vSZ 5.2???

unknown

I currently have a ZoneDirector 3050 which is setup to use RADIUS and it works perfectly. I am trying to configure a new Virtual SmartZone 5.2 that I setup using Hyper-V connect using RADIUS as well, but RADIUS keeps failing. I have tried to replicate the similar settings I have on the ZD3050 but it constantly fails. Has anyone ran into this issue and resolved it successfully? I'm thinking there are some settings i'm missing somewhere, but I feel like I have tried everything.

Find more posts tagged with

Accepted answers

All comments

david_black_594

This is probably a dumb question, but is the vSZ listed as a RADIUS client? That's what I forget to do about half the time LOL.

unknown

At this point, there are no dumb questions. Thank you for responding and yes it has a RADIUS Client. The RADIUS Client for the vSZ is setup almost identical to our ZD3050 RADIUS Client for the exception of the IP Address.

unknown

Hi John,

What server are you using ? Are you using proxy or non proxy settings, in non proxy AP is the authenticator and AP subnet or individual IP needs to be added as radius client.

What does the AAA test say, FYI AAA test is just to check the connection between controller and AAA server using PAP and client Auth uses EAP.

Best Regards

Vineet

unknown

Thank you for assisting and any help you can provide. Below are screen shots of the process i'm taking with non-proxy. I have tested proxy, but had the same results. It seems that the Virtual SmartZone does not like the "Connection Request Policy" "NAS Port Type". The ZoneDirector 3050 Controller (10.32.0.2) works perfectly, but not the vSZ (10.42.0.2). RADIUS Client settings are exactly the same except for the IP obviously.

Image_ images_messages_5f91c448135b77e247a00e2b_2993fde7a8b28b8c384625392d22eb9b_RackMultipart20200421391757x4h-a6709a24-8163-4426-8622-f419da16331a-312882018.png1587468408

Image_ images_messages_5f91c448135b77e247a00e2b_2993fde7a8b28b8c384625392d22eb9b_RackMultipart20200421391757x4h-a6709a24-8163-4426-8622-f419da16331a-312882018.png1587468408

Image_ images_messages_5f91c448135b77e247a00e2b_ed4192d10c9e1431b0dbf23704690bab_RackMultipart202004211177561l2-7f936aac-a28f-4569-b25c-1eae8309d6f5-1297915440.png1587468443

Image_ images_messages_5f91c448135b77e247a00e2b_6c4083e1184d2a9716592bf8390a12ce_RackMultipart20200421112190swn-af6e112f-ee8c-4ebc-b85c-e2725752aa85-943152057.png1587468494

Image_ images_messages_5f91c448135b77e247a00e2b_8f571d52247f23d16f28108ec3ee3f4d_RackMultipart20200421628831qzt-81489671-ebaf-42ee-a07f-f666b2853ba5-1908362959.png1587468946

Image_ images_messages_5f91c448135b77e247a00e2b_9bcdbcf97b0d8bb6d083add5c464b956_RackMultipart2020042189563117a-cf982401-3e02-4330-b919-a89ee4aeb8c2-79945026.png1587468638

Image_ images_messages_5f91c448135b77e247a00e2b_4bb9f807a1976c97c99b6fcfc6770811_RackMultipart202004213527718ss-e73c8e09-c7f4-4230-987b-8ad57728ae12-2069164414.png1587468665

Image_ images_messages_5f91c448135b77e247a00e2b_5555764334e959703135b62563f7f638_RackMultipart2020042177282qj5m-77692e32-5f36-438b-b0fa-c5c6e9a76d1d-311870660.png1587468680

Image_ images_messages_5f91c448135b77e247a00e2b_706983bbdaab40fd176d8b95c2108c23_RackMultipart20200421110110vms-b1370373-9568-4dc5-b167-e10192e54185-190305415.png1587468689

BELOW IS A SUCCESSFUL TEST FROM OUR ZD3050 (10.32.0.2) AND EVENT LOGS.

Vineet_nejwala

Hi John,

Yes, so the radius request is not matching any connection request policy and hence the auth is failing. Kindly follow the below and create a new connection request policy, if it still fails kindly open a ticket with Ruckus support to assist over remote session.

https://www.youtube.com/watch?v=QlL777qF95s

Best Regards
Vineet

unknown

That video doesn't help my issue. I've watched it 20 times. The only Connection Request Policy which communicates with my Virtual SmartZone is when I create a Condition for "Client IPv4 Address". Which is great to see the green "Success" display during testing in vSZ, but it returns with "None group is associated with this user.". Even though there is a Network Policy with a User Group its using to authenticate with. When I set it up this way and create an SSID using RADIUS, no wireless device can authenticate. The wireless SSID prompts for credentials, but it looks like it dies at the controller because nothing shows up in the Event Logs in the Server. I currently have a ticket open with Ruckus. The technician looked at it for 5 minutes and couldn't resolve the problem. Below are some more pictures.

Image_ images_messages_5f91c448135b77e247a014a0_54444dafd142e68ad704c95dfbc7a673_RackMultipart202004211161591pk-d3e1988d-3f57-48e0-b5ba-66a4d2bdcf61-479994766.png1587476097

Vineet_nejwala

Hi John,

As a test can you configure below :

1)Connection request policy : under condition add only "Day and time restriction" and allow all time

2) Network policy : under condition add "Day and time restriction" allow all time and add the user group.

Other all settings would remain same, we are just removing NAS port, Test the above settings and update, meanwhile let me check with the case owner.

Best Regards
Vineet

unknown

Thank you for the suggestion. It comes back as Success and None group, but still cannot authenticate wireless devices with the SSID/RADIUS.

Vineet_nejwala

John, is it still not hitting connection request policy or any other error on event viewer?

Best Regards
Vineet

Vineet_nejwala

Hi John,

Lets ignore the AAA test now, kindly follow the below commands to make sure we have client failure logs enabled, if no failure logs on NPS event viewer we have to follow below?

Open CMD prompt on Server as admin
At the command prompt, type the following command, and then press ENTER auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

The above command would enable the client failure and success log on NPS. If even after this you do not see any logs populating ask engineer on case to take an capture on AP to see if the "access-request" packet is leaving AP eth interface. If the request is hitting NPS there has to be the failure log populating.

Best Regards
Vineet

unknown

Hi John,

From the "Even Viewer" screenshot I can see the NAS Port Type is being classified as "Virtual" instead of "Wireless IEEE 802.11". That should be an issue from the ZD OS code.
Try as a workaround editing the NPS Policy NAS Port Type Conditions and check "Virtual" option and see if that solves the problem.

Best regards.

unknown

The Event Logs for NPS work, but when trying to authenticate to a SSID with a Wireless Device it doesn't even make it to the Server. How do i know Event Logs work, because if I have a successful or failed attempt directly from the AAA in the vSZ Controller it gives me a NPS Event Log.

unknown

I'm thinking it's something down those lines. By checking "Virtual" I no longer get a Failed attempt using the NAS Port Type Condition. But I still get the below picture and still cannot authenticate with Wireless devices. Image_ images_messages_5f91c48f135b77e247ae9cfa_50b74c0e8820670271fb5e290c2e003d_RackMultipart2020042111753012i-e32194b4-7ed1-45b7-8907-bc740699e616-1046234509.png1587483550

Image_ images_messages_5f91c48f135b77e247ae9cfa_50b74c0e8820670271fb5e290c2e003d_RackMultipart2020042111753012i-e32194b4-7ed1-45b7-8907-bc740699e616-1046234509.png1587483550

unknown

Maybe there is something in here that needs further configuring when setting up the SSID. Under "RADIUS Options".

Image_ images_messages_5f91c449135b77e247a02f15_4ec362288a6a5d6c49b60de8bd95f59c_RackMultipart20200421753301aop-f8fe447a-25bc-4f22-b377-9c1f0e4668ca-1457732284.png1587483916

Image_ images_messages_5f91c449135b77e247a02f15_4ec362288a6a5d6c49b60de8bd95f59c_RackMultipart20200421753301aop-f8fe447a-25bc-4f22-b377-9c1f0e4668ca-1457732284.png1587483916

unknown

The Virtual and Port # seem ok because it is a Virtual Controller via Hyper-V and that's the port # required to access the web portal interface. But because it is Virtual, i'm thinking there are some configuration tweeks that need to take place somewhere.

unknown

Try enabling the option "Use controller as proxy" otherwise the AP will be the one who tries to communicate with the NPS. Unless that's the way you wanted to be.

Best regards

unknown

I've tried that a few times to no success. This is ultimately how i'm going to have it setup, but for testing purposes it seems faster setting up the Non-Proxy. I get the same results, can't authenticate with the SSID.

Image_ images_messages_5f91c48f135b77e247aea906_604ccd5851c3ade659f547448d9d99a7_RackMultipart20200421597249ppp-b927e921-9200-4ddf-a636-c3f4c5351925-1660184995.png1587486849

Image_ images_messages_5f91c48f135b77e247aea906_604ccd5851c3ade659f547448d9d99a7_RackMultipart20200421597249ppp-b927e921-9200-4ddf-a636-c3f4c5351925-1660184995.png1587486849

Image_ images_messages_5f91c48f135b77e247aea906_b00c5283384356bd999aed5d5f18d097_RackMultipart202004216501911ge-3c55172b-6588-4f35-9018-324adc6e025b-567865332.png1587486861

Image_ images_messages_5f91c48f135b77e247aea906_380759645091fef0da965575032d0264_RackMultipart20200421556161hgt-99640f77-483f-4fb6-bc1a-986f91caecdf-2019300060.png1587486879

Image_ images_messages_5f91c48f135b77e247aea906_36f41c24249f91f61951b2126108eae4_RackMultipart2020042145849ngdn-59140199-280f-4277-b21f-1e25550fe3aa-1235534718.png1587486891

unknown

I don't have a ZD right know to check screens and show you exactly the menus, but I think that it has to be with the WLAN no being added to the user groups. Check default user group or any custom ones and check if the WLAN you're testing is added. Maybe I'm wrong, but I think it's worth the try.

unknown

Instead of using "User Groups" in NPS, have you tried using "Windows Groups"?

unknown

Numerous times. lol.. I'm in the process or reinstalling the Virtual SmartZone. I will update the forum with the outcome.

unknown

Because we use Windows Groups with a group of users that have access and we also have a or condition for Domain Computers, so machine auth can take place as well (if you have Windows based computers).

unknown

Reinstall of Virtual SmartZone didn't do the trick. I want to know if anybody has a Virtual SmartZone on Hyper-V and has RADIUS working. I believe the issue is that it picks up the NAS Port-Type as Virtual (Because it is), like Javier mentioned previously. Because my physical ZD3050 works with RADIUS perfectly. There has to be some tweaking I can do somewhere, but my brain is fried at this point. All ideas are welcomed.

unknown

HI John,

the nas port-type as virtual has nothing to do with the smartzone being a physical or virtual appliance. Its just what it does to create a "fake" test packet.

In all your first attempts you were not using proxy mode. As such, the APs themselves are sending the radius auth request and thus you need to add all the APs as radius clients on your NPS.

If you run in proxy mode, then its smartzone sending the requests. Are you able to run wireshark on your NPS server to see if any radius packets are reaching the controller at the IP level? I dont recall if NPS would create event logs for radius packets for unexpected clients.

unknown

Thank you for your response. As for Proxy and non-Proxy, I just have one test AP running at the moment. Non-Proxy makes testing faster. I have a Ruckus Engineer working on the issue, and he is having difficulties resolving the issue as well. The problem seems to be with the Virtual SmartZone Controller. I will update the forum with any findings.

But, I would still love to know if there is anybody out there who successfully uses a Virtual SmartZone Controller on Hyper-V and has RADIUS Authenticaing with a WIndows Server/NPS.

unknown

That video doesn't help my issue. I've watched it 20 times. 9xmovies The only Connection Request Policy which communicates with my Virtual SmartZone is when I create a Condition for "Client IPv4 Address". Which is great to see the green "Success" display during testing in vSZ, but it returns with "None group is associated with this user.". tubemate , mobdro ?

unknown

Was there any resolution to this issue? I am having the same issue with a virtual Smartzone controller.

unknown

Hi, we are using Ruckus vSZ (5.2) and Radius (Windows NPS) on both Hyper-V and VMWare and it's working.
You cannot use 5.2 version and proxy your requests through SmartZone because there is some bug currently in that release (https://forums.ruckuswireless.com/ruckuswireless/topics/radius-server-unreachable-events).

So you have to use non-proxy if you are on 5.2 at least.
If you still need help you can contact me on Teams (anders.grandt(at)qsys.se).

unknown

I am having the same issue with a virtual Smartzone controller too.

unknown

Hi all,

We had the same problem, even AAA tests in the vSZ (5.2) failed.

I have a possible solution:

- At the radius server, make sure your account matches the current network policy (Policies > Network Policies > Select your network policy > Conditions). If you have used the NPS wizard to setup network policies, it will create a condition: NAS port type "Wireless - IEEE 802.11". Remove this one if this exist. Select a user group (For example security group "Domain users") or another condition it should match.
- After that, restart all your smartzones (software- or hardware appliances doesn't matter).
- The AAA test in the vSZ should now pass and you should be able to connect to the the wifi network with 802.1x as authentication type.

unknown

vSZ version 5.2.0.0.699 with 411 R710s APs on campus. Every few days we are getting a bunch of radius server unreachable events. What is odd is the details of the event do not even point to our radius server. shareit app vidmate

unknown

HI john.

Did this problem resolve?

If not, which mode of vsz( vsz-e or vsz-h) did you deploy?

This point is important.

unknown

having same problem on sz104 firmware 5.2.2.0.317

unknown

Same issue here. I got multiple notifications from the vSZ every day.

"Authentication Server [192.168.3.2] not reachable from Radius Proxy [192.168.3.3] on Virtual SmartZone [32.111.98.106]"

I am 99% sure the authentication servers are reachable, because it sits in the same network and same physical location. (And our monitoring says it OK)

Note that the IP "32.111.98.106" looks totally random to me. This is NOT our IP, nor from the virtual smartzone.

I hoped that updating the vSZ high scale from 5.2.0.x to 5.2.1.0.515 would fix the issue, but sadly it didn't...