topic Re: RADIUS not working with new vSZ 5.2??? in SmartZone and Virtual SmartZone

RADIUS not working with new vSZ 5.2???

john_krussaniot — Mon, 20 Apr 2020 22:11:12 GMT

I currently have a ZoneDirector 3050 which is setup to use RADIUS and it works perfectly. I am trying to configure a new Virtual SmartZone 5.2 that I setup using Hyper-V connect using RADIUS as well, but RADIUS keeps failing. I have tried to replicate the similar settings I have on the ZD3050 but it constantly fails. Has anyone ran into this issue and resolved it successfully? I'm thinking there are some settings i'm missing somewhere, but I feel like I have tried everything.

Re: RADIUS not working with new vSZ 5.2???

david_black_594 — Mon, 20 Apr 2020 22:29:07 GMT

This is probably a dumb question, but is the vSZ listed as a RADIUS client? That's what I forget to do about half the time LOL.

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Mon, 20 Apr 2020 22:34:17 GMT

At this point, there are no dumb questions. Thank you for responding and yes it has a RADIUS Client. The RADIUS Client for the vSZ is setup almost identical to our ZD3050 RADIUS Client for the exception of the IP Address.

Re: RADIUS not working with new vSZ 5.2???

vineet_nejawal2 — Tue, 21 Apr 2020 03:22:33 GMT

Hi John,

What server are you using ? Are you using proxy or non proxy settings, in non proxy AP is the authenticator and AP subnet or individual IP needs to be added as radius client.
What does the AAA test say, FYI AAA test is just to check the connection between controller and AAA server using PAP and client Auth uses EAP.

Best Regards
Vineet

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 11:50:30 GMT

Thank you for assisting and any help you can provide. Below are screen shots of the process i'm taking with non-proxy. I have tested proxy, but had the same results. It seems that the Virtual SmartZone does not like the "Connection Request Policy" "NAS Port Type". The ZoneDirector 3050 Controller (10.32.0.2) works perfectly, but not the vSZ (10.42.0.2). RADIUS Client settings are exactly the same except for the IP obviously.

BELOW IS A SUCCESSFUL TEST FROM OUR ZD3050 (10.32.0.2) AND EVENT LOGS.

Re: RADIUS not working with new vSZ 5.2???

Vineet_nejwala — Tue, 21 Apr 2020 12:32:44 GMT

Hi John,

Yes, so the radius request is not matching any connection request policy and hence the auth is failing. Kindly follow the below and create a new connection request policy, if it still fails kindly open a ticket with Ruckus support to assist over remote session.

https://www.youtube.com/watch?v=QlL777qF95s

Best Regards
Vineet

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 13:39:29 GMT

That video doesn't help my issue. I've watched it 20 times. The only Connection Request Policy which communicates with my Virtual SmartZone is when I create a Condition for "Client IPv4 Address". Which is great to see the green "Success" display during testing in vSZ, but it returns with "None group is associated with this user.". Even though there is a Network Policy with a User Group its using to authenticate with. When I set it up this way and create an SSID using RADIUS, no wireless device can authenticate. The wireless SSID prompts for credentials, but it looks like it dies at the controller because nothing shows up in the Event Logs in the Server. I currently have a ticket open with Ruckus. The technician looked at it for 5 minutes and couldn't resolve the problem. Below are some more pictures.

Re: RADIUS not working with new vSZ 5.2???

Vineet_nejwala — Tue, 21 Apr 2020 13:59:22 GMT

Hi John,

As a test can you configure below :

1)Connection request policy : under condition add only "Day and time restriction" and allow all time

2) Network policy : under condition add "Day and time restriction" allow all time and add the user group.

Other all settings would remain same, we are just removing NAS port, Test the above settings and update, meanwhile let me check with the case owner.

Best Regards
Vineet

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 14:23:13 GMT

Thank you for the suggestion. It comes back as Success and None group, but still cannot authenticate wireless devices with the SSID/RADIUS.

Re: RADIUS not working with new vSZ 5.2???

Vineet_nejwala — Tue, 21 Apr 2020 14:41:21 GMT

John, is it still not hitting connection request policy or any other error on event viewer?

Best Regards
Vineet

Re: RADIUS not working with new vSZ 5.2???

Vineet_nejwala — Tue, 21 Apr 2020 15:12:06 GMT

Hi John,

Lets ignore the AAA test now, kindly follow the below commands to make sure we have client failure logs enabled, if no failure logs on NPS event viewer we have to follow below?

Open CMD prompt on Server as admin
At the command prompt, type the following command, and then press ENTER auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

The above command would enable the client failure and success log on NPS. If even after this you do not see any logs populating ask engineer on case to take an capture on AP to see if the "access-request" packet is leaving AP eth interface. If the request is hitting NPS there has to be the failure log populating.

Best Regards
Vineet

Re: RADIUS not working with new vSZ 5.2???

javier_valdes_c — Tue, 21 Apr 2020 15:15:21 GMT

Hi John,

From the "Even Viewer" screenshot I can see the NAS Port Type is being classified as "Virtual" instead of "Wireless IEEE 802.11". That should be an issue from the ZD OS code.
Try as a workaround editing the NPS Policy NAS Port Type Conditions and check "Virtual" option and see if that solves the problem.

Best regards.

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 15:27:30 GMT

The Event Logs for NPS work, but when trying to authenticate to a SSID with a Wireless Device it doesn't even make it to the Server. How do i know Event Logs work, because if I have a successful or failed attempt directly from the AAA in the vSZ Controller it gives me a NPS Event Log.

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 15:39:50 GMT

I'm thinking it's something down those lines. By checking "Virtual" I no longer get a Failed attempt using the NAS Port Type Condition. But I still get the below picture and still cannot authenticate with Wireless devices.

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 15:45:33 GMT

Maybe there is something in here that needs further configuring when setting up the SSID. Under "RADIUS Options".

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 15:50:46 GMT

The Virtual and Port # seem ok because it is a Virtual Controller via Hyper-V and that's the port # required to access the web portal interface. But because it is Virtual, i'm thinking there are some configuration tweeks that need to take place somewhere.

Re: RADIUS not working with new vSZ 5.2???

javier_valdes_c — Tue, 21 Apr 2020 16:15:54 GMT

Try enabling the option "Use controller as proxy" otherwise the AP will be the one who tries to communicate with the NPS. Unless that's the way you wanted to be.

Best regards

Re: RADIUS not working with new vSZ 5.2???

john_krussaniot — Tue, 21 Apr 2020 16:35:35 GMT

I've tried that a few times to no success. This is ultimately how i'm going to have it setup, but for testing purposes it seems faster setting up the Non-Proxy. I get the same results, can't authenticate with the SSID.

Re: RADIUS not working with new vSZ 5.2???

javier_valdes_c — Tue, 21 Apr 2020 16:59:23 GMT

I don't have a ZD right know to check screens and show you exactly the menus, but I think that it has to be with the WLAN no being added to the user groups. Check default user group or any custom ones and check if the WLAN you're testing is added. Maybe I'm wrong, but I think it's worth the try.

Re: RADIUS not working with new vSZ 5.2???

eightohtwoeleve — Wed, 22 Apr 2020 13:58:40 GMT

Instead of using "User Groups" in NPS, have you tried using "Windows Groups"?