topic Re: Authentication Failure or event 201 in ZoneDirector

Authentication Failure or event 201

eddie_scarberry — Thu, 24 Sep 2020 18:30:15 GMT

I am using a radius server. sometimes I have a device that is still trying to connect using a users old password, and after trying the bad password 3 times in a roll, it locks the user out. I see that there is a EVENT 201 in the event viewer. Shouldn't these type events of Client authentication failed get logged? 201 is set to log, but I never get any 201 logs. Is there a way I can see authentication failures to maybe see the device type, name or mac address of the device the password is failing on?

Re: Authentication Failure or event 201

syamantakomer — Fri, 25 Sep 2020 13:26:02 GMT

Hi Eddie,

Are you referring event 201 on ZD or auth server?

For the controller it is just a authentication failure. It depends upon the log level set on ZD, If it is set to Show more, you will be able to see authentication failure in the ZD event logs with client's MAC address.

Go to ZD >> System >> system settings >> Log settings >> "show more".

Regards,
Syamantak Omer

Re: Authentication Failure or event 201

eddie_scarberry — Fri, 25 Sep 2020 13:56:06 GMT

I am referring to ZD. I do not have authentication server sat up. if I did, would it show more than the ZD? Any good links to show how to set one up? In my ZD, I have SYSTEM, but under that I just have General, AP, Cluster, Maps, Certificates and Templates. I do not have a System Settings. is there anywhere that it would show a failure referencing the username? I need to be able to search for a username and see failures.

Re: Authentication Failure or event 201

syamantakomer — Fri, 25 Sep 2020 14:21:37 GMT

Hi Eddie,

Please refer online document from here.

Regards,
Syamantak Omer

Re: Authentication Failure or event 201

eddie_scarberry — Fri, 25 Sep 2020 14:33:27 GMT

Thanks, I must have a different version of firmware, as I dont have a SYSTEM>SYSTEM SETTINGS. I have done a screen shot.

Re: Authentication Failure or event 201

syamantakomer — Fri, 25 Sep 2020 14:44:24 GMT

Hi Eddie,

You have posted this question under Zonedirector product. However, you are using SmartZone or virtual SmartZone. This is why provided information is not matching.

Regards,
Syamantak Omer

Re: Authentication Failure or event 201

eddie_scarberry — Fri, 25 Sep 2020 14:46:43 GMT

Thank you. can you provide me with SmartZone info? should I post this also under Smartzone?

Re: Authentication Failure or event 201

syamantakomer — Fri, 25 Sep 2020 14:56:08 GMT

Reason Code 201 is applicable for the WLAN which has MAC Auth enabled, not for PSK or 802.1X. I don't think you will get more information like client IP or hostname.

Could you share a sample event.

Regards,
Syamantak Omer

Re: Authentication Failure or event 201

eddie_scarberry — Fri, 25 Sep 2020 15:16:26 GMT

ok thank you. its always been a chore to try to find out what devices are locking an account out. Some I have never found.