Setup 802.1x on WiFi network using Ruckus Cloud

[david_levine]

Hi all,

I am trying to get 802.1x working on our ICX switches and on our WiFi. 

All switches and APs / WiFi networks are managed in Ruckus Cloud.

I have configured a test wireless network for Enterprise AAA (802.1x), and have a RADIUS server setup (Windows 2019 with the NPS role). 

When I try to connect to the WiFi network, I get prompted for my username and password, but I don't get past that, and cannot connect.

I am completely new to this; Is there any testing tool or tips that might help? 

I have added all our APs as RADIUS clients in the NPS server, and have double checked the shared secret.

I have created a basic Network Policy in the NPS server; grant access to domain users, Microsoft PEAP w/ MS-CHAP-v2. Nothing special... just trying to get username/password auth to connect to the WiFi.

When trying to connect from a laptop, I get prompted for username and password, but cannot successfully auth. Pretty much same behavior if trying from a domain joined laptop or a non domain joined laptop.

Any tips are much appreciated!

[adam_mayo]

David, for the NPS side, a log analyser would help show you if the requests are even hitting the Radius server and if so, why they are failing. Im working through a similar issue monitoring the NPS logs using https://www.deepsoftware.com/iasviewer/ (its free and has a portable app which doesn't require installation).

[david_levine]

Thanks - I'll check that tool out!

[syamantakomer]

Hi Devid,

Please check and make sure auth method (EAP - PEAP) has a certificate mapped to it, else auth will not work.

If still facing issue, check event viewer >> Customer Views >> Server Roles >> Network Policy And Access Service >> Review the most recent authentication attempt. It will give you more info like if request is even reaching the server and hitting the correct policy, and what is the reason for auth failure, etc.

To see the complete picture, we need to review and collect information from below points.

1. Radius policy should be configured correctly with a certificate in auth method.
2. Radius server profile on Cloud should be configured correctly.
3. Make sure shared secrete is same on both sides, on Cloud and on Radius server.
4. Make sure AP IPs are added to radius client list on Radius Server.

For troubelshooting:

1. Setup packet capture on the AP where test client is connecting.
   - Select AP on cloud GUI >> Click on More Action >> Test Connection >> Packet Capture >> Set "Capture Interface" to "Wired" and start capture when client is ready to connect.
2. Setup and run wireshark on NPS server, and set the filter for AP IP address to filter the traffic coming from radius server.
3. Now connect the client and try 2-3 times so that you have more captures for review.
4. Post 2-3 failure, stop captures on AP and on radius server side.
5. Save captures from AP, radius server and review all to see the connection flow.
   - AP capture
   - Server capture
   - Server event logs.

Parallelly, if Cloud Analytics is working, it can also show you complete client connection flow and can pin point the failure.

If still facing issue, open a case with support for further help.

[david_levine]

Thanks for the detailed reply;

Regarding the first part - yes - there is a certificate mapped for PEAP

When looking at the NPS Event Log, I only see some logs from when I was initially trying to add the APs (had initially deployed windows server standard, and was trying to add APs using cidr... had to upgrade edition to Datacenter to do that :))

I don't see any authentication attempts in the NPS event log at all.

As for making sure the RADIUS server is configured correctly in the Cloud, there is nothing else aside from defining it in the WiFi network setup, correct?

Shared secret is the same, and all AP IP addresses have been added. Again, added using cidr, but maybe I will try adding individually see if that makes a difference.

I was looking around in Analytics, but I don't see any reference to the failed connection / auth attempts from my laptop and another test laptop I have. So, not sure if I am not looking where I should be.

I will look at doing a packet trace also.

Thanks,

[syamantakomer]

If you are not seeing any logs in event viewer, check the connectivity between AP to radius server.

For server config on Cloud, it is only available under WLAN settings.

On Analytics, you will see a search box on top, just put the failing client MAC address and search for it.