I am using a radius server. sometimes I have a device that is still trying to connect using a users old password, and after trying the bad password 3 times in a roll, it locks the user out. I see that there is a EVENT 201 in the event viewer. Shouldn't these type events of Client authentication failed get logged? 201 is set to log, but I never get any 201 logs. Is there a way I can see authentication failures to maybe see the device type, name or mac address of the device the password is failing on?
For the controller it is just a authentication failure. It depends upon the log level set on ZD, If it is set to Show more, you will be able to see authentication failure in the ZD event logs with client's MAC address.
Go to ZD >> System >> system settings >> Log settings >> "show more".
I am referring to ZD. I do not have authentication server sat up. if I did, would it show more than the ZD? Any good links to show how to set one up? In my ZD, I have SYSTEM, but under that I just have General, AP, Cluster, Maps, Certificates and Templates. I do not have a System Settings. is there anywhere that it would show a failure referencing the username? I need to be able to search for a username and see failures.