iOS and WPA-2 Enterprise with RADIUS

[cjhaas]

We're using RADIUS for authentication in our WPA-2 enterprise environment and are running into issues where iOS devices (so far iPhones and iPads) are forced to re-enter their credentials fairly often. It seems that whenever a device roams to another network (home wi-fi, coffee shop, etc.) that this happens. I've personally noticed it with my device but I also tend to reboot which I thought was the issue but other users have started to complain now, too. All other clients (desktops, laptops, Windows, Mac,  Raspberry PI's) are working and can roam without issue. None of the iOS devices have enterprise profiles loaded, they're just stock. We followed the Meraki Guide for RADIUS/WPA-2 pretty much exactly as far as I can tell. Is this a known issue and is there a solution?

[PhilipDAth]

I have not seen this issue before.

When the user is getting prompted for their password again - do you see anything in the RADIUS log?  If may be that the RADIUS server is rejecting the authentication attempt, forcing the client to ask for a username/password again.

[cjhaas]

Hi Philip, in the Meraki event log I'm seeing "previous authentication expired" for iOS devices (and only iOS devices) occasionally and I'm 99% sure that those times correspond to this issue but I'll need to sit and monitor for this to happen to be 100% sure. I'll update this post if/when I confirm this.

Thanks,
Chris

[PhilipDAth]

Are you using PEAP with MSCHAPv2, or some other kind of authentication?

[cjhaas]

It appears that we didn't have that authentication method setup. We've just turned that on and I'll update this post (probably tomorrow) with results. Thanks Philip!

[PhilipDAth]

What authentication method were you using?

[cjhaas]

Unfortunately I don't know a lot about NPS in Windows, I'm an admin by default!

When I go to edit our settings, under Authentication Methods the "Override network policy" wasn't checked so I'm not really sure what was being used. Is there a default for Windows 2008 R2?

[PhilipDAth]

Your settings should look something like this:

[cjhaas]

Thanks again Philip, that's what we changed them to