Cisco Meraki MR APs issue with Radius NPS | Reason : The RADIUS Request message that Network Policy

[sureelam]

Team, We are experiencing a recurring problem with our NPS and Cisco Meraki MR Access Point. This issue has surfaced recently, where the AP authentication initially functions properly upon installation but stops working after 3 hours, despite no alterations to the network configuration. The notable difference in the logs is the appearance of the user as Security ID: NULL SID (previously displayed as the username).
The reason for this anomaly is identified as a malformed RADIUS Request message received by the Network Policy Server from the network access server.

Reason : The RADIUS Request message that Network Policy Server received from the network access server was malformed.

Our network setup consists solely of Meraki APs, connected in the following sequence: MR ----> Aruba Switch ----> Palo Alto Firewall ----> RADIUS via IPsec tunnel. Looking forward to hearing from you guys soon...

[alemabrahao]

Perform a packet capture.

[sureelam]

@alemabrahao  What elements should we examine in a packet capture?

[cmr]

Capture the traffic on the Aruna switch for the port where the AP is connected. Compare the RADIUS requests when it works to when it fails. 

Are the packets different?  If not then move down the chain to the port connected to the Palo Alto and if still okay, to the PA itself.

[sureelam]

In the packet, it indicates an "Access-Request" message being sent, and the response from the server is an "Access-Challenge." This cycle repeats, occasionally resulting in an "Access-Request" being flagged as a duplicate request.

Within the "Access-Challenge" response, the Radius protocol is utilized, specifically involving Attribute Value pairs, with one such pair being AVP:t=Session-Timeout(27) L=6 val(30).

Could this be linked to the aforementioned issue at times?

 

[sureelam]

Not seeing any other packets apart from this.