Not connecting using Enterprise with "My RADIUS server"

[rhamersley]

I have 802.1X configured with all my Meraki network switches and works fine.  I just changed my Meraki AP's from Pre-Shared key (PSK) configuration to Enterprise with "My RADIUS server" and will not connect.

[rhbirkelund]

Have you configured your RADIUS server on the SSID, other than just selecting Enterprise with Radius as authentication method?

[rhamersley]

Yes and and the Access Points show green also.   If it was not configured correctly I would see a problem with the AP's.

[GIdenJoe]

Make sure ALL your AP's have been added as Radius clients on your radius server and that their pre shared key is correct.

Then you should be looking at your radius logs to see what is going on.

You can also capture traffic leaving the AP on the wired port and filter on port 1812 to see the conversation between the AP and the radius server.  You get at treasure trove of information like the AV pairs exchanged.

Also you may be not matching the incoming session in your policy list.  Wireless has a different NAS-port type than a switch.

[rhamersley]

So appreciative on the response back GldenJoe!!!....I do have the RADIUS clients configured on the RADIUS server and the Pre-Shared Key in each location.

Unfortunately I am not familiar on how to capture traffic on a wired port on the network switch.   If you have instructions or a link I can review that would be great so I can try to capture this data.

[GIdenJoe]

In dashboard you can go to Network wide -> packet capture.
Then select for Access Points.

Then tag the correct access point.

Then below that you have the option to download the packet capture or view it on screen (download gives the option to view it in wireshark which is better).  And a text box for CAPTURE filters (not display filters).

In that box just put the filter: port 1812 and start capturing right before a client connects to the AP on the radius SSID and see the exchange of messages between AP and Radius server.

[rhamersley]

Appreciate the assistance....Where is the file created after my packet capture...

I started and stopped it.

[rhamersley]

I guess the better question is how do I download this file to my Wireshark??

[GreenMan]

It's automatically pushed to your PC via the cloud:   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi...

[rhamersley]

I have all our network switches authenticating to our RADIUS server using 802.1X for authentication for our wired users in the office.   So I would like to get off of the Pre-Shared Key (PSK) for authentication for our wireless environment.   Meraki support person was not able to assist me on this of why this was not connecting my workstation to the SSID.

[alemabrahao]

Do you see any logs arriving on your Radius server? Have you tried a packet capture?

[rdominguez]

Hello @rhamersley As @alemabrahao indicated, getting a packet capture and checking logs on your Radius server are good starting points. The packet captures can provide details in terms of whether or not the traffic is reaching the Radius server as well as the responses sent out by the server, if any.

In addition to that, Meraki does have a guide for troubleshooting Radius issues. You can find it here: 
https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS_Issue_Resolution_Guide