Radius Problems 801.x

[athan1234]

Hello

I am having issues with the radius.
Mr 33

a recent
Version in use: MR 28.7.1.
The customers are unable to connect to the network

[Brash]

The test proves that the Meraki AP's are successfully able to reach the RADIUS server and (I'm fairly sure) that they are authorized to send RADIUS requests.

However it doesn't validate that the client can successfully authenticate.

What do your authentication policies look like on the RADIUS server? What are you using to identify and authorize clients? (Eg, computer name, username, certificates)

[alemabrahao]

Have you checked the logs on the Radius server?

[athan1234]

Hi I checked the radisus server .

I get  this message 

[alemabrahao]

Perfect, you need to install AD CS.

RADIUS Server Requirements

There are many server options available for RADIUS, which should work with MR access points if configured correctly. Please refer to your RADIUS server documentation for specifics, but the key requirements for WPA2-Enterprise with Meraki are as follows:

• The server must host a certificate from a Certificate Authority (CA) trusted by clients on the network.
• All gateway APs broadcasting the WPA2-Enterprise SSID must be configured as RADIUS clients/authenticators on the server, with a shared secret.
• The RADIUS server must have a user base to authenticate against.

Once the RADIUS server is configured, refer to the Dashboard Configuration section below for instructions on how to add your RADIUS server to Dashboard.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_...

[athan1234]

What do you mean with AD CS?

[alemabrahao]

active directory certificate server. For 802.1x It's necessary to have a server certificate.

It's an old article but take a look at Install and Configure the Microsoft Windows 2008 Server as a CA Server

https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/115988-nps-wlc-...

[athan1234]

When I built the cA, did I need to install it on the PC for the users ?

[alemabrahao]

If you are using PEAP It is not necessary, just for EAP-TLS.

[alemabrahao]

You can download this document and follow the steps.

https://community.cisco.com/t5/wireless-mobility-knowledge-base/deploy-a-ca-and-nps-certificate-serv...

[athan1234]

One question more . There is any way to access wothout a CA . A user are able to connect 8021x only with AD domain ? I belive MS CHAP it is possible ?

[alemabrahao]

Nope, to use 802.1x It's required a server certificate from a Certificate Authority (CA). The client does not have to validate It, but on the server, I have to install a certificate.

On Cisco WLC I know that is possible to use LDAP to 802.1x, but on Meraki, I think that is not possible.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/211277-WLC-with-LDAP-...

[athan1234]

Thanks crack 

[athan1234]

Hi i am watching this video the guy dosen’t set up a  server certificate from a Certificate Authority (CA). 

https://m.youtube.com/watch?v=TQNgh5m5ehU

[alemabrahao]

802.1x needs a server certificate. I'm 100% sure of that. In this video he is configuring a policy in NPS, probably AD CS has been installed.

trust me 802.1x doesn't work without a server certificate.

[alemabrahao]

Protected EAP (PEAP) – it uses inner and outer authentication. Nevertheless, the Authentication Server (AS) presents a digital certificate to authenticate itself with the supplicant in the outer authentication.

[alemabrahao]