RADIUS issues

If you use WPA-Enterprise or WPA2-Enterprise on your network, clients must be authenticated via a RADIUS server, and even if you don't use those wireless standards, RADIUS provides an effective way of providing centralized authentication. Troubleshooting RADIUS issues involves both ensuring that the access point/router can connect to the RADIUS server, and that the client can log in to the RADIUS server. 

Verify that the RADIUS server has a secret configured and that it is set up to accept connections from the access point/router, which should be configured to connect to RADIUS with a matching secret. Also, verify connectivity between the access point/router and the RADIUS server. There are different ways of doing this but using the ping utility is the easiest way. 

You may find that the RADIUS server is up and running and connected to the network, but the client's log in attempts are rejected. If so, make sure the client is using the Extensible Authentication Protocol (EAP) to log in and that it matches the type the RADIUS server requires. Some of the common options include:

  • EAP Transport Layer Security (EAP-TLS): This was defined in RFC 5216, and was the original wireless LAN EAP authentication protocol.
  • Protected Extensible Authentication Protocol (PEAP): Encapsulates an EAP session within an encrypted TLS tunnel. 
  • EAP Tunneled Transport Layer Security (EAP-TTLS): With this protocol, authentication takes place within an encrypted tunnel. Supported in Windows 8 and subsequent versions of Windows.
  • EAP Flexible Authentication via Secure Tunneling (EAP-FAST): Another variant of EAP which creates an encrypted tunnel, this version of the protocol uses a Protected Access Credential (PAC) to establish a tunnel in which client credentials are checked. 

If your RADIUS server uses EAP-TTLS or EAP-FAST, you will need to install an 802.1X supplicant program on the client. Also make sure that other EAP-specific settings match on both the RADIUS server and the client. If you are still having issues, you may want to refer to your RADIUS server's documentation for further guidance. A LAN analyzer or a packet sniffer such as Wireshark can be of use in debugging protocol issues. 

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset