Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 35 replies
  • Subscribers 1 subscriber
  • Views 47108 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WLAN Radius (NPS) authentication fails (since upgrade to UTM 9)

fundinfo
Hi,

since the upgrade to UTM 9 (9.004-34) (HA Mode) we are experincing some problems with our WLAN authentication. 
There is a RADIUS server set up (Windows Server 2008R2, NPS Server, configured as described in the Sophos KB), which worked fine with our devices running V8.***. Since the upgrade to UTM none of the clients is able to connect to the wireless network using WPA2 Enterprise (WPA2 PSK works fine). Nothing was changed on the RADIUS server side and the configuration/shared key, etc was double checked. There are no errors in the NPS log, but the Sophos wireless log shows the authentication process.
 
The error showing up is the following:
802.1X: authentication failed - EAP type: 0 ((null))
802.1X: Supplicant used different EAP type: 1 (Identity)

The part of the logfile showing the error message is attached.


Any ideas?

Thanks.


This thread was automatically locked due to age.
  • 0
    APflash | UTM Tools

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    If I delete the other 2 SSID's VLAN9 and VLAN98, turn vlan tagging off on the access point and bridge the "house" ssid to the AP LAN I get the correct IP address.
  • 0
    I have to admit that I haven't tried the "Bridge to VLAN" functionality, only the "Bridge to AP LAN" capability.  I have bridged a wlan interface to an existing Standard Ethernet interface, but I don't think that can be done to a VLAN interface.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Bob, I finally got it to work thanks to your suggestions and assistance. The problem was with the configuration of the switch port, it seems like Cisco and Sophos\Astaro handle the VLAN tagging a little bit differently on the AP's. My Cisco AP worked fine with the way my HP switch was configured but for the AP50 to work I had to set the PVID to 1 instead of 7, and tag the port for VLAN 7 instead of being untagged. Kind of strange to me, but I'm pretty green with networking.

    Thanks again for all your help, I certainly learned a lot in the process.

    PS what part of OKC do you live in? My Aunt and Uncle live in Edmond OK, they work for the University of Oklahoma
  • 0
    Yeah, untagged seems to be a problem...

    Cheers - Bob
    PS I know several profs. Send an email to my username here @ the domain in my signature block below.

    Sorry for any short responses.  Posted from my iPhone.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML