M and MSM Series
cancel
Showing results for 
Search instead for 
Did you mean: 

MSM765 + WINDOWS AD

 
Highlighted

MSM765 + WINDOWS AD

Hi all!
i successfully joined controller to domain, and its status points AS joined. But when im trying to auth via client in logs shows that LOGIN OK, but then i receive ACCESS REJECT.
HERE some log i got

Mar 5 16:10:37 debug radiusd I:rlm_eap_mschapv2: Issuing Challenge
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Packet (Length:'159',Code:'Access-Challenge',Id:'134') from RADIUS Server (Ip:'127.0.0.1',Port:'27910') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Access Challenge (id='237') to RADIUS Client (ip-address='169.254.0.4',port='32772').
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Access Request (id='27') for user (calling-station-id='00-13-CE-D7-CC-D7',virtual-ap-index='2') from IEEE802dot1x RADIUS Client (ip-address='169.254.0.4',port='32772',called-station-id='00-0F-61-7F-BB-F0:ML_ES').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Packet (Length:'374',Code:'Access-Request',Id:'161') to RADIUS Server (Ip:'127.0.0.1',Port:'1645') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug radiusd E:internal authorization attributes are missing.
Mar 5 16:10:37 debug radiusd Last message repeated 1 times
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Packet (Length:'174',Code:'Access-Challenge',Id:'161') from RADIUS Server (Ip:'127.0.0.1',Port:'27910') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Access Challenge (id='27') to RADIUS Client (ip-address='169.254.0.4',port='32772').
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Access Request (id='98') for user (calling-station-id='00-13-CE-D7-CC-D7',virtual-ap-index='2') from IEEE802dot1x RADIUS Client (ip-address='169.254.0.4',port='32772',called-station-id='00-0F-61-7F-BB-F0:ML_ES').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Packet (Length:'311',Code:'Access-Request',Id:'173') to RADIUS Server (Ip:'127.0.0.1',Port:'1645') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug radiusd E:internal authorization attributes are missing.
Mar 5 16:10:37 debug radiusd Last message repeated 1 times
Mar 5 16:10:37 debug radiusd A:Login OK: [pchelisant] (from client localhost port 666 cli 00-13-CE-D7-CC-D7)
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Packet (Length:'138',Code:'Access-Challenge',Id:'173') from RADIUS Server (Ip:'127.0.0.1',Port:'27910') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Access Challenge (id='98') to RADIUS Client (ip-address='169.254.0.4',port='32772').
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Access Request (id='82') for user (calling-station-id='00-13-CE-D7-CC-D7',virtual-ap-index='2') from IEEE802dot1x RADIUS Client (ip-address='169.254.0.4',port='32772',called-station-id='00-0F-61-7F-BB-F0:ML_ES').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Packet (Length:'320',Code:'Access-Request',Id:'149') to RADIUS Server (Ip:'127.0.0.1',Port:'1645') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug radiusd E:internal authorization attributes are missing.
Mar 5 16:10:37 debug radiusd A:Login OK: [pchelisant] (from client localhost port 666 cli 00-13-CE-D7-CC-D7)
Mar 5 16:10:37 debug iprulesmgr Received RADIUS Packet (Length:'214',Code:'Access-Accept',Id:'149') from RADIUS Server (Ip:'127.0.0.1',Port:'27910') for User (nas-port:'666',username:'pchelisant').
Mar 5 16:10:37 debug iprulesmgr Sending RADIUS Access Reject (id='82') to RADIUS Client (ip-address='169.254.0.4',port='32772').
16 REPLIES 16
Highlighted

Re: MSM765 + WINDOWS AD

Who will point me to the problem?
Thank you!
Highlighted
Trevor Commulynx
Regular Advisor

Re: MSM765 + WINDOWS AD

You have Radius Rejects, are you sure you have the VSC set to use AD for Auth?
Highlighted

Re: MSM765 + WINDOWS AD

sure
Highlighted
Fred!
Trusted Contributor

Re: MSM765 + WINDOWS AD

Can you provide a screen capture of the AD page? Did you activated any Active Directory group attributes profiles?
Highlighted

Re: MSM765 + WINDOWS AD

See attach
Highlighted

Re: MSM765 + WINDOWS AD

Regarding attributes, the only thing i did is created groups named as my OU domain containers. But seems something is not correct, because LOGIN OK i receive only when default NON AC group is activated....
Highlighted
Fred!
Trusted Contributor

Re: MSM765 + WINDOWS AD

So that I clearly understand: I can see that you have created a couple of groups that are not access controlled. Your active directory setup seems OK so far.

However, I need to understand if the user 'pchelisant' from the traces above is connecting on a VSC that has access control enabled or not? Can you confirm the setings in your VSC?
Highlighted

Re: MSM765 + WINDOWS AD

The user PCHELISANT is a domain user. And only 1 default AD group is activated = NON AC Controlled. This is shows in the pic. So user is not Access controlled
Highlighted
Fred!
Trusted Contributor

Re: MSM765 + WINDOWS AD

I can see that you only have configured non-access controlled as an AD group from your screen capture, but my question was is the VSC/SSID that you connect to really non-access controlled?

The reason why I'm asking is that I suspect it is access-controlled from the traces that you have in your first post.

Could you please do a screen capture of the VSC page (just the top of the page, not the entire page) so that we can verify?