Aruba/RADIUS: Switch doesnt authenticate with MS-CHAPv2, but with PAP

[IT_Student]

Hello everyone, 

we have a problem with a few of our switches, which do not authenticate at the radius server with peap as configured. This is my configuration: 

radius-server host [IP] key [key]

aaa authentication ssh login peap-mschapv2 local

aaa authentication ssh enable peap-mschapv2 local

aaa authentication login privilege-mode

All of the switches are configured like this. But as I said, some of them dont authenticatie the user. They can definitely reach the NPS, because when I switch over to 'aaa authentication ssh radius local' (PAP), everything works fine. 

I can´t link this problem to a software release or product series, becuase for every failing switch, I can find a working switch with the exact same model and the same os version (or even older). What they all have in common is the product series 2530. 

On the NPS, there is only one rule, that basically allows every authentication method (for testing). From the logs I can see, that the switch and server are starting the Access-Request / Access-Challenge ping-pong. This usually ends with an Access-Accept packet, but in this case, they simply abort the connection. The server also doesn´t send an Access-Rejected packet. 

Does someone have an idea? Thank you in advane. 

[IT_Student · Accepted solution]

Hello again, 

I could reslolve the issue. The problem was that obviously,  NPS is checking the timestamp of the event when using EAP, but is not when using PAP. On the failing switches, sntp was not configured, so the switches did not have the right system time. Adding a sntp server resolved this for me. 

[nikunjbhatia]

Hi 

Please let me know if Adding a sntp server has resolved you issue.

In case you need any other assistance do let us know. 

[IT_Student]

Yes, it resolved the issue. 

Thank you!