Windows 10: Wireless connection issues when moving from a RADIUS wireless SSID to a non-RADIUS network

Hello, we are having issues when clients move from a RADIUS based SSID to a non-RADIUS based SSID. The computers are domain joined and utilize RADIUS through a NPS server on the network. We have found that when a computer connects to the RADIUS based network and then attempts to connect to another SSID that does not use RADIUS it will either not get an IP address assigned via DHCP APIPA address or it will get an IP address but the network connection will not work, pings will fail even when attempting to ping the default gateway. The fix is to disable WiFi through Windows on the computer and

:)

 

wlan + radius authentication

Hello,

i dont know what types of radius server your using? what types of security? enabled Proxcy? MS radius server or another party server? AP is configured to support radius server? Does your radius server support your Nokia Phone ?

so many questions in my mind and everything must be configured in order to be able to connect to radius server.

for the Better solution contact your Network Administrator he/she can connect you to radius server.

thanks

 

AP unable to authenticate to RADIUS server

RADIUS is running on NPS Windows 2016 Datacenter

AP is Meraki MR33



I have tried just about everything I can think of in this configuration and cannot get a connection. I have looked over some of the other articles in the forum also but no success. If anyone can point out a
flaw or something I have missed here it would be greatly appreciated! Config info is text and can attach screenshots if anyone needs them for reference for RADIUS server, GPO applied and Meraki config.





Following NPS configuration information:



NPS Server, WIN 2016 DC

Enrolled in AD Services

Certificate from CA applied

RADIUS Clients: 10.0.0.0/8

Manually Generated Shared Secret correct between devices

Vendor Name as RADIUS Standard



Connection Request Policies:

Policy: enabled

Type of server: unspecified



Conditions:

NAS Port type: Wireless IEEE 802.11 OR Wireless Other



Settings:

Authentication: authenticate requests on this server

No Accounting

Attribute type: Caller-Station-Id

No other settings applied







Network Policies:



Policy: enabled

Grant Access

Ignore user account dial-in properties

Type of server: unspecified



Conditions:

Wireless IEEE 802.11 OR Wireless Other

User Groups: (domain name)\domain users and (domain name)\domain computers



Constraints:

Auth methods EAP Types (in listed order top to bottom): MS Secured Password EAP_CHAP v2, MS Protected EAP (PEAP,) MS Smart Card or other cert

Idle Timeout, Session Timeout, CallerStation ID and day/time restrictions not configured/default

NAS Port Type: Wireless IEEE 802.11 OR Wireless Other



Settings:

Framed Protocol: PPP

Service Type: Framed

Vendor specific: none

BAP: server settings determine...

IP filters: none

Encryption: 40, 56 and 128 checked, no encryption is NOT checked

IP Settings: Server settings determines...



GPO: no inheritance from other GPO's and only GPO in the test OU



Comp config-Security-wireless-new

Policy Name: RADIUS-TEST



Properties:

General Tab: Policy name and description same name

Use Windows WLAN autoconfig service for clients CHECKED

SSID "RADIUSTEST"

Network Permissions:

Infrastructure

Allow

NO other boxes checked



SSID Profile RADIUSTEST:

Connection tab: SSID RADIUSTEST

all Connect boxes checked

Security tab:

WPA2-Enterprise

AES_CCMP

Network auth method: PEAP -Properties: Verify server, cert server is checked, tell if server cant be identified, auth method is EAP-MSCHAP v2 -Advanced: PMK caching is only box checked

Auth mode: User or computer

Cache information is checked





Meraki config:



MR33 AP connected to MX67

AP has static internal address assigned

Gateway is correct



SSID: RADIUSTEST

WPA2-Enterprise with my RADIUS server

WPA encryption: 1 and 2 allowed

802.11 r/w: disabled

No splash page

Radius server IP, port 1812, shared secret from NPS



No accounting, proxy or group policies

Bridge mode

VLAN tagging

VLAN ID: # for wireless vlan on appliance

Ignore VLAN attributes in RADIUS responses

No Content filter or Bonjour forwarding

Receiving the following errors regarding the policies that are setup. Going through the policies I cannot seem to find what I have configured incorrectly though.



Event ID 20153 Error

The currently configured accounting provider failed to load and initialize successfully. The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication
method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.



Event ID 20269 Warning

CoId={NA}: The user failed an authentication attempt due to the following reason: The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method
used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.





Also received an Error 18 for bad shared secret, but I have double checked that also and, if it was incorrect for some reason previously, has been updated. Not seeing 18 at this time, but others are creating
with each attempt.



Looking into the certificate also. Had an issue regarding multiple SAN entries in the template to include using the specific IP of the server. Primary name is correct though.



Lots of moving parts here I know, I appreciate any and all assistance!

 

802.11x RADIUS wifi via NPS

Hi,

I have wifi set up using 802.11x (WPA2-Enterprise) using Windows Network Policy Server to authenticate wireless clients via RADIUS.

Laptops can only connect to the wireless AFTER they have logged in, and all is working perfectly. However, Attempting to connect to the wireless PRIOR to user logon results in an immediate "Cannot connect to this network" The wireless security is set for "User or computer authentication"

Ideally, I would like for the laptops to automatically connect to the 802.11x wifi immediately on startup, and prior to the user logging in. What am I missing?