Quantcast
Channel: Network Access Protection forum
Viewing all 1875 articles
Browse latest View live
↧

NPS on 2008 R2 with Aruba wireless controller

August 17, 2011, 8:07 am
$
0
0

Windows XP SP3 client:

WPA2/AES for Association- PEAP for Authentication with Secured password(EAP-MSCHAP v2) without auto connecting with windows logon creds

Aruba:

SSID-WPA2/AES

There is no termination on the controller it is a pass-through authenticator.

I connect to the SSID and it asks for my Windows Creds, so the Aruba is passing it to the NPS. I receive this error when it is validating identity. "An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP)."
↧
Search

802.1x guest user with a 802.1x configuration (another domain)

February 11, 2015, 9:49 am
$
0
0

Hello all,

I have an issue with some guest user who have a 802.1x configuration with their own companies. What happen is that the user who have 802.1x enabled try to authenticate with our NPS but the domain doesn't exist on our side. And there's a retry every minute or so right now. Is there a way we can denied other 802.1x with another domain? Make it ''normal'' guest user? Or it is on the side of the guest user?

Thanks

↧
↧

NPS certificates installed automatically on BYODs

February 11, 2015, 2:32 pm
$
0
0

Hello,

I recently set up a NPS server for our wireless authentication. I set up the following policies:

1)User must be part of a wireless_user AD group

2)Computer must have a certificate installed (manually installed)

It works, However I just discovered when an IPad trys to connect it prompts for  a username and password. If the user is part of the AD group and enters his username and password the certificate automatically installs on the device. This works for Android devices as well. Is there a way to not have the certificate be pulled down automatic.

Im very new to NPS and been searching on line for hours.

Thanks,


↧

The filename would be too long for the destination folder server 2012

December 29, 2014, 12:58 am
$
0
0

Hi Supports,

We have facing some problem in win 2012 server.I am copy file to server and come to error message is as follow: the filename would be too long for the destination folder server 2012.

Thanks & regards,

Roshan

M.no.9999484994

Email: roshan@adaan.com

↧

NPS, MSCHAPv2 and user attribute manipulation

February 16, 2015, 4:07 am
$
0
0

Hello,

I have some issues with the NPS server. I use NPS as a RADIUS to manage 802.1x authentication on a WiFi network. Active Directory has DNS name domain.cz, that is not the same as our public DNS. Now we would like to join our WiFi network to Eduroam. Under the terms of Eduroam we have to use the same realm as our public DNS, not internal. The goal is therefore to authenticate requests with realm @publicdomain.cz in our Active Directory. So I´ve created a Connection request policy and using manipulation attribute rules changed realm in user attribute from @publicdomain.cz to @domain.cz, but it doesn´t work. In logs I can see that replacement was successfull, the user is found in Active Directory but the access was denied with reason: 

Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect. (EventID 6273, Reason Code 16)


If a request contains user in form of user@domain.cz (realm is the same as our internal AD DNS), it is verified with no problem.

According to this article (https://msdn.microsoft.com/en-us/library/cc753603.aspx) user attribute must not be changed if EAP type is MSCHAPv2 and if the policy is used to forward the RADIUS message, but I don´t think this is the case.

How should I solve the problem above? I´ve tried to configure NPS on Windows Server 2008 R2 and 2012 R2 with no luck. 

JK

↧
↧

Windows 2012 r2 802.1X MAC Address bypass configuration

February 17, 2015, 10:39 pm
$
0
0
I am setting up MAB for my environment and I want to make sure I am setting it up correctly, as I see some articles stating there is a reg edit needed and others that don't mention it at all.

I have Dell PowerConnect switch with 802.1X authentication working for my Domain Computers.

I now want to allow non-802.1x capable devices to be assigned the correct vlans (Printers, IP Phones, etc).

I have created a user account in AD for the device, using lowercase MAC Address for the username and password.  
I have set the switchport to allow MAB
I have created a NPS Network Policy for one of the devices and assigned the groups it belongs to and set Authentication Method to: Unencrypted (PAP,SPAP).

I keep receiving this error in the logs "The user attempted to use an authentication method that is not enabled on the matching network policy"
↧

Network Policy Server windows 7 non domain wireless clients could not connect (Event id 6273 reason code 265)

February 17, 2015, 11:06 pm
$
0
0

Hi,

We have successfully configured network policy server on windows server 2012 and all wireless clients could connect to our network except windows 7 and xp non domain clients.The clients that are successfully authenticated includes windows 8,mobile users (andriod + iOS) domain as well as non domain clients.If we join windows 7 pc to the domain it  successfully connects but non domain clients could not connect.We have large number of windows 7 users that have their own laptop machines and we dont want each laptop to join the domain.

On server event 6273 generated with reason code 265 "The certificate chain was issued by an authority that is not trusted".Plz help how to resolve this issue.I have searched on the internet but no proper solution found.

↧

Network Policy Server Act as proxy drops response from radius (NPS) with reason code 118

February 19, 2015, 5:42 am
$
0
0

Hi

Hope you are good, Myself, Priyank, since many days we are trying to resolve one error of Radius connectivity but we failed to do so. we tried searching on internet but there is no solution. the complete scenario is we have two different forest with Trust and we have placed two NPS for domain. we are using Aruba 7010 as a NAS. when we connect directly from NAS to NPS, we are getting authenticated through the Connection and Network policy. the moment we introduce proxy in-between the connection is not getting completed. have tried enough to find out the solution. NPS event log says user is authenticated with 6272 and 6278 . Proxy event says user discarded with 6274 reason code 118. 

Event ID 6278

Network Policy Server granted full access to a user because the host met the defined health policy.

User:
    Security ID:            INFOMEDIA18\priyank.sheth
    Account Name:            priyank.sheth
    Account Domain:            INFOMEDIA18
    Fully Qualified Account Name:    infomedia18.in/INDIA/External Users/WEB18 Infra Team/Priyank Sheth

Client Machine:
    Security ID:            NULL SID
    Account Name:            -
    Fully Qualified Account Name:    -
    OS-Version:            -
    Called Station Identifier:        000B869B46D7:NW18
    Calling Station Identifier:        1430C6E86D85

NAS:
    NAS IPv4 Address:        xxx.xxx.xxx.26
    NAS IPv6 Address:        -
    NAS Identifier:            Network18-A
    NAS Port-Type:            Wireless - IEEE 802.11
    NAS Port:            0

RADIUS Client:
    Client Friendly Name:        NW18-Proxy
    Client IP Address:            xxx.xxx.xxx.125

Authentication Details:
    Connection Request Policy Name:    PUB-Auth
    Network Policy Name:        WLAN-MGMT
    Authentication Provider:        Windows
    Authentication Server:        DADAR-ADC.infomedia18.in
    Authentication Type:        PEAP
    EAP Type:            Microsoft: Secured password (EAP-MSCHAP v2)
    Account Session Identifier:        -

Quarantine Information:
    Result:                Full Access
    Extended-Result:            -
    Session Identifier:            -
    Help URL:            -
    System Health Validator Result(s):    -

Event Id 6272

Network Policy Server granted access to a user.

User:
    Security ID:            INFOMEDIA18\priyank.sheth
    Account Name:            priyank.sheth
    Account Domain:            INFOMEDIA18
    Fully Qualified Account Name:    infomedia18.in/INDIA/External Users/WEB18 Infra Team/Priyank Sheth

Client Machine:
    Security ID:            NULL SID
    Account Name:            -
    Fully Qualified Account Name:    -
    OS-Version:            -
    Called Station Identifier:        000B869B46D7:NW18
    Calling Station Identifier:        1430C6E86D85

NAS:
    NAS IPv4 Address:        xxx.xxx.xxx.26
    NAS IPv6 Address:        -
    NAS Identifier:            Network18-A
    NAS Port-Type:            Wireless - IEEE 802.11
    NAS Port:            0

RADIUS Client:
    Client Friendly Name:        NW18-Proxy
    Client IP Address:            xxx.xxx.xxx.125

Authentication Details:
    Connection Request Policy Name:    PUB-Auth
    Network Policy Name:        WLAN-MGMT
    Authentication Provider:        Windows
    Authentication Server:        DADAR-ADC.infomedia18.in
    Authentication Type:        PEAP
    EAP Type:            Microsoft: Secured password (EAP-MSCHAP v2)
    Account Session Identifier:        -
    Logging Results:            Accounting information was not written to any data store.

Quarantine Information:
    Result:                Full Access
    Session Identifier:            -

Event ID 6274

Network Policy Server discarded the request for a user.

Contact the Network Policy Server administrator for more information.

User:
    Security ID:            NULL SID
    Account Name:            priyank.sheth
    Account Domain:            -
    Fully Qualified Account Name:    -

Client Machine:
    Security ID:            NULL SID
    Account Name:            -
    Fully Qualified Account Name:    -
    OS-Version:            -
    Called Station Identifier:        000B869B46D7:NW18
    Calling Station Identifier:        1430C6E86D85

NAS:
    NAS IPv4 Address:        xxx.xxx.xxx.26
    NAS IPv6 Address:        -
    NAS Identifier:            Network18-A
    NAS Port-Type:            Wireless - IEEE 802.11
    NAS Port:            0

RADIUS Client:
    Client Friendly Name:        Network18-A
    Client IP Address:            xxx.xxx.xxx.26

Authentication Details:
    Proxy Policy Name:        PUB-Con
    Network Policy Name:        -
    Authentication Provider:        RADIUS Proxy
    Authentication Server:        xxx.xxx.xxx.101
    Authentication Type:        -
    EAP Type:            -
    Account Session Identifier:        -
    Reason Code:            118
    Reason:                The remote RADIUS (Remote Authentication Dial-In User Service) server returned an unreadable response.

Can you pls. help me in this.

Thanks

Regards



↧
Search

Sonic NSA 2400 suddenly not able to authenticate users to the RADIUS server

January 22, 2015, 9:09 am
$
0
0

Two days ago suddenly users could not authenticate through the VPN or Wifi. The password prompt just keeps coming up over and over.

So I go into the Sonicwall device and check the settings, all the ip's are correct, the settings all look good.  I go to test the RADIUS connection and get Authentication failed,  or MSCHAP ERROR: E=691 R=0 V=3.

I checked all the settings on the Server 2012 R2 NAP server, seems good, the Sonic device is configure and enabled.  Nothing seems to prevent it from logging from the NAP server settings.

To trouble shoot I added my laptop to the NAP RADIUS Clients, same issue, not able to authenticate using a couple RADIUS test tools. 

What setting can I check to find out why the NAP server is suddenly not authenticating user and clients who are allowed, enabled and correctly configured in NAP.

Any thoughts on were to look or how to further troubleshoot this not being able to authenticate to the RADIUS server issue?  Right now the VPN and Corporate Wifi are down because no one is able to authenticate.

Thank you

Curt Winter

Systems Engineer

↧
↧

OpenSSL in Windows Server 2012 R2

February 19, 2015, 7:45 am
$
0
0

A security scan gives the following Failure Report.  When I try to install the update I get a message that the update is not compatible with the Operating System.  Does anyone have experience installing an update or is it possible to disable OpenSSL provided the WebApp does not require it to run?

THREAT:

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a

full-strength general purpose cryptography library. For more details about the detection please refer to the Qualys community article

heartbleed-detection-update (https://community.qualys.com/blogs/qualys-tech/2014/04/09/heartbleed-detection-update).

OpenSSL is exposed to a security vulnerability due to a missing bounds check in the handling of the TLS heartbeat extension.

Affected Versions:

OpenSSL 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1

PLEASE NOTE:

This QID will be reported as possible vulnerability (YELLOW) if it was triggered because the target host has a vulnerable OpenSSL banner.

This QID will be reports as confirmed vulnerability (RED) if the target responds to the SSL heartbeat request in a vulnerable fashion (irrespective of

the OpenSSL banner).

IMPACT:

The vulnerabilities can be exploited by malicious users to reveal up to 64kB of memory to a connected client or server that may aid in launching

further attacks.

SOLUTION:

Update to Version 1.0.1g to resolve this issue. The latest version is available for download fromOpenSSL Web site (http://www.openssl.org/source/).

↧

nps ias log not deleteing older log files

February 20, 2015, 9:37 am
$
0
0
On Network Policy Server has Accounting configured to save *.log files to a local drive.  The check box to "When disk is full delete older log files".  Unfortunately the log files do not seem to be purged automatically.  Is there something else I'm missing in the configuration or is there a way to modify the threshold?
↧

Certificate issues

February 20, 2015, 10:23 am
$
0
0
I have a problem I can't seem to
resolve. Here is my set up.
I have SBS 2008 and a sql-srv 2005. The program
that the remote PC connects to is the sql server.
Problem started when my
certificate expired. (For the love of all things ever why wouldn't a self signed
certificate not expire or at least auto renew). At this point remote PC was
getting the "expired cert..." error
Anyway, I renewed certificate through
"SBS Console\Network\connectivity tab\certificate..." and now instead of getting
the expired message, they are getting the following. "Remote desktop server
address requested & the certificate subject name do not match."
Is there
an easy way to fix this? I haven't dealt much with certificates and I am really
struggling here.
Remote machine is not on my domain.

1. How, specifically, do I tell what
the Remote Desktop Gateway server address actually is, and
2. how do I
determine what the remote workstation thinks it should be.
This is what I
think
1. In the TS Gateway Manager \ "view TS Gateway Farm Members" \ SSL
certificate tab. However, I am viewing this on Server1 (the SBS2008).
2. When
I try to connect from the remote PC it gives me an option to view the
certificate.
These certificates match. So I am not sure where I am missing
it here.

Forgive my ignorance, but I am fairly new to the server side of things and still learning.

The certificate does have FQDN.

↧

802.1x wired authentication via PEAP, MD5

February 21, 2015, 12:58 pm
$
0
0

Hi everyone,

Thank you for taking the time for reading this, I am implementing a security solution and wanted to take th benefit of implementing 802.1x over wire. I have been searching a bit but no much info from start to finish on how to implementing this solution, i would really appreciate if someone could point me some where  to find  detailed instruction on how to do this, as so far i have been configuring in multiple way bit no result out of it. Still a orange port color on my switch, that means the first hop of security work but the next no.

Thank you in advance to read this.

↧
↧

802.1x trouble: Can't get Nortel IP Phone to authenticate to NPS server through HP ProCurve switch

May 30, 2011, 7:05 pm
$
0
0

I've been working on getting 802.1x set up.  I've so far gotten WinXP clients to authenticate through our HP ProCurve switch to the NPS server using PEAP/EAP-MSCHAPv2, and to put different authorized users on different VLANs based on AD Groups, as well as unauthorized users onto a separate VLAN.  Also, the switch is using the NPS server for securing management logons.

However, when I configure and plug in a Nortel phone, I can see the EAP packets going to the switch, which then send the Access-Request message to the NPS server.  On the NPS server, I can see that the NIC receives the Access-Request packet, but it never responds to it.  When I compare the packet to an Access-Request packet from a WinXP client, the only differences I can see are User-Name (1), Port (5), Port-ID (87), Calling-Station-ID (31) and the EAP-Message (79), which to me are the fields that *should* be different.  I can also see that the packet is coming in on the correct port (1812).  Nothing gets logged in Event Viewer, nor in the NPS log (c:\windows\system32\logfiles\inDDMMYY.log).

It's my understanding that at least, I should be getting an IAS_NO_POLICY_MATCH in the log, as I haven't set up a policy for it yet.  Also, if I set up a dummy policy to accept all requests on all days and times, using any authentication method, I still get nothing.

The phone is set to use PEAP, but if I understand correctly, even if that was set wrong, I should at least see an Access-Challenge response packet from the server; PEAP doesn't factor in quite that early.  Or do I misunderstand?

Any help would be appreciated.

↧

i cann't access to some computers in my network

February 24, 2015, 12:08 am
$
0
0

i have domain server 2008  and some pc's  

  i cann't access to shared folder in  some pc's 

and i don't now why 


↧
Search

Server 2012 NPS recieving unknown authentication attempts from DOMAIN\guest account

February 24, 2015, 11:26 am
$
0
0

Hello,

I am pretty new to technet, so I appreciate any assistance that I can get and look forward to assisting others in the future.  

I currently have a server 2012 NPS server setup to use as a radius server for my WiFi users to use their domain credentials along with 802.1x. We are using ubiquity APs here in our environment. I already setup the NPS along with a self signed user certificate which i have deployed using GPO to various devices.  My setup has been working beautifully, until i noticed a weird issue yesterday.  All of our APs are Unifi AP-LR's and we have a single Unifi AP-AC.  It seems that randomly when trying to authenticate via this one AP-AC, you are repeatedly prompted for the credentials and are never able to connect. When checking the NPS server, it says that it is receiving a connection request from MYDOMAIN\Guest.  However, no one is trying to log in with a guest account. Does anyone have any ideas as to why this would be?  Below is a sample of the log of the problem:

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:

                Security ID:                                            CABLEBAHAMAS\Guest

                Account Name:                                     -

                Account Domain:                                 CABLEBAHAMAS

                Fully Qualified Account Name:          CABLEBAHAMAS\Guest

Client Machine:

                Security ID:                                            NULL SID

                Account Name:                                     -

                Fully Qualified Account Name:          -

                OS-Version:                                           -

                Called Station Identifier:                      24a43c52aaa1:REV-Corp

                Calling Station Identifier:                     8019349def31

NAS:

                NAS IPv4 Address:                                10.70.1.42

                NAS IPv6 Address:                                -

                NAS Identifier:                                       24a43c52aaa1

                NAS Port-Type:                                     Wireless - IEEE 802.11

                NAS Port:                                               67

RADIUS Client:

                Client Friendly Name:                           REV-Corp

                Client IP Address:                                  10.70.1.42

Authentication Details:

                Connection Request Policy Name:     REV-Corp

                Network Policy Name:                         -

                Authentication Provider:                     Windows

                Authentication Server:                         radius2.cablebahamas.com

                Authentication Type:                           EAP

                EAP Type:                                               -

                Account Session Identifier:                 -

                Logging Results:                                   Accounting information was written to the local log file.

                Reason Code:                                        34

                Reason:                                                  The user or computer account that is specified in the RADIUS Access-Request message is disabled.


↧

Configure RRAS on Server 2008 - LAN Client loose connection

February 24, 2015, 12:19 pm
$
0
0

Upon configuring RRAS on a server to allow VPN connections, all the client PC's on the LAN lost connections to the server and could not access the internet.

History:

I configured RRAS to allow VPN access and NAT.

Upon completion of the configuration, I drilled down to IPv4 and could not find the NAT.

I read an article suggesting the Routing may not have been installed. Sure enough it was not, so I disabled RRAS and installed Routing.

Then I configured and enabled RRAS once again.

It was at this moment all client PC’s on the LAN lost connection to the server and the internet.

The server still had internet access.

Environment:

Server 2008 SP2 (DNS Server, DHCP Server)

Clients: Window 7 Pro SP1

While the server is the DHCP server, all client PC’s have static IP addresses.

I don't know enough about RRAS and how it has affected the access between client and server.

While a fix would be great, if you have any information that could point me in the right direction, that would be welcomed too.

Thank you in advance

↧
↧

email error message

February 4, 2015, 9:30 am
$
0
0
I'm trying to set up a live.com email account on my phone. After putting the email address and password I get a error message (failed). if I go through a search engine, the security asks my for the last four numbers of my phone number. It works that way but, I need it to work the other way. I have been using this email account on my laptop for years. I'm sure it is just security issues with your server.
↧

Windows 2012 r2 802.1X MAC Address bypass configuration

February 25, 2015, 7:18 pm
$
0
0

Hello, since my previous thread lead nowhere, I am making a new thread to try to get this resolved.

I am working on 802.1X vlan authentication setup and have so far got my Windows clients both authenticating and being assigned the correct VLANs based upon AD User group membership.

I am now trying to enable MAC Address Bypass (MAB) for the devices (phones and printers) that do not support 802.1X requests.

I am using Dell PowerConnect N2000 series switches and have enabled dot1x mac-auth-bypass on the port that I am testing with.

I have enabled fine grained PW policy in the domain. Created a user account using the mac address of an IP phone as the un and pw.

I would like help with the connection policy and network policy configuration for this.

In my testing, I have a connection policy:

NAS Port Type - Ethernet

Network Policy:

Authentication Method - PAP, SPAP OR Unauthenticated Access.

I am getting the following errors in the event logs:

EventData
SubjectUserSidS-1-5-21-3061965030-270410203-1914234541-9656
SubjectUserName70CA9B9F6055
SubjectDomainName

CONTOSO
FullyQualifiedSubjectUserNameCONTOSO\70CA9B9F6055
SubjectMachineSIDS-1-0-0
SubjectMachineName-
FullyQualifiedSubjectMachineName-
MachineInventory-
CalledStationIDf8-b1-56-5b-d9-ff
CallingStationID70:ca:9b:9f:60:55
NASIPv4Address-
NASIPv6Address-
NASIdentifierf8-b1-56-5b-d9-fd
NASPortTypeEthernet
NASPort11
ClientNameSwitch
ClientIPAddress10.10.10.8
ProxyPolicyNameMAB Wired Connections
NetworkPolicyNameMAB
AuthenticationProviderWindows
AuthenticationServertestrad.contoso.com
AuthenticationTypeEAP
EAPType-
AccountSessionIdentifier-
ReasonCode66
ReasonThe user attempted to use an authentication method that is not enabled on the matching network policy.
LoggingResultAccounting information was written to the local log file.

↧

EAP-MSCHAP-V2 auth failure with internal error

February 27, 2015, 5:21 am
$
0
0

Hi,

I am trying to do a EAP-MSCHAP-V2 authentication using Microsoft Windows Server 2012. The Connection Request Policy and Network Policy matches fine. But the NPS doesnt respond with Access Accept/Reject after the Challenge. The event log is pasted below.

System
-Provider
[ Name]Microsoft-Windows-Security-Auditing
[ Guid]{54849625-5478-4994-A5BA-3E3B0328C30D}
EventID6274
Version0
Level0
Task12552
Opcode0
Keywords0x8010000000000000
-TimeCreated
[ SystemTime]2015-02-27T13:02:15.161062800Z
EventRecordID3107890
Correlation
-Execution
[ ProcessID]536
[ ThreadID]556
ChannelSecurity
Computertest.sandbox.com
Security
-EventData
SubjectUserSidS-1-5-21-3785042689-3882553610-222231796-1118
SubjectUserName0a-00-3e-a0-00-34
SubjectDomainNameSANDBOX
FullyQualifiedSubjectUserNamesandbox.com/Users/deeps-ap
SubjectMachineSIDS-1-0-0
SubjectMachineName-
FullyQualifiedSubjectMachineName-
MachineInventory-
CalledStationID-
CallingStationID-
NASIPv4Address10.110.63.10
NASIPv6Address-
NASIdentifier-
NASPortTypeWireless - Other
NASPort5
ClientNameDeeps_AP
ClientIPAddress10.110.63.10
ProxyPolicyNamedeeps-test
NetworkPolicyNamedeeps-test
AuthenticationProviderWindows
AuthenticationServerxxx.sandbox.com
AuthenticationTypeEAP
EAPType-
AccountSessionIdentifier-
ReasonCode1
ReasonAn internal error occurred. Check the system event log for additional information.

↧
Viewing all 1875 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>