5508 WLC to Server2008 NPS Radius

[choclateer]

I have setup the WLC to authenticate to a MS Server2008 NPS for a WPA2/AES SSID. The connection is successful, but client authentication fails for wrong EAP-type. I believe this indicates a Windows7 client issue. Can anyone tell me the required client setup to satisfy the MS NPS?

[Stephen Rodriguez]

What type of EAP are you doing on the NPS?

On the client 'smartcard/other certificate' is EAP-TLS  Protected EAP is PEAP.

Steve

[choclateer]

I am not using EAP/TLS I do not have a CA server.

client is set to use:

Microsoft PEAP

secured password (EAP-MS-CHAPv2)

802.1x settings = user authentication only

Mike Fleck

Datanamics, Inc

cell 702-985-5420

[Scott Fella]

Just to add to Steves comments.  You need a certificate on NPS to do PEAP.  Do you have one installed.

[choclateer]

I checked with the server team and yes, the NPS does have a certificate.

[Stephen Rodriguez]

MIke,

     Can you screen shot the NPS rules and the client setup?

Steve

[choclateer]

NPS properties attached

[Stephen Rodriguez · Accepted solution]

Ok, you only want to select the EAP type as PEAP.  The inner method can be MSCHAPv2.  So remove the EAP-MSCHAPv2 from the EAP type list and try the client again.

Steve

[choclateer]

Thanks for that. I made that change, still had a problem. A friend told me he had issues with AES, so I changed it to TKIP and it worked the first time.