Invalid Message Authenticator in EAP Request

[lmslattery]

Hi,

I am attemping to configure Infratructure authentication for WDS and WPA/PEAP Client authentication using ACS 4.1(1) Build 23 from an Aironet 1210 running IOS 12.3(8)JEC.

I have a production ACS server that has both LEAP and PEAP enabled under the global configuration options.

The access point has been correctly defined as a NAS using RADIUS-Aironet on the ACS server. The Access point has ACS defined as a RADIUS server and the shared secret set the same as the NAS definition within ACS.

For both WDS Infrastructure authentications(LEAP) and client authentication requests to the access point using PEAP I receive the following message in the ACS failed log:

"Invalid message authenticator in EAP request"

A search on CCO tells me that this is normally the result of a shared secret mismatch. I have however retyped the shared secret several times , and tested with simple strings such as "cisco" and the same result is received. Both the Radius definition on the AP and the NAS definition on ACS have bee re-created with no change in result.

As a test I ran up a clean install of ACS 4.1(1)23 in a VMware session. Configured a NAS object for the AP as I had previously done on the production system and it worked first go.

Would anyone have any clues on what could be wrong with my production ACS. ?

Many Thanks,

Leon

[jcoke]

I don't see where you mentioned about the device groups. The strange part is that another WLC was authing with no problem. Very odd.

[lmslattery]

Thinking about it. The ACS I was originally having problem with was also setup for "Device Groups".

Even though I was having this issue with Autonomous AP's rather than WLC's I'd say our problems are related.

[Scott Fella]

Device group doesn't have to be configured if you don't want to. One working and the other not is not very strange for some odd reason. At leats you got it to work.

[apishko]

Just want to thank all for this post. Hae just brought up a new 4.1 install and have been fighting with EAP-FAST authentication off an on for the past day or so (should know by now to look here first). Anyway, I removed the WLC from a device group and it started working.

[Premdeep Banga]

I have a question, when you placed the AAA client under a NDG, was there any Shared Key defined on the NDG level. Because it is an expected behavior, that if you define a Shared Key on the NDG level it over-rides key at the AAA Client level.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/NetCfg.html#wp342738

Refer to Step4.,

"Each device that is assigned to the Network Device Group will use the shared key that you enter here. The key that was assigned to the device when it was added to the system is ignored. If the key entry is null, the AAA client key is used."

Regards,

Prem

Please rate if it helps!