cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1448
Views
0
Helpful
10
Replies

User trying to authenticate from invalid location

matthew gosling
Level 1
Level 1

Hi,

I have reciently attmepted to upgrade our 5508 DMZ WLC to 7.6.100.0 from 7.2.x - we are using Cisco NAC Guest Server version 2.0.3 for web portal authentication.

Upon completing the upgrade to the WLC guest users were not able to authenticate and I was seeing the following log message on the NAC server.

_SYSTEM_ ( - 10.3.240.10) User trying to authenticate from invalid location: user@user.com 2709 05-Mar-2014 18:30:58

I have seen CSCsq86376 but we are using the IP Address as the attribute.

Has any one else run into this problem before or could perhaps point me in the right diretion of potential configuraiton to change/further trouble shooting?

Thank you in advance.

10 Replies 10

Scott Fella
Hall of Fame
Hall of Fame

You might have to look at your pre-auth ACL's on the WLC.  You can also post on the security AAA forum and see if there was a change in the WLC code that affected external webauth... make sure on the WLC WLAN AAA tab that you don't have this enabled:

Radius Server Overwrite interface

Or on the WLAN General tab that the NAS-ID is still the hostname of the WLC.  This requires a reboot if you change it.

Thanks,

Scott

*****Help out other by using the rating system and marking answered questions as "Answered"*****

-Scott
*** Please rate helpful posts ***

Just done the same as the above, but then reverted back to 7.5 and put original config on.

But still got the same issue.

Any help would be much appreciated

Has the upgrade changed  the webauth files.??

 

I have done many upgrades to v7.6 and never had any issue with WebAuth failing.  Since you downgraded and also restored your config, the only thing that would of changed is the WebAuth or certificates that isn't part of the restore.  Are you using an external authentication server, has that changed?  You might be better off opening a TAC case, because something else must of happen if you did a restore and it's still broke. 

Scott

-Scott
*** Please rate helpful posts ***

Scott.

Thank for the prompt reply.

No we are not using a external Auth server, just local.

The portal does use https and it prompts you to accept cert.

 

Think a TAC case it will have to be.

So the WebAuth is pretty straight forward.  Local auth and you don't have a 3rd party cert so you will get a certificate error. So what is the issue?  All users are not working, or just certain one?

Scott

-Scott
*** Please rate helpful posts ***

Scott.

All I get is User trying to authenticate from invalid location: on the nac guest server.

Nothing changed on the NAC server?    You should do a file compare of the config from when it was working and now.  The NGS should have a detailed error that you can look at also. Make sure your NGS and WLC shared secret is correct. Might be a good idea to enter that again. 

Scott

-Scott
*** Please rate helpful posts ***

Scott.

Thanks for the help.

Got this sorted as per abwahid in a previous post above.

Just totally missed this when I checked config.

But on WLC under Security/Radius Authentication Servers.

At the top the "Auth Call Station ID Type" was set to  system mac address.

Set to IP Address and booom...working.

 

We had the same problem after upgrading fra 7.4.121 to 7.6.120.

The CSCsq86376 fixed the problem for us.

abwahid
Level 4
Level 4

Hi,

Any customer that has the calling-station-id attribute on their controller set to MAC address will not pass any authentications, change the attribute to use the IP address instead of the MAC address and then try.

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: