Core Issue
The shared secret is not entered correctly in either the access point or the RADIUS server.
Resolution
When you receive the Bad request from NAS error message and the Invalid message authenticator in EAP request failure code, then you need to check and re-enter the shared secret key in the access point and the RADIUS server.
A RADIUS server and the access point use a shared secret text string to encrypt passwords and exchange responses. In order to configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon and a secret text (key) string that it shares with the access point.
For more information on how to configure the RADIUS server, refer to Configuring RADIUS and TACACS Servers.
Problem Type
Error message
Products
Access point
Security Options
Authentication
ACS
Tacacs+
EAP
LEAP / RADIUS
IOS Errors, Warnings, Statistics and Log Messages
Invalid message authenticator in EAP request
