Security

 Using Aruba 6.3.1.15

 

Trying to setup a basic user only auth (to AD) wifi network.  The radius side is fine as I have gone through the AAA test.

 

But when a client tries to connect it asks for the username and password, but then just says it is unable to connect.

 

I am new to Aruba so I am probably missing something basic.  Any step by step guide out there or places to check where I may have gone wrong.

 

 

The controller is EAP agnostic. The issue is likely between the client and the RADIUS server.

 

Which RADIUS platform are you using?

Did you install a server certificate on the RADIUS server?

Does the client have the Root CA that signed the RADIUS server certificate?

Windows 2008 R2 server for radius

 

Ideally for this test network they want is with mininal issues for the user (so only minial use of certs).  The aim is easy of use rather then security.

 

Server does have a cert.  When the client trying to connect it asking to accept the cert but then says unable to connect. 

Please take a look at the document  here:

 

 http://community.arubanetworks.com/aruba/attachments/aruba/115/6113/1/Using+Microsoft+Windows+2008+Server+With+Aruba.pdf

 

...to see how to set things up.  

Thanks, will take a look.

 

I am fairly sure I know the answer to this, but is there anyway in which clients can connect to a wifi network with their Active Directoy details without the use of any certs?

 

Thanks again

At Minimum, your radius server needs a certificate, even when authenticating usernames and passwords.   That is as per the standard.   It is in the document.

Justing looking through the document.

 

Is there any issues with the Radius server not to be sitting on a domain controller.  We ideally want the radius to be a different server to our DCs.

 

Is that asking for problems down the line?

It only has to be a domain member.  No problems down the line.

Cool, that is what I thought.

 

Setup a new server just running radius.  (it is on the domain)

 

I have setup radius and gone through the certificate part of the document and all went has expected.

 

Now when using the connection on the AAA Test Server is says AAA server timeout.  I will recheck the radius settings.  Hopefully it is just a typo.

 

Check to make sure you have the controller listed as a radius client, with the correct radius secret.

Okay, so I have a new server in the domain that I have setup as a Network Policy Server (following the document).  This server is not a DC, but is in the domain.

 

When it comes to the AAA Test Server process, it is just stating AAA server timeout.

 

Any thoughts on what I may have missed?

Are there any firewalls between the controller and the NPS server?

All firewall settings on the server are off.  Nothing between controller and server.

Resolved the AAA Test Server problem.  It was down to DNS.

 

But still have the existing issue whereby a client attempts to connect, it asks for the username and password and then says that it is unable to joing the network.

 

I probably have a setting wrong somewhere in the setup.  Any thoughts on the best place to look.

Take a look in the event viewer in NPS and search for the MAC address.


Thanks,
Tim

Right more or less got it sorted.  Issue was that while the main controller was setup as a Radius client the backup controller was not.  And the test AP was working off the backup controller.

 

So now clients can connect and join the network and all working.  The only remaining issue is that the certs that the clients have to accept is 'not verified'

 

This is the same issue if it is the aruba cert from the controller or the server cert from the radius server.

 

I am thinking the best option would be to load a cert onto the controller!  Thoughts?

The not verified will always come up the first time a user connects to the network. The only way to bypass that is to configure network settings via group policy or manually configure the clients locally.


Thanks,
Tim

Fair enough.  Only really an issue from windows machines as it prompts a number of times before it goes through.  All other devices (mobile phones and ipads) it is just the once.

On Windows, it will try machine, then user which is why you see it multiple times.


Thanks,
Tim

Thanks for all the help.  Will continue with testing and no doubt come back if I run into anything else.  Cheers