Wireless Access

Hi there

none of our Windows 10 clients can connect to our main wireless. They can however connect to our portal page. Any ideas? Running out of magic rabbits here.

How do you connect to your main wireless?  How are your Windows 10 laptops different?  Did you ever test Windows 10 and get it to connect at some point?

 

We go through active directory - acs server.

Our authentication is as follows

 

WPA2-Entperise

AES

PEAP

It keeps saying "Cannot connect to this network". All other platforms work fine.

What do you use to configure your Windows 10 machines?

 Are there any messages on the ACS server?

Are there any messages in the controller?  (show auth-tracebuf mac <mac address of client>)

We found a few models of NICs do not see ‘a’ band ssid, but only see ‘g’ band ssid. See if you can download driver from manufacture of the NIC instead of using Windows 10 driver.

Hi there

downloaded directly from intel and still no luck. I can authenticate to our other wireless network which is a captive portal. Frustrated.

...then I would open a TAC case.  The rest of us are just guessing with the limited information you provided...

 

I have.

Have you contacted your Aruba partner? They likely have more insight into your network/configurtion.


Thanks,
Tim

Can you put a client in debug, attempt to connect and post the auth-tracebuf output?

 

 

Side note. Are all of your clients configured to not validate server identity?

I am having the same issue with a batch of new laptops and minis running windows 10 going to a radius server. The radius log shows successful and airwave assigns an IP address but I get that same message on the LT or mini. It's something incompatible with Windows 10 and the 105AP. Has anyone had any luck? All drivers are up to date.

Are there any messages on the controller or ACS while they are trying to authenticate?

 

I checked all of the settings on the SSID and nothing stands out. Im running Windows 64 bit - Windows 10. Just bizarre.

If all of the settings are the same, the error messages are what matter.  Besides the error message on the client, are there any error messages in the user debug on the controller, or the logs on the ACS?  That information is crucial.

 

Dug deeper and found this on the ACS

 

11514 Unexpectedly received empty TLS message; treating as a rejection by the client

 

Thing is we dont use a certificate to log in.

Is your RADIUS server certificate signed by a public or private CA?


Thanks,
Tim

We dont use a certificate in the settings (unchecked). For this network we have to manually set up the SSID.

 

You have to have a RADIUS server certificate.


Thanks,
Tim

We use an ACS5.1 Cisco... this is the config

 

Friendly Name:
Description:
Issued To:	ACS51
Issued By:	ACS51
Valid From:	20:17 12.08.2011
Valid To (Expiration):	20:17 11.08.2012
Serial Number:	5c0e174235909c6a

 

Protocol

Select Protocol to which selected certificate should be applied.

EAP: Used for EAP protocols that use SSL/TLS tunneling

Management Interface: Used to authenticate the web server (GUI)

 

Renew Self-Signed Certificate

Certificate expires on:	20:17 11.08.2012
Renew Self-Signed Certificate

So I dug deeper and found this on the Radius server.

This is only happening on Windows 10 machines, everything else works fine.

CWC-AAA-1

11514 Unexpectedly received empty TLS message; treating as a rejection by the client

The P at the beginning of 'PEAP' stands for "Protected" and is usually a certificate-based TLS "wrapper" for the EAP exchange of user credentials.

 

Given that your certificate is long-expired, I'd expect that you've been telling your Windows 7 and 8 systems to ignore server validation. I don't know what changes if any were made in Windows 10, but I'm sure the options have moved around. It's even possible MS has tightened security and made it harder to use self-signed and expired certificates.

 

You'll need to poke around in your WLAN settings on the clients to get them to accept the RADIUS server certificate.

 

If you can post screenshots of bits of it, we could help you figure it out.

 

Hi there

issue was with the ACS 5.1 server. We had to create a new certificate and then it worked :)

I hate Windows 10!

It really has nothing to do with Windows 10. Certificates are a critical
part of network authentication. You should consider reconfiguring your
clients to verify the server's identity.

Agree with Tim, you should change your Win7/8 clients to now check the server certificates in their supplicant configs. It is VERY trivial to MITM those kinds of untrusted connections and puts your data integrity at risk.

Good luck, glad you got it working!

I would like to have all our Win7/8 clients check for a valid certificate, but since the default is to not trust any certificate that's easier said than done.  The first time they connect they'll get a warning no matter what, no? Whether it's our cert or MITM. Plus windows 7 doesn't always get cleanly past that 'continue' part of an 802.1x auth and onto the network. Fac/staff I can push, but students normally set up the connection to ignore.

Have you considered using QuickConnect?