Wireless Access

Firmware 6.1.2.8 Aruba 3200 controllers AP 125

 

Radius authentication using Microsoft nps

 

enforcing computer authentication.

 

After upgrading to version 6.1.x we have been experiencing issues where users do not see network shares after logon, but are able to unc to them, and also get 'no logon servers available'. All of this is very intermittent, I have allowed an allow all acl in my users and computer profiles, but this still happens?

 

Jason

#3200

Does your machine authentication machine role  allow ALL traffic ?  If not, you could be blocking domain traffic, which would prevent logins and more.

 

Yes. this was all working untill we upgraded firmware. Just for ruling out I added an allow all on the user and machine profiles.

 

jason

I'm running into a similar issue.

 

AOS 6.1.2.7, machine auth + user auth after, mostly AP 125's, MS Radius.

 

There's about a 1-2 min delay between when the user can log in with his/her domain account without getting the "No logon servers available message". I've even setup a GP to wait for the network connection when the "Welcome" is being displayed, helped somewhat but not entirely. This doesn't always happen and is intermittent. Machine  has the proper role while the issue happens. If someone has some insight or tacked a similiar problem help would be much appreciated.

 

Thanks

At the ctrl-alt-delete prompt, make sure the machine is in the user table and has an ip address.

On the command line, type "show data path session table <ip address of machine>" to make sure traffic is flowing and nothing is being blocked.

Hi, We have similar issues since upgrading from 5.4.5 to 6.1.3.1. We do machine and user auth via NPS server and AD. Periodically users are not able to pass machine auth and/or user auth. We see messages in the logs about no servers being available and other messages as well that did not happen in 5.4. FYI

---

@istong wrote:
Hi, We have similar issues since upgrading from 5.4.5 to 6.1.3.1. We do machine and user auth via NPS server and AD. Periodically users are not able to pass machine auth and/or user auth. We see messages in the logs about no servers being available and other messages as well that did not happen in 5.4. FYI

---

istong,

 

What firewall policies are in your Machine Authentication role, when your device is at ctrl-alt-delete?

 

We don't have any special rules for the machine auth so whatever the default is. I'm happy to check further if you give me an idea what to look at.  I'm curious though - if it was a firewall rule, would that not be an all or nothing issue. By that I mean wouldn't it affect all users and not the current scenario where it is intermittant and random?

---

@istong wrote:

We don't have any special rules for the machine auth so whatever the default is. I'm happy to check further if you give me an idea what to look at.  I'm curious though - if it was a firewall rule, would that not be an all or nothing issue. By that I mean wouldn't it affect all users and not the current scenario where it is intermittant and random?

---

Do your devices login to your controller as "host/<machine hostname>" when at the ctrl-alt-delete screen?

 

We do machine auth to the AD workstation object. It normally works and the user shows as 802.1x auth on the controller. But periodically users can't connect since the upgrade. Does that answer the question?

Bumping this thread for additional information.

 

We just deployed several hundred laptops, trying to change from a wired to a wireless perspective. Have run IASPARSE against the radius logs and have separated the machines that have bad domain credentials from the ones that are experiencing this exact problem.

 

We are getting that random symptom of no logon server available and occasionally a message about trust relationship between the computer and the server.  We changed the default behavior to authenticated for Machine Auth so that it functions as allow all but are still getting this behavior.

 

We have dual 6k controllers and each room has about 30 laptops with two AP 105s in each room.  The instructor and students can try and logon and can get wildly different results from every machine functioning perfectly to everyone of them getting the no logon servers available.  When we arrive on site everything from all works to but a few not working are the results.

 

VERY Random in nature.

 

Appreciate knowing what others are doing....

 

------

Controller Model	Aruba6000-US
ArubaOS Version	6.1.2.3
Compiled	2012-02-09 at 15:38:38 PST (build 32293) by p4build
ROM	System Bootstrap, Version CPBoot 1.2.0.0 (build 20527) 2009-01-20 18:56:10
Controller Uptime	29 days 19 hours 25 minutes 46 seconds
Processor	XLR 732 (revision C4) with 2017M bytes of memory.
Memory	32K bytes of non-volatile configuration memory.
System Flash	512M bytes of Supervisor Card System flash (model=CF 512MB).

If you have several hundred laptops at the same time, having good broadcast controls to reduce contention is a very important thing to reduce the random issues that you seem to be having.  Are you using "broadcast filter all" and "broadcast filter arp" at the virtual AP level?

 

We figured out the problem and I'm going to write a sepearte thread.

cjoseph, the wireless client have the proper role at the ctrl-alt-delete screen which has allow all rights. marrngtn your update on how you solved the issue will be greatly appreciated.