Wired Intelligent Edge

Hello,

I'm having issues with Windows NPS. And getting the below output in event log when attempting to radius into an Aruba 6000 series switch after failing to authenticate. I believe I need to configure a vendor specific attribute (VSA) but couldn't find any clear documentation in configuring it on NPS. I've seen some videos where the VSA is applied to the Network Policy but based on the reason code and the particular conditions I have leads me to believe I need to configure a VSA on the Connection Request Policy.

User:

              Security ID:                                     NULL SID

              Account Name:                              User1

              Account Domain:                                         -

              Fully Qualified Account Name:   -

Client Machine:

              Security ID:                                     NULL SID

              Account Name:                              -

              Fully Qualified Account Name:   -

              Called Station Identifier:                            -

              Calling Station Identifier:                           192.168.X.X

NAS:

NAS IPv4 Address:                         -

              NAS IPv6 Address:                         -

              NAS Identifier:                               sshd

NAS Port-Type:                              Virtual

              NAS Port:                                        15263

RADIUS Client:

              Client Friendly Name:                   "Friendly Name"

              Client IP Address:                                        192.168.X.X

Authentication Details:

              Connection Request Policy Name:           -

              Network Policy Name:                  -

              Authentication Provider:                            -

              Authentication Server:                 "Authentication Server"

              Authentication Type:                    -

              EAP Type:                                        -

              Account Session Identifier:                        -

              Logging Results:                             Accounting information was written to the local log file.

              Reason Code:                                 49

              Reason:                                                         The RADIUS request did not match any configured connection request policy (CRP).

Thank you in advance if anyone has any information regarding my issue.

Hello,

I'm having issues with Windows NPS. And getting the below output in event log when attempting to radius into an Aruba 6000 series switch after failing to authenticate. I believe I need to configure a vendor specific attribute (VSA) but couldn't find any clear documentation in configuring it on NPS. I've seen some videos where the VSA is applied to the Network Policy but based on the reason code and the particular conditions I have leads me to believe I need to configure a VSA on the Connection Request Policy.

User:

              Security ID:                                     NULL SID

              Account Name:                              User1

              Account Domain:                                         -

              Fully Qualified Account Name:   -

Client Machine:

              Security ID:                                     NULL SID

              Account Name:                              -

              Fully Qualified Account Name:   -

              Called Station Identifier:                            -

              Calling Station Identifier:                           192.168.X.X

NAS:

NAS IPv4 Address:                         -

              NAS IPv6 Address:                         -

              NAS Identifier:                               sshd

NAS Port-Type:                              Virtual

              NAS Port:                                        15263

RADIUS Client:

              Client Friendly Name:                   "Friendly Name"

              Client IP Address:                                        192.168.X.X

Authentication Details:

              Connection Request Policy Name:           -

              Network Policy Name:                  -

              Authentication Provider:                            -

              Authentication Server:                 "Authentication Server"

              Authentication Type:                    -

              EAP Type:                                        -

              Account Session Identifier:                        -

              Logging Results:                             Accounting information was written to the local log file.

              Reason Code:                                 49

              Reason:                                                         The RADIUS request did not match any configured connection request policy (CRP).

Thank you in advance if anyone has any information regarding my issue.

So, I'm understanding based on the reason code that the request isn't matching on the connection request policy (CRP). But what I'm not understanding is how the request can't be processed as the only condition I'm using for the CRP is a NAS IPv4 matching on the management subnet for all my switches. I have HP 2530's and Aruba 2540's also in my network that are hitting on that CRP policy.  I've changed out the conditions for the different things you recommended with no luck. I get the same reason code of 49. I may have been listing them under the wrong setting potentially, but I tried a variation of using them as conditions and/or settings within the CRP. I'm not sure what else I would need to add in the CRP for the ArubaOS-CX's to be able to process the radius requests. I've looked through the documentation and the only thing that seems to be relevant and what I might be missing is attached but that seems to come back to VSA's.

https://support.hpe.com/hpesc/public/docDisplay?docId=a00110027en_us&docLocale=en_US" target="_blank" rel="noopener"> https://support.hpe.com/hpesc/public/docDisplay?docId=a00110027en_us&docLocale=en_US

Hello,

I'm having issues with Windows NPS. And getting the below output in event log when attempting to radius into an Aruba 6000 series switch after failing to authenticate. I believe I need to configure a vendor specific attribute (VSA) but couldn't find any clear documentation in configuring it on NPS. I've seen some videos where the VSA is applied to the Network Policy but based on the reason code and the particular conditions I have leads me to believe I need to configure a VSA on the Connection Request Policy.

User:

              Security ID:                                     NULL SID

              Account Name:                              User1

              Account Domain:                                         -

              Fully Qualified Account Name:   -

Client Machine:

              Security ID:                                     NULL SID

              Account Name:                              -

              Fully Qualified Account Name:   -

              Called Station Identifier:                            -

              Calling Station Identifier:                           192.168.X.X

NAS:

NAS IPv4 Address:                         -

              NAS IPv6 Address:                         -

              NAS Identifier:                               sshd

NAS Port-Type:                              Virtual

              NAS Port:                                        15263

RADIUS Client:

              Client Friendly Name:                   "Friendly Name"

              Client IP Address:                                        192.168.X.X

Authentication Details:

              Connection Request Policy Name:           -

              Network Policy Name:                  -

              Authentication Provider:                            -

              Authentication Server:                 "Authentication Server"

              Authentication Type:                    -

              EAP Type:                                        -

              Account Session Identifier:                        -

              Logging Results:                             Accounting information was written to the local log file.

              Reason Code:                                 49

              Reason:                                                         The RADIUS request did not match any configured connection request policy (CRP).

Thank you in advance if anyone has any information regarding my issue.

So, I'm understanding based on the reason code that the request isn't matching on the connection request policy (CRP). But what I'm not understanding is how the request can't be processed as the only condition I'm using for the CRP is a NAS IPv4 matching on the management subnet for all my switches. I have HP 2530's and Aruba 2540's also in my network that are hitting on that CRP policy.  I've changed out the conditions for the different things you recommended with no luck. I get the same reason code of 49. I may have been listing them under the wrong setting potentially, but I tried a variation of using them as conditions and/or settings within the CRP. I'm not sure what else I would need to add in the CRP for the ArubaOS-CX's to be able to process the radius requests. I've looked through the documentation and the only thing that seems to be relevant and what I might be missing is attached but that seems to come back to VSA's.

https://support.hpe.com/hpesc/public/docDisplay?docId=a00110027en_us&docLocale=en_US" target="_blank" rel="noopener"> https://support.hpe.com/hpesc/public/docDisplay?docId=a00110027en_us&docLocale=en_US

Hello,

I'm having issues with Windows NPS. And getting the below output in event log when attempting to radius into an Aruba 6000 series switch after failing to authenticate. I believe I need to configure a vendor specific attribute (VSA) but couldn't find any clear documentation in configuring it on NPS. I've seen some videos where the VSA is applied to the Network Policy but based on the reason code and the particular conditions I have leads me to believe I need to configure a VSA on the Connection Request Policy.

User:

              Security ID:                                     NULL SID

              Account Name:                              User1

              Account Domain:                                         -

              Fully Qualified Account Name:   -

Client Machine:

              Security ID:                                     NULL SID

              Account Name:                              -

              Fully Qualified Account Name:   -

              Called Station Identifier:                            -

              Calling Station Identifier:                           192.168.X.X

NAS:

NAS IPv4 Address:                         -

              NAS IPv6 Address:                         -

              NAS Identifier:                               sshd

NAS Port-Type:                              Virtual

              NAS Port:                                        15263

RADIUS Client:

              Client Friendly Name:                   "Friendly Name"

              Client IP Address:                                        192.168.X.X

Authentication Details:

              Connection Request Policy Name:           -

              Network Policy Name:                  -

              Authentication Provider:                            -

              Authentication Server:                 "Authentication Server"

              Authentication Type:                    -

              EAP Type:                                        -

              Account Session Identifier:                        -

              Logging Results:                             Accounting information was written to the local log file.

              Reason Code:                                 49

              Reason:                                                         The RADIUS request did not match any configured connection request policy (CRP).

Thank you in advance if anyone has any information regarding my issue.

Hello,

I'm having issues with Windows NPS. And getting the below output in event log when attempting to radius into an Aruba 6000 series switch after failing to authenticate. I believe I need to configure a vendor specific attribute (VSA) but couldn't find any clear documentation in configuring it on NPS. I've seen some videos where the VSA is applied to the Network Policy but based on the reason code and the particular conditions I have leads me to believe I need to configure a VSA on the Connection Request Policy.

User:

              Security ID:                                     NULL SID

              Account Name:                              User1

              Account Domain:                                         -

              Fully Qualified Account Name:   -

Client Machine:

              Security ID:                                     NULL SID

              Account Name:                              -

              Fully Qualified Account Name:   -

              Called Station Identifier:                            -

              Calling Station Identifier:                           192.168.X.X

NAS:

NAS IPv4 Address:                         -

              NAS IPv6 Address:                         -

              NAS Identifier:                               sshd

NAS Port-Type:                              Virtual

              NAS Port:                                        15263

RADIUS Client:

              Client Friendly Name:                   "Friendly Name"

              Client IP Address:                                        192.168.X.X

Authentication Details:

              Connection Request Policy Name:           -

              Network Policy Name:                  -

              Authentication Provider:                            -

              Authentication Server:                 "Authentication Server"

              Authentication Type:                    -

              EAP Type:                                        -

              Account Session Identifier:                        -

              Logging Results:                             Accounting information was written to the local log file.

              Reason Code:                                 49

              Reason:                                                         The RADIUS request did not match any configured connection request policy (CRP).

Thank you in advance if anyone has any information regarding my issue.