Troubleshooting Wireless Radius connection or authentication issues

06/02/2022 5 People found this article helpful 380,213 Views

Description

This KB will show you where to check for connection and authentication issues using the Server event logs and Wireshark.

If the Access Point is behind a Sonicwall firewall then Packet Monitor may be used to capture the traffic. Should the Access Point be connected to a switch/router, and not behind a firewall, then it may be possible to use Packet Mirroring to capture traffic on another switch port. A capturing device would need to be connected to the mirrored port.

You may be able to capture directly on the Radius Server and that would require Wireshark to be installed on the server.

Resolution

Capturing Packets using Packet Monitor or Wireshark.

Configure the Packet monitor to capture UDP traffic on port 1812. In wireshark capture using the filter udp.port ==1812
In Packet Monitor click on start capture and attempt to connect to the SSID which has been configured for Radius authentication. In Wireshark click on the capture button.
Stop the capture
Export the capture from Packet Monitor as Pcapng
Open the exported capture in Wireshark.

Wireshark profiles will display the frames differently. In this example I have added the Radius Code as a column
Expand the Access-Request frame to
Check the attributes to make sure they are correct and the correct information is being sent to the Radius Server.
Reference this against the information in the Network and Connection request policies.

Searching the Windows Server Event Viewer

Under the Server Manager go to Tools/Event Viewer
Go to Network Policy and Access Services
Search for Information Events with the ID 6273
Check under the Authentication Details section for issues
Check the User, Client Machine, NAS and Radius Client to make sure the details are correct
Check the Connection Request and Network Policies, under the Network Policy Server, for possible issues and to compare the criteria