1

I recently migrated NPS from one host running Windows Server 2012 Standard to another, using the TechNet instructions for migrating with different host names.

While all my RADIUS clients were (and still are) able to authenticate against the old server, one client (an Apple Time Capsule) fails to do so with the new one (I've tested the other three clients, and they work ok with the new server).

I've triple-checked the shared secrets are ok between the Time Capsule and NPS (and changed it a couple of times as well, just in case, copy-pasting the same secret on each), and based on an article I also switched NPS certificates (I messed up migrating my CA, and had to create a new one). The new CA's certificate is installed and should be trusted on the devices trying to authenticate.

Event log on the old server shows Windows security audit events for successful logins, which obviously don't show up on the new one (for the Time Capsule) - in fact the only thing that does show up when trying to authenticate against the new server are NPS event 4400s informing me about LDAP connections having been established (successfully).

After I switched on more logging on the new server, the NPS log file under C:\Windows\system32\logfiles does receive some further information, compared to the logs from the old server.

Old server (successful authentication):

<Event>
    <Timestamp data_type="4">12/09/2012 23:57:03.831</Timestamp>
    <Computer-Name data_type="1">(old-server-name)</Computer-Name>
    <Event-Source data_type="1">IAS</Event-Source>
    <NAS-IP-Address data_type="3">(radius-client-ip)</NAS-IP-Address>
    <NAS-Port data_type="0">0</NAS-Port>
    <Called-Station-Id data_type="1">(nn-nn-nn-nn-nn-nn:DOMAIN)</Called-Station-Id>
    <Calling-Station-Id data_type="1">(mm-mm-mm-mm-mm-mm)</Calling-Station-Id>
    <Framed-MTU data_type="0">1400</Framed-MTU>
    <NAS-Port-Type data_type="0">19</NAS-Port-Type>
    <Connect-Info data_type="1">CONNECT 0Mbps 802.11</Connect-Info>
    <Client-IP-Address data_type="3">(radius-client-ip)</Client-IP-Address>
    <Client-Vendor data_type="0">0</Client-Vendor>
    <Client-Friendly-Name data_type="1">(radius-client-name)</Client-Friendly-Name>
    <User-Name data_type="1">(username@domain)</User-Name>
    <Proxy-Policy-Name data_type="1">(connection-request-policy-name)</Proxy-Policy-Name>
    <Provider-Type data_type="0">1</Provider-Type>
    <SAM-Account-Name data_type="1">(DOMAIN\username)</SAM-Account-Name>
    <Fully-Qualifed-User-Name data_type="1">(DOMAIN\username)</Fully-Qualifed-User-Name>
    <NP-Policy-Name data_type="1">(network-policy-name)</NP-Policy-Name>
    <Class data_type="1">311 1 (old-server-ip) 12/07/2012 09:32:22 2836</Class>
    <Quarantine-Update-Non-Compliant data_type="0">1</Quarantine-Update-Non-Compliant>
    <EAP-Friendly-Name data_type="1">Microsoft: Secured password (EAP-MSCHAP v2)</EAP-Friendly-Name>
    <MS-Quarantine-State data_type="0">0</MS-Quarantine-State>
    <MS-Extended-Quarantine-State data_type="0">0</MS-Extended-Quarantine-State>
    <Authentication-Type data_type="0">11</Authentication-Type>
    <Packet-Type data_type="0">1</Packet-Type>
    <Reason-Code data_type="0">0</Reason-Code>
</Event>
<Event>
    <Timestamp data_type="4">12/09/2012 23:57:03.831</Timestamp>
    <Computer-Name data_type="1">(old-server-name)</Computer-Name>
    <Event-Source data_type="1">IAS</Event-Source>
    <Class data_type="1">311 1 (old-server-ip) 12/07/2012 09:32:22 2836</Class>
    <EAP-Friendly-Name data_type="1">Microsoft: Secured password (EAP-MSCHAP v2)</EAP-Friendly-Name>
    <Authentication-Type data_type="0">11</Authentication-Type>
    <PEAP-Fast-Roamed-Session data_type="0">1</PEAP-Fast-Roamed-Session>
    <Client-IP-Address data_type="3">(radius-client-ip)</Client-IP-Address>
    <Client-Vendor data_type="0">0</Client-Vendor>
    <Client-Friendly-Name data_type="1">(radius-client-name)</Client-Friendly-Name>
    <MS-CHAP-Domain data_type="2">(domain-data)</MS-CHAP-Domain>
    <Proxy-Policy-Name data_type="1">(connection-request-policy-name)</Proxy-Policy-Name>
    <Provider-Type data_type="0">1</Provider-Type>
    <SAM-Account-Name data_type="1">(DOMAIN\username)</SAM-Account-Name>
    <Fully-Qualifed-User-Name data_type="1">(DOMAIN\username)</Fully-Qualifed-User-Name>
    <NP-Policy-Name data_type="1">(network-policy-name)</NP-Policy-Name>
    <Quarantine-Update-Non-Compliant data_type="0">1</Quarantine-Update-Non-Compliant>
    <Framed-Protocol data_type="0">1</Framed-Protocol>
    <Service-Type data_type="0">2</Service-Type>
    <MS-Quarantine-State data_type="0">0</MS-Quarantine-State>
    <MS-Extended-Quarantine-State data_type="0">0</MS-Extended-Quarantine-State>
    <Packet-Type data_type="0">2</Packet-Type>
    <Reason-Code data_type="0">0</Reason-Code>
</Event>

New server (failed):

<Event>
    <Timestamp data_type="4">12/11/2012 00:43:59.126</Timestamp> 
    <Computer-Name data_type="1">(new-server-name)</Computer-Name> 
    <Event-Source data_type="1">IAS</Event-Source> 
    <NAS-IP-Address data_type="3">(radius-client-ip)</NAS-IP-Address> 
    <NAS-Port data_type="0">0</NAS-Port> 
    <Called-Station-Id data_type="1">(nn-nn-nn-nn-nn-nn:DOMAIN)</Called-Station-Id> 
    <Calling-Station-Id data_type="1">(mm-mm-mm-mm-mm-mm)</Calling-Station-Id> 
    <Framed-MTU data_type="0">1400</Framed-MTU> 
    <NAS-Port-Type data_type="0">19</NAS-Port-Type> 
    <Connect-Info data_type="1">CONNECT 0Mbps 802.11</Connect-Info> 
    <Client-IP-Address data_type="3">(radius-client-ip)</Client-IP-Address> 
    <Client-Vendor data_type="0">0</Client-Vendor> 
    <Client-Friendly-Name data_type="1">(radius-client-name)</Client-Friendly-Name> 
    <User-Name data_type="1">(username@domain)</User-Name> 
    <Proxy-Policy-Name data_type="1">(connection-request-policy-name)</Proxy-Policy-Name> 
    <Provider-Type data_type="0">1</Provider-Type> 
    <SAM-Account-Name data_type="1">(DOMAIN\username)</SAM-Account-Name> 
    <Fully-Qualifed-User-Name data_type="1">(DOMAIN\username)</Fully-Qualifed-User-Name> 
    <Class data_type="1">311 1 (new-server-ip) 12/10/2012 20:22:25 67</Class> 
    <Authentication-Type data_type="0">5</Authentication-Type> 
    <NP-Policy-Name data_type="1">(network-policy-name)</NP-Policy-Name> 
    <Quarantine-Update-Non-Compliant data_type="0">1</Quarantine-Update-Non-Compliant> 
    <Packet-Type data_type="0">1</Packet-Type> 
    <Reason-Code data_type="0">0</Reason-Code> 
</Event>
<Event>
    <Timestamp data_type="4">12/11/2012 00:43:59.126</Timestamp> 
    <Computer-Name data_type="1">(new-server-name)</Computer-Name> 
    <Event-Source data_type="1">IAS</Event-Source> 
    <Class data_type="1">311 1 (new-server-ip) 12/10/2012 20:22:25 67</Class> 
    <Session-Timeout data_type="0">30</Session-Timeout> 
    <Client-IP-Address data_type="3">(radius-client-ip)</Client-IP-Address> 
    <Client-Vendor data_type="0">0</Client-Vendor> 
    <Client-Friendly-Name data_type="1">(radius-client-name)</Client-Friendly-Name> 
    <Proxy-Policy-Name data_type="1">(connection-request-policy-name)</Proxy-Policy-Name> 
    <Provider-Type data_type="0">1</Provider-Type> 
    <SAM-Account-Name data_type="1">(DOMAIN\username)</SAM-Account-Name> 
    <Fully-Qualifed-User-Name data_type="1">(DOMAIN\username)</Fully-Qualifed-User-Name> 
    <Authentication-Type data_type="0">5</Authentication-Type> 
    <NP-Policy-Name data_type="1">(network-policy-name)</NP-Policy-Name> 
    <Quarantine-Update-Non-Compliant data_type="0">1</Quarantine-Update-Non-Compliant> 
    <Packet-Type data_type="0">11</Packet-Type> 
    <Reason-Code data_type="0">0</Reason-Code> 
</Event>

In the failing case, the second event has Packet-Type=11, which refers to the challenge. Since the two events repeat several times in the NPS log, I assume this means there is never a response to the challenge?

If I don't have the CA certificate installed on the devices trying to authenticate, the device shows the CA certificate from the old server when authenticating against it. However, with the new server, I don't get prompted about the certificate at all -- the devices just report they are authenticating, but nothing happens beyond the two events above. Eventually, the devices time out and say they couldn't connect.

Edit #4: I've been debugging this a bit more, even removing the configuration and creating new policies on the new NPS server, to no avail. I've now set the new NPS server to use PEAP only, with EAP-MSCHAPv2.

I just noticed that if I select a self-signed certificate (issued to localhost, not the FQDN, and generated for IIS Express Development(!)) on the new NPS server, devices will prompt me about the certificate and if I choose to accept the certificate, join the network successfully. In this case, the logs look like the first one above, i.e. Authentication-Type 11 and Packet-Types 1 and 2, in order.

Choosing any other certificate I have listed in the Protected EAP Properties will result in the clients never prompting me about a certificate (even when I don't have the CA certificate installed), and Authentication-Type 5 being used unsuccessfully, as above. This happens even with the certificate that was generated with the RAS and IAS Server certificate template for this very server.

What are the exact requirements for certificates used for NPS servers?

2
  • 1
    Personally, I suspect this is somehow related to the certificates, but don't know how to investigate this. Also, a laptop that can authenticate on LAN through the switch cannot authenticate through the Time Capsule (both against the new server), and this to me might contraindicate a certificate problem (shouldn't I be seeing the same through the switch?). Dec 11, 2012 at 9:51
  • Does a Time Capsule latch onto the first CA certificate it gets somehow? Wireless devices can authenticate to the new server through another AP without problems, so the devices and certificates cannot be to blame in this case as far as I can tell. I've also repeatedly verified the shared secret, so it should be ok. I can't think of anything else that could be at fault here since this problem is limited to the Time Capsule alone. Dec 15, 2012 at 9:42

0

You must log in to answer this question.

Browse other questions tagged .