Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have many Ubiquiti's unifi AP connected to a Windows Server 2012 NPS's radius server. I configured security policies for let domain user to connect to local network.

I have some trouble with window 7 clients, i get "Impossible to connect". In C:\Windows\System32\LogFiles I see the Access-Request packet and a "11" packet that seems to be Access-Challenge. I did not see any event log about connection rejected. I tried to manually configure the wireless connection with this tutorial: http://www.is.uwa.edu.au/it-help/access/wireless/unifi/windows-7/windows-7-manual but I got nothing good.

The bad thing is that with non-windows devices (like mobiles, tablets, mac computers) the radius connection works perfectly!

share|improve this question

1 Answer 1

up vote 2 down vote accepted
+50

I just did this exact thing, but I used Windows Server 2008R2 as the RADIUS server.

The guide that you linked to looks good, actually, it just needs to match your settings on the NPS/RADIUS server. By default Windows 7 computers will try to authenticate with the computer's domain password when they first power on, and then with the user name/password once you have logged in. By default, Windows 7 will also try to verify that the certificate presented by the RADIUS server is trusted. The guide you linked to shows you how to force the Windows 7 client to authenticate with the user information only. You should make sure this matches your actual NPS policy.

Here is what I did for my Unifi install:

  1. We have a domain PKI, so I generated a domain-trusted certificate for the RADIUS server. If you use a self-signed certificate, you should use GPO to deploy it to the Trusted Root Certification Authorities on the client devices.
  2. I set the RADIUS Connection Policy, authentication method as follows: EAP-MSCHAPv2.
  3. I created 2 network policies to match 2 SSIDs: Domain Computers, and Domain Users. I then used the "Called Station ID" RADIUS attribute to set up appropriate conditions: Machine Group: Domain\Domain Computers for the "Computers" SSID, and User Group: Domain\Wireless Users for the "Users" SSID.
  4. I then deployed the proper settings using GPO Group Policy Preferences to all of our domain-joined laptops.

By the way you listed a very minimal error message, but if you look in the Windows Security event log, you should be able to get much more detailed information about where the RADIUS authentication is failing.

The most likely error sources will be:

  • Improper or untrusted certificate
  • Windows is attempting to use the wrong password--machine vs user password--on a domain-joined device.
  • You have set up the authentication method differently on the RADIUS server than on the client.

The Unifi AP just passes on the RADIUS authentication, by the way: that won't be part of the equation at all. Just look at the RADIUS server and the client device.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.