Troubleshooting RADIUS Authentication Issues

Check for access-request retries

Check your capture for a high number of duplicate access-request packets (retries). Even when you see access-accept packets, a high number of retries can prevent clients from connecting to the SSID

Record the behavior and continue to the next step.

Check for a group policy override

Check whether the access-accept packet contains a group policy override using one of these attributes:

Filter-ID: The RADIUS server uses the Filter-ID attribute-value pair (AVP) to assign the group policy Ntw Admins.

Reply-Message: The RADIUS server assigns the group policy Policy-X through the reply-message attribute

Airespace-ACL-Name: The RADIUS server assigns the group policy Policy-Y through the Airespace-ACL-Name attribute

Aruba-User-Role: The RADIUS server uses the Aruba-User-Role attribute to assign the group policy Policy-Z.

If the access-accept packet contains one of these attributes, record it and continue to the next step.

Confirm the SSID expects the correct group policy attribute

Navigate to Wireless > Configure > Access control > [SSID name]

Confirm the correct attribute is selected under RADIUS attribute specifying group policy name

After you confirm the attribute, continue to the next step.

Confirm the group policy exists and isn't blocking the client

Navigate to Network-wide > Configure > Group policies and confirm the desired policy exists. The policy name must exactly match the name the RADIUS server sends.

Navigate to Network-wide > Configure > Group policies > [policy name] and confirm the policy doesn't include firewall rules or Umbrella policies that block the client. Record the configuration and continue to the next step. 

Check for a VLAN override

A correct VLAN override must contain all three of these attributes:

• Tunnel-Type = VLAN
• Tunnel-Medium-Type = IEEE-802
• Tunnel-Private-Group-ID = [VLAN to assign]

If the access-accept packet is missing any of these attributes, the VLAN override doesn't work. The following example shows the RADIUS server assigning VLAN 200 to the user.

 If the access-accept packet contains a VLAN override, record it and continue to the next step.

Confirm the SSID accepts a VLAN override

Navigate to Wireless > Configure > Access control > [SSID name] and confirm the RADIUS override setting:

New access control page > Client IP and VLAN > RADIUS override = Override VLAN tag	Legacy Access control page > Addressing and traffic > RADIUS override = RADIUS response can override VLAN tag

Record the configuration and continue to the next step.

Collect a wireless capture

Collect a wireless capture while you reproduce the issue. Use one of these tools, listed in order of ease of use:

• A Macbook
• Other Meraki Acess points installed closed to the access point selected to reproduce the problem
• Cisco access points
• A linux device with a wireless card (Can be a laptop live boot linux)

If you only have MR access points available, follow these steps:

1. If you have a spare MR access point that you can install in the room where the problem occurs, skip to step 5
2. If you plan to use a neighboring access point instead, for example an access point installed in the next room, start with step 3.
3. Choose the access point where you'll reproduce the problem.
4. Navigate to Wireless > Monitor > RF spectrum > [access point name]
5. Select the affected band (2.4 GHz or 5 GHz). Record the channel the access point uses.
6. Click Interfering APs, sort by dBm in descending order, and record the basic service set identifier (BSSID) with the strongest signal that corresponds to one of your local SSIDs.

7. Identify the access point broadcasting the strong BSSID you recorded.
8. Filter the access point list using the last characters of the BSSID

9. Click the access point name, and click BSSID Details to confirm the strong neighbor access point.

10. Configure the strong neighbor access point, or the spare access point, to use the same channel as the access point you'll use to reproduce the issue.
11. Navigate to Wireless > Configure > Radio settings > [access point name] > Channel > Change channel setting

12. Select Manual, choose the channel, and click Save.

If you're unsure which radio band the access point uses, match both the 2.4 GHz and 5 GHz bands to the channel used by the access point reproducing the issue.

13. After both access points use the same channel,
14. Navigate to Network-wide > Monitor > Packet capture, select both access points under Access point

15. Click Start capture, and reproduce the problem.

Confirm VLAN assignment and traffic forwarding

Check whether the group policy overrides the VLAN. Navigate to Network-wide > Configure > Group policies > [policy name] > VLAN and check the setting. If the setting is Do not tag VLAN or Tag VLAN, the group policy modifies the client's default VLAN.

Take note of the configuration and continue to the next step in the troubleshooting flow.

Record the configuration and continue to the next step.

Confirm the neighboring device has the correct VLAN configuration. Depending on where your access points connect, use these documents to verify the VLAN configuration:

• MS
• MX
• Cisco switch.

Check for the complete four-way handshake process. In the wireless capture, apply this filter: wlan.addr == <client-mac-address> and eapol. Confirm you see messages 1 through 4

If you used multiple MR access points and see duplicate messages, this result is expected. Record the behavior and continue to the next step.

Check for data traffic from the wireless client. In the wireless capture, apply this filter: wlan.addr == <client-mac-address> and wlan.fc.type_subtype == 0x028. Confirm you see Quality of Service (QoS) data frames to and from the client MAC address.

Record the behavior and continue to the next step.

Check whether the access point forwards client traffic to the LAN. In the wired capture you collected earlier, apply this filter: eth.addr == <client-mac-addr> and (dhcp or arp or dns). If you see traffic sourced by the client MAC address, the access point forwards the client traffic from the wireless medium to the LAN

Record the result and return to the troubleshooting flow.