Can someone help with VPN/RADIUS Authentication

[dpodblood]

Hey all,

I'm new to my position as system admin, and have found myself in a bit of a stressful situation which I haven't been able to resolve. We have a Sonicwall router which we are using for an LT2P/IPsec VPN. For authentication we are using RADIUS on Windows Server 2008. Yesterday we made some changes to the policies on our NPS server in order to try and get our Wi-Fi users to authenticate through RADIUS. We never did get it working and now our VPN users are unable to authenticate either. I'm not sure what has changed so I am hoping someone can help me troubleshoot.

I have checked the IAS logs on the RADIUS server, and used a parser to make them more readable:

http://www.deepsoftware.ru/iasviewer/

In the cause for termination it is showing "INVALID_PORT_TYPE". The thing is the connection policy, and the network policy which the connection is hitting does not specify a NAS port type, and never has, so why would it be giving me this error? Even when I look back through the logs to a successful connection attempt a NAS port type is not specified. If any one has any ideas on what would cause this error, or where else I can look for information to troubleshoot (logs etc.) with it would be appreciated.

Here is the actual entry from the IAS log:

192.168.221.1,mycompany\dpodblood,07/13/2012,14:54:26,IAS,server,4,192.168.221.1,5,0,4108,192.168.221.1,4116,0,4128,Router,4154,Use Windows authentication for all users,4155,1,4129,mycompany\dpodblood,4130,mycompany\dpodblood,25,311 1 fe80::c10a:5c22:7035:1ce4 07/13/2012 17:16:17 13,4127,2,4149,company Wireless Policies,4136,1,4142,0
192.168.221.1,mycompany\dpodblood,07/13/2012,14:54:26,IAS,server,25,311 1 fe80::c10a:5c22:7035:1ce4 07/13/2012 17:16:17 13,4149,company Wireless Policies,4108,192.168.221.1,4116,0,4128,Router,4154,Use Windows authentication for all users,4155,1,4129,mycompany\dpodblood,4130,mycompany\dpodblood,4127,2,4136,3,4142,70

Any help would be appreciated!

 

[dpodblood]

And solved....

Apparently there is a secondary location where NAS port type can be defined. 802.11 was selected where it should have been empty. Amazing how one checkbox can ruin an afternoon.

 

[spidey07]

RADIUS is extremely powerful and normally you have to explicitly tell it what to accept and from whom. When doing wireless you'll need to allow whatever EAP method you're using and if you're using PEAP you need to have your certificate setup all correctly on the RADIUS server along with the root cert from the root CA.

Conversely to test and get the cert stuff not involved, tell the wireless client to not verify server cert.