ZyXEL Communications NXC5500 User manual

1
The Troubleshooting Guide of 802.1X
Authentication Failed on NXC5500
Table of Contents
The Troubleshooting Guide of 802.1X Authentication Failed on NXC5500 ................................... 1
Preface ............................................................................................................................................ 2
To ology.......................................................................................................................................... 2
Configuration Validation ............................................................................................................. 2
Active Directory ....................................................................................................................... 3
Lightweight Directory Access Protocol (LDAP) ...................................................................... 10
Remote Authentication Dial in User Service (Radius) ........................................................... 14
Network Verification ..................................................................................................................... 27
Check the ort number ............................................................................................................. 27
Ping the domain name (for AD server) ..................................................................................... 27
Information Collecting .................................................................................................................. 30
Collect the logs from controller ................................................................................................ 30
Ca ture ackets......................................................................................................................... 31
The reference of KB ...................................................................................................................... 32
1.

2
Preface
How should we do when the 802.1X authentication failed? There are three hases for you to
find what the roblem let the authentication failed is. The check order is configuration, network
and information collection. First, we have to confirm that the configuration are setting correct
and then check the network is no roblem. If there is no roblem for configuration and network
and the issue still exist, then collect the regarding information for us to realize the sym tom as
soon as ossible and fix it.
To ology
There is an exam le for wireless station is authenticated by external authenticated server via
NXC5500, which has managed VLAN on NXC5500 is VLAN 1 with IP range 192.168.100.x.
USG100 acts as a DHCP server to assign an IP address to the device. Wireless stations ass
authentication by using AD/LDAP/RADIUS accounts.
Configuration Validation
There are many authentication failed cause by the error settings, so it is necessary to check the
configuration of NXC correctly when the authentication failed. NXC su ort three ty es of
external authenticated server se arately are AD, LDAP and Radius.

3
The configuration of NXC
Active Directory
1. Check the information of AD server. Go to AAA Server > Active Directory > Edit

4
There is an exam le with windows 2008 R2 AD server let us to double check the AD server
information of NXC.
*Please confirm that the AD server ick u the Advanced Features of View before you check
the information of DN.
Base DN: write the domain name
Go to the AD server and o en the Active Directory Users and Com uters. Right click
the do ain na e and go to Properties > Attribute Editor > distinguishedNa e > view.
It will show you the content that can be co ied and asted to the NXC in the field of
Base DN.
Do ain na e

5
Bind DN: write the username who has privilege to set the configuration of AD server and group
setting. In our server, the account of Administrator has the complete privilege for setting. The
information of account is same as the account of login AD server.
Bind DN: CN=Administrator,CN=Users,DC=zyxel,DC=cso,DC=com
Password : The password of Administrator
Go to the AD server and o en the Active Directory Users and Com uters. Select the Users
and right click the Ad inistrator and go to Properties > Attribute Editor >
distinguishedNa e > view. It will show you the content that can be co ied and asted to
the NXC in the field of Bind DN.
Server Authentication
User name (Must be a user who has rights to add a machine to the domain.)
Password: write the assword of user name.
(You can also write the Administrator account that has com lete rights.)
Realm: write the domain name
NetBIOS Name: Go to the AD server and o en the Active Directory Users and
Com uters. Right click the domain name and go to Pro erties > General. It will

6
show you the content that can be co ied and asted to the NXC in the field of
NetBIOS.
Configuration Validation of AD server infor ation
After finish entering the information of AD server, you can in ut an account id of AD server
for testing to make sure NXC can ca ture the user information by correct AD configuration.
The Test Status will show you the message about the result of user authentication.
After confirm the ste 1 is assing, and then go to the ste 2.
2. Go to Date/Ti e. Make sure the time of NXC and AD server both have the correct time.

7
3. Go to Host Na e. Set the domain name as you set on the AD server.
4. Go to DNS > Do ain Zone Forwarder > Add. Add the information of domain zone.
*Public DNS server: write the IP of DNS server can resolve the domain name. If you have no
additional DNS server, you can write the IP of AD server.

8
5. Go to Auth. Method > Add. Select the AD server you create.
6. Go to AP profile > SSID > Security List. Make sure the security list select the 802.1X
authentication and correct AD server. Since AD server doesn’t su ort EAP rotocol, so NXC
has built-in FreeRADIUS server rovide EAP rotocol for station authentication. The Radius
Ty e must select Internal when the external authenticated server is AD server.
If AD server installs IAS or NPS that su ort EAP rotocol, the radius server ty e of NXC
can be select External o tion.

9
7. Go to AP profile > SSID > SSID List. Check the security rofile with 802.1X authentication.

10
8. Check AP whether set the AP rofile that you created.
9. Check the AD server whether receive the information from NXC5500 and add the NXC5500
in the com uters list automatically.
Lightweight Directory Access Protocol (LDAP)

11
1. Check the information of LDAP is correct or not. Go to AAA Server > LDAP > Edit.
Base DN: write the domain name
Bind DN: enter a user who has rivilege to set the configuration of LDAP. In the
exam le, the account of Administrator “lda admin” has the com lete rivilege for
setting. The information of account is same as the account of login LDAP.
Configuration Validation
After finish to enter the information of LDAP, you can in ut an account id of LDAP for
testing whether the information of LDAP is correct or not.
The Test Status will show you the message about the result of user authentication.

12
2. Go to Auth. Method > Add. Select the LDAP server you create.
3. Go to AP profile > SSID > Security List. Make sure the security list select the 802.1X
authentication and correct LDAP server. Since LDAP server doesn’t su ort EAP rotocol
and cannot be an authentication server, so NXC has built-in FreeRADIUS server rovide EAP

13
rotocol for station authentication. The radius server ty e must select Internal when the
external authenticated server is LDAP server.
4. Go to AP profile > SSID > SSID List. Check the security rofile with 802.1X authentication.

14
5. Check AP whether set the AP rofile that you created.
Remote Authentication Dial in User Service (Radius)
1. Check the information of Radius is correct or not. Go to AAA Server > Radius > Edit.

15
Key: Enter the correct the password is same as the password in the Radius server.

16
2. Go to Auth. Method > Add. Select the Radius server you create.

17
3. Go to AP profile > SSID > Security List. Make sure the security list select the 802.1X
authentication and correct Radius server.
Since Radius server su ort EAP rotocol and de end on the to ology, you can select the
Internal or External for radius server ty e.
Radius server type: Internal

18
If use the EAP rotocol by built-in FreeRADIUS of NXC, you need to add the NXC information
in the Radius server be a trusted client.
Radius server type: External
If use the EAP rotocol by Radius server, you need to add the AP information in the Radius
server be a trusted client.
4. Go to AP profile > SSID > SSID List. Check the security rofile with 802.1X authentication.

19
5. Check AP whether set the AP rofile that you created.
The configuration of windows co puter
The com uter with windows OS have to add a connection for connecting the SSID with 802.1X
authentication, or it will fail to connect.
The configuration of device with windows 8 OS connect the SSID with 802.1X
1. O en the “Network and Sharing Center”.
2. Click “Set up a new connection or network”.

20
3. Select “Manually connect to a wireless network”.