ZyXEL Communications NXC5500 User manual

1
The Troubleshooting Guide of 802.1X
Authentication Failed on NXC5500
Table of Contents
The Troubleshooting Guide of 802.1X Authentication Failed on NXC5500 ................................... 1
Preface ............................................................................................................................................ 2
To ology.......................................................................................................................................... 2
Configuration Validation ............................................................................................................. 2
Active Directory ....................................................................................................................... 3
Lightweight Directory Access Protocol (LDAP) ...................................................................... 10
Remote Authentication Dial in User Service (Radius) ........................................................... 14
Network Verification ..................................................................................................................... 27
Check the ort number ............................................................................................................. 27
Ping the domain name (for AD server) ..................................................................................... 27
Information Collecting .................................................................................................................. 30
Collect the logs from controller ................................................................................................ 30
Ca ture ackets......................................................................................................................... 31
The reference of KB ...................................................................................................................... 32
1.

2
Preface
How should we do when the 802.1X authentication failed? There are three hases for you to
find what the roblem let the authentication failed is. The check order is configuration, network
and information collection. First, we have to confirm that the configuration are setting correct
and then check the network is no roblem. If there is no roblem for configuration and network
and the issue still exist, then collect the regarding information for us to realize the sym tom as
soon as ossible and fix it.
To ology
There is an exam le for wireless station is authenticated by external authenticated server via
NXC5500, which has managed VLAN on NXC5500 is VLAN 1 with IP range 192.168.100.x.
USG100 acts as a DHCP server to assign an IP address to the device. Wireless stations ass
authentication by using AD/LDAP/RADIUS accounts.
Configuration Validation
There are many authentication failed cause by the error settings, so it is necessary to check the
configuration of NXC correctly when the authentication failed. NXC su ort three ty es of
external authenticated server se arately are AD, LDAP and Radius.

3
The configuration of NXC
Active Directory
1. Check the information of AD server. Go to AAA Server > Active Directory > Edit

4
There is an exam le with windows 2008 R2 AD server let us to double check the AD server
information of NXC.
*Please confirm that the AD server ick u the Advanced Features of View before you check
the information of DN.
Base DN: write the domain name
Go to the AD server and o en the Active Directory Users and Com uters. Right click
the do ain na e and go to Properties > Attribute Editor > distinguishedNa e > view.
It will show you the content that can be co ied and asted to the NXC in the field of
Base DN.
Do ain na e

5
Bind DN: write the username who has privilege to set the configuration of AD server and group
setting. In our server, the account of Administrator has the complete privilege for setting. The
information of account is same as the account of login AD server.
Bind DN: CN=Administrator,CN=Users,DC=zyxel,DC=cso,DC=com
Password : The password of Administrator
Go to the AD server and o en the Active Directory Users and Com uters. Select the Users
and right click the Ad inistrator and go to Properties > Attribute Editor >
distinguishedNa e > view. It will show you the content that can be co ied and asted to
the NXC in the field of Bind DN.
Server Authentication
User name (Must be a user who has rights to add a machine to the domain.)
Password: write the assword of user name.
(You can also write the Administrator account that has com lete rights.)
Realm: write the domain name
NetBIOS Name: Go to the AD server and o en the Active Directory Users and
Com uters. Right click the domain name and go to Pro erties > General. It will

6
show you the content that can be co ied and asted to the NXC in the field of
NetBIOS.
Configuration Validation of AD server infor ation
After finish entering the information of AD server, you can in ut an account id of AD server
for testing to make sure NXC can ca ture the user information by correct AD configuration.
The Test Status will show you the message about the result of user authentication.
After confirm the ste 1 is assing, and then go to the ste 2.
2. Go to Date/Ti e. Make sure the time of NXC and AD server both have the correct time.

7
3. Go to Host Na e. Set the domain name as you set on the AD server.
4. Go to DNS > Do ain Zone Forwarder > Add. Add the information of domain zone.
*Public DNS server: write the IP of DNS server can resolve the domain name. If you have no
additional DNS server, you can write the IP of AD server.

8
5. Go to Auth. Method > Add. Select the AD server you create.
6. Go to AP profile > SSID > Security List. Make sure the security list select the 802.1X
authentication and correct AD server. Since AD server doesn’t su ort EAP rotocol, so NXC
has built-in FreeRADIUS server rovide EAP rotocol for station authentication. The Radius
Ty e must select Internal when the external authenticated server is AD server.
If AD server installs IAS or NPS that su ort EAP rotocol, the radius server ty e of NXC
can be select External o tion.

9
7. Go to AP profile > SSID > SSID List. Check the security rofile with 802.1X authentication.

10
8. Check AP whether set the AP rofile that you created.
9. Check the AD server whether receive the information from NXC5500 and add the NXC5500
in the com uters list automatically.
Lightweight Directory Access Protocol (LDAP)