We use a computer running Windows Server 2008 (32-bit) with the RRAS and NPS roles to authenticate users for VPN and wireless access over RADIUS.
This configuration has been working great for more than a year, but starting this morning the server has started denying all requests. As far as I know, the only change was installing Windows Updates last night.
- It isn't a connectivity or firewall problem. The server replying to all RADIUS requests with Access-Reject.
- There is only one connection request policy, and it processes all requests on this server 24/7.
- For testing purposes, I have created one network policy that should approve all requests 24/7. The log file (
C:\Windows\System32\LogFiles\IN1110.log) indicates that this policy is being selected, but the server still replies with Access-Reject. - I have verified that all servers which send RADIUS requests are listed in the RADIUS clients, and there are no entries in the event log about invalid RADIUS clients.
However, I am seeing a strange System event being logged each time the server responds to a RADIUS request. We don't use MGM or multicast at all, so I don't know how to track this down.
Warning
RasServer, 50015
Specified interface was not present in MGM.
I have already tried rebooting the server, and reinstalling RRAS/NPS. (Side note: when removing NPS, all configuration is preserved, and is still present after the reinstall.) Short of setting up a completely new server, I'm at my wits end.
Has anybody else had problems like this with RRAS/NPS?
2011-10-17 Update: Added the complete text of Event ID 6274
Network Policy Server discarded the request for a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID: CFL\nic
Account Name: nic
Account Domain: CFL
Fully Qualified Account Name: cfl.local/People/Prince George/Nic Waller
Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
OS-Version: -
Called Station Identifier: 00-17-9A-09-A8-1D:CFL
Calling Station Identifier: CC-08-E0-EE-BA-82
NAS:
NAS IPv4 Address: 192.168.123.12
NAS IPv6 Address: -
NAS Identifier: D-Link Access Point
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 1
RADIUS Client:
Client Friendly Name: DWL-7100AP Wireless Access Point
Client IP Address: 192.168.123.12
Authentication Details:
Proxy Policy Name: Always authenticate requests on this server
Network Policy Name: Permit wireless RADIUS via EAP DWL-7100AP
Authentication Provider: Windows
Authentication Server: PG-DC2.cfl.local
Authentication Type: EAP
EAP Type: -
Account Session Identifier: -
Reason Code: 1
Reason: An internal error occurred. Check the system event log for additional information.
Update: Actually, some requests are being approved. It looks only only 802.1x requests with the EAP authentication type are failing. Upon looking at the certificate situation, it looks like the server's certificate had expired and was preventing PEAP authentication.
