NPS Network Policy

Question

I am trying to setup a NPS that uses RADIUS for our Wi-Fi. The logon name and password should be the computers MAC address. I have created the new user in AD with the mac as the account name and password. The computer tries to connect to the Wi-Fi, and the logs show it giving the right information. I get my connection request policy back, but the Network Policy will not show up in the log. Therefore, the computer cannot get connected to Wi-Fi.

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:

	Security ID:			Domain\60452e38fb8a

	Account Name:			60452e38fb8a

	Account Domain:			Domain

	Fully Qualified Account Name:	Domain\60452e38fb8a

Client Machine:

	Security ID:			NULL SID

	Account Name:			-

	Fully Qualified Account Name:	-

	Called Station Identifier:		10f3119946a0

	Calling Station Identifier:		60452e38fb8a

NAS:

	NAS IPv4 Address:		10.x.x.12

	NAS IPv6 Address:		-

	NAS Identifier:			2504

	NAS Port-Type:			Wireless - IEEE 802.11

	NAS Port:			1

RADIUS Client:

	Client Friendly Name:		WLC

	Client IP Address:			10.x.x.12

Authentication Details:

	Connection Request Policy Name:	Secure Wireless Connections

	Network Policy Name:		-

	Authentication Provider:		Windows

	Authentication Server:		SERVER2.Domain

	Authentication Type:		PAP

	EAP Type:			-

	Account Session Identifier:		36363930303739392F36303A34353A32653A33383A66623A38612F32313137

	Logging Results:			Accounting information was written to the local log file.

	Reason Code:			48

	Reason:				The connection request did not match any configured network policy.

Here is my Network Policy - "MAC Authentication Policy":

Conditions:
NAS Port Type Wifeless - IEEE 802.11

Calling Station ID    XXXXXXXXXXXX

Windows Groups  Domain\Wifi-MAC-filtering

Settings:

Authentication Method Unencrypted authentication (PAP,SPAP)

Access Permission Grant Access

Framed-Protocol PPP

Service-Type Framed
Encryption Policy Disabled

I think I need help forming the Network Policy. Any help would be appreciated.

Answer 1

Hello Chris,

We seem to be at cross-purposes.

If the network is "open" and the client has never encountered it before, then it should connect without any problem (assuming that the MAC Authentication Bypass works).

I assumed that your test client had encountered the network before or had been configured with a profile specifying 802.1X authentication (you mentioned that you had connected with an explicit MAC-style username and password).

Gary

Answer 2

I did connect using username and password, then promptly forgot it. I am trying to figure out how to set the connection up to not have to touch every device to change the settings manually and how to get it not to request username and password but just use the MAC provided.

Answer 3

Gary,

As well even with the 802.1x it still doesn't connect.

Answer 4

I figured out what my issue was, I needed to set the SSID to PSK instead of 802.1x, this allows them to use a standard pass phrase but if the user is not in the NPS as authorized it denies them.

Answer 5

Hello Chris,

Is the WiFi network "open"? I believe that that is essential.

If the network is not "open" then Windows clients will at least try to authenticate and probably prompt for credentials.

Gary