Windows Server 2019 Event ID 17 - An Access-Request message was received from RADIUS client 192.168.xxx.xxx without a Message-Authenticator attribute when a Message-Authenticator attribute is required.

Question

Hi Everyone,

While setting up our Radius server to be used as an authenticator for verifying VPN access, we got this error, "An Access-Request message was received from RADIUS client 192.168.254.254 without a Message-Authenticator attribute when a Message-Authenticator attribute is required. Verify the configuration of the RADIUS client in the Network Policy Server snap-in (the "Client must always send the Message-Authenticator attribute in the request" checkbox) and the configuration of the network access server."

The thing is, when we go to Network Policy Server > RADIUS Clients and Servers > Radius Clients > Radius Client > Radius Client Properties > Advanced, "Access-Request message must contain the Message-Authenticator attribute" is already enabled with a checkmark.

We're following Cisco's procedure for setting up a 2FA using Duo and a RADIUS server from this link below and this is what we've run into.

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances

Any assistance is greatly appreciated.

Thank you very much,

Sonny B

Answer 1

You need to disable the checkbox "Access-Request message must contain the Message-Authenticator attribute" for that RADIUS client in NPS.

Because the Meraki MX (per Cisco/Meraki documentation) does not include the Message-Authenticator attribute in its RADIUS requests. If NPS requires it, you'll get this exact error.

Even if you're using Duo as the 2FA middleware between Meraki and NPS, Duo only proxies the RADIUS requests, and it can’t inject the Message-Authenticator header into a message that never had it to begin with.

Get access to your NPS server then flow these steps bellow:

• Open Network Policy Server.
• Go to RADIUS Clients and Servers > RADIUS Clients.
• Right-click the RADIUS Client (your Meraki device).
• Choose Properties > Advanced tab.
• Uncheck "Access-Request messages must contain the Message-Authenticator attribute".
• Click OK and restart the NPS service (optional but recommended).

Answer 2

Hi Joseph,

Wow! Thank you very much.

Now, I'm getting an Event 6273 Reason 16 Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

So I'll create a new post for this new error then.

Thank you very much,

Sonny B

Answer 3

Hi, so did you fix it with my solution yet ? And does the Windows Server working fine by now ?