802.1x and DHCP Failure

From: RogerC (rojoch_at_NOSPAMtiscali.co.uk)
Date: 04/13/04 

Date: Tue, 13 Apr 2004 01:06:35 +0100

Hi,
I am trying to setup radius authentication. Having failed on our production
network I have set up a test setup consisting of a 2003 standard sever and a
laptop running XP sp1.
I have applied all service packs/updates I can find.
I have tried both Dlink 900AP and 2000AP's and Dlink 650+ & G650 PCMCIA
cards, all with the latest drivers.
The laptop logs on and obtains an ip address correctly using a wired
connection.

When connecting by wireless I always get an Automatic Private IP Addressing
(APIPA)

In the TechNet article "Troubleshooting Windows XP IEEE 802.11 Wireless
Access" it states:
"If the wireless adapter has an Automatic Private IP Addressing (APIPA)
address (169.254.0.0/16) or the configured alternate IP address, then
authentication has failed and the Windows XP wireless client is still
associated with the wireless AP" but the IAS log and AP log indicate that
authentication was successful.
I have tried everything but to no avail!
Any help greatly appreciated!

RogerC
Test setup:-
The test domain is 'ROGERDOM', server 'win2k3s' and laptop 'ROGERLAP' and
user logon of rogerc.
Server Event Log entries:

Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 11/04/2004
Time: 01:04:34
User: N/A
Computer: WIN2K3S
Description:
User host/ROGERLAP.rogerdom.com was granted access.
 Fully-Qualified-User-Name = rogerdom.com/Computers/ROGERLAP
 NAS-IP-Address = 192.168.8.50
 NAS-Identifier = MY-DWL-900AP+
 Client-Friendly-Name = 900AP
 Client-IP-Address = 192.168.8.50
 Calling-Station-Identifier = 00-80-C8-07-11-47
 NAS-Port-Type = Wireless - IEEE 802.11
 NAS-Port = 0
 Proxy-Policy-Name = Use Windows authentication for all users
 Authentication-Provider = Windows
 Authentication-Server = <undetermined>
 Policy-Name = WIRELESS access policy
 Authentication-Type = PEAP
 EAP-Type = Secured password (EAP-MSCHAP v2)

Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 11/04/2004
Time: 01:08:02
User: N/A
Computer: WIN2K3S
Description:
User ROGERDOM\rogerc was granted access.
 Fully-Qualified-User-Name = rogerdom.com/My Users/Roger xxxxxx
 NAS-IP-Address = 192.168.8.50
 NAS-Identifier = MY-DWL-900AP+
 Client-Friendly-Name = 900AP
 Client-IP-Address = 192.168.8.50
 Calling-Station-Identifier = 00-80-C8-07-11-47
 NAS-Port-Type = Wireless - IEEE 802.11
 NAS-Port = 0
 Proxy-Policy-Name = Use Windows authentication for all users
 Authentication-Provider = Windows
 Authentication-Server = <undetermined>
 Policy-Name = WIRELESS access policy
 Authentication-Type = PEAP
 EAP-Type = Secured password (EAP-MSCHAP v2)

AP log:

Apr/13/2004 00:03:04 Send Accounting login message ROGERDOM\rogerc
Apr/13/2004 00:03:03 Authentication success 00-80-C8-07-11-47
Apr/13/2004 00:03:03 EAP-Success 00-80-C8-07-11-47
Apr/13/2004 00:02:53 EAP-Response/Identity ROGERDOM\rogerc
Apr/13/2004 00:02:53 EAP-Request/Identity
Apr/13/2004 00:02:53 Wireless PC connected 00-80-C8-07-11-47
Apr/13/2004 00:02:45 EAP-Response/Identity ROGERDOM\rogerc

Relevant Pages

  • RE: Wireless Security Notes and Findings (from this list and other places)
    ... There are two general areas of wireless security: Authentication and ... authentication standard that works with wireless networks. ... client computer runs a client program to connect to the network with a ...
    (Security-Basics)
  • Re: Why wireless connection needs refresh (every 5 minutes) ?
    ... > If you have other wireless APs nearby, you may need to stop the Wireless ... UN-CHECKING THE EVIL IEEE AUTHENTICATION was an immediate ... "Windows XP uses a Connect to Wireless Network ...
    (microsoft.public.windowsxp.network_web)
  • PEAP authentication very Slow!!!!!!!
    ... I am using PEAP authentication on Windows XP service Pack1 for wireless ... server on Windows 2000 server service Pack 4. ...
    (microsoft.public.internet.radius)
  • Re: wireless network disconnects when using IEEE 802.1x authentica
    ... since it gets encrypted before it leaves the wireless NIC ... For a home network or small ... >> Change that authentication key say every six months. ... >> RADIUS server to do that, and it works best if you've got an Active ...
    (microsoft.public.windowsxp.security_admin)
  • WLAN authentication sometimes fail
    ... I have set up a wireless network in our office. ... Enabled authentication for MS-CHAP v2 and EAP method PEAP ... Windows XP SP2 that is not a member of the domain. ... Wireless configuration, WPA, TKIP, PEAP and unchecked "use windows default logon" ...
    (microsoft.public.internet.radius)