Clients connecting to APs through a Zyxel GS1920 not reaching the RADIUS server

Patrick_M
Patrick_M Posts: 9
First Comment
in Switch

I replaced my Cisco switch with a Zyxel GS1920. Figured out all the VLANs and internet is working great. The problem I am running into I have a Network Policy Server (NPS) to authenticate users to an employee network. This worked fine in the old Cisco switch, but now it stopped working. I added the IP to the NPS server and selected RADIUS standard. The RADIUS IP and port are added to AAA.

The guest network works fine, no authentication is required. It is only when I need to authenticate. Any ideas about what I could be missing?

Accepted Solution

All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,290  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @Patrick_M,

    Please reference this FAQ first to make sure the configuration is correctly set up.

    https://community.zyxel.com/en/discussion/12380/how-to-implement-compound-authentication-with-dynamic-vlan-assignment

    Zyxel Melen

    Engage in the Community, become an MVP, and win exclusive prizes!


  • Patrick_M
    Patrick_M Posts: 9
    First Comment

    So I followed the instructions. When I went to put the port authentication (802.1x) on, I added it to the switches. That broke my switches communicating with the server. Added the port authentication (802.1x) to the APs and it disconnected them.

    Do I need to add MAC authentication and Guest VLAN like the document says? I am only looking to use the 802.1x.

    I wondered if I needed to activate the port the server is on for Port Authentication 802.1x.

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,290  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @Patrick_M,

    You don't need to add MAC authentication since you only use 802.1xl. But you mentioned you have the guest network, so I recommend adding guest VLAN configuration. And you don't need to activate the server port for authentication since this port is a trusted port.

    By the way, could you provide some additional information about the scenario of your network? It would be helpful to know if there are both WiFi clients and clients connected via Ethernet cables, as well as whether all clients need to go through an authentication process.

    Zyxel Melen

    Engage in the Community, become an MVP, and win exclusive prizes!


  • Patrick_M
    Patrick_M Posts: 9
    First Comment

    The switch is in the server room so an overview of the devices connected.

    1. Firewall connected to port 1 with all the VLANs
    2. 2 servers on VLAN 10, connected through an ethernet cable on ports 2 and 3
    3. 4 access points connected to all VLANs on ports 21 to 24
    4. Several PCs for employees to use on VLAN 10
    5. 1 remote switch on port 45

    I will be adding a lot of devices in the future.

    I have Extreme access points and a mix of some computers/servers connecting to VLAN 10. Their PVID is set to 10. The Employee VLAN is 10, so I can access all the APs they communicate fine with IPs on the PVID 10.

    I have several SSIDs two that are used the most:

    Wifi-Employee (trying to get working with 802.1x) (VLAN 10)10.10.0.0/16

    The NPS server sits on port 5 of my switch and has an IP: 10.10.100.11

    Wifi-Guest (works fine) (VLAN 40) 192.168.30.0/24

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,290  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @Patrick_M,

    Thanks for the information. So, no matter the ethernet client or the WiFi client, if it tries to connect to employee VLAN 10, it needs to pass authentication, right?

    Could you provide your firmware version and current configuration to me? I can help to check what might be wrong.

    Zyxel Melen

    Engage in the Community, become an MVP, and win exclusive prizes!


  • Patrick_M
    Patrick_M Posts: 9
    First Comment
    edited June 2023

    Clients connecting through ethernet on VLAN10 are fine, its the ones who are tyring authenticate through the NPS server.

    Switch firmware: V4.70(ABMK.5) | 11/30/2021

    Been searching for an update without any luck.

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,290  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited July 2023

    Hi @Patrick_M,

    Layer 2 switch uses default management VLAN to send authentication packets.

    Please help to change your Default Management IP from VLAN 1 to VLAN 10.

    Zyxel Melen

    Engage in the Community, become an MVP, and win exclusive prizes!


  • Patrick_M
    Patrick_M Posts: 9
    First Comment

    Thanks will give that a try. I am trying one different thing I found. I think I had to add all the options for authentication to my Network Policy. My initial tests last night were successful I will see today when users start using the wifi, but will also look at the management port.

    network policy.png

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,290  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited July 2023 Answer ✓

    Hi @Patrick_M,

    Below is my NPS constraints setting for you to reference:

    image.png

    And you can also check the switch MAC table to check if the client passes authenticate or not. In your scenario, the client's MAC address will be listed in VLAN 10 once it passes authenticate.

    Zyxel Melen

    Engage in the Community, become an MVP, and win exclusive prizes!


Categories

Switch Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）