Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm having trouble getting multiple devices to establish a WiFi connection when they use the same authentication details. Here's a bit about my wireless setup:

  • Single access point using WPA2 Enterprise (802.1X) -- Linksys WAP4400N (yep it's pretty old).
  • 802.1X authentication is PEAP, 2nd phase authentication is EAP-MSCHAPv2 or certificate.
  • RADIUS server is Network Policy Server from Windows Server 2008 R2.
  • Users authenticate against an Active Directory, anyone active in the Domain Users group is allowed in.
  • Wireless devices include Windows 7, two iPhones, and two Android tablets. Not all of these are mine.

The issue is that if the same user (because the device belongs to the same person) tries to authenticate on two devices at a time only the first device that authenticated will get a working WiFi connection. Although the subsequent devices will claim that 802.1X authentication has been successful (as mirrored in the Windows security event log) it will always fail to retrieve an IP address from DHCP.

None of the devices also claim that 802.1X authentication has failed, they just stick on "obtaining IP address" for a while then fail blaming poor connectivity. The Windows security event log doesn't show any authentication failures. Setting a static IP address doesn't resolve this; a WiFi connection will claim to be established, but no data will flow.

I'm wondering if it's the access point at fault, or if the way I'm authenticating is ill advised? On the face of it, it would appear that the access point isn't happy with two supplicants using the same user credentials, but then I was under the impression the access point has no say in this. Isn't the access point (authenticator) merely supposed to be a bridge between the supplicant and authentication server?

Perhaps I should be issuing each device with its' own certificate then use EAP-TLS or PEAP with phase 2 certificates instead. I don't really want to go making new users for each person on a separate WiFi device as that defeats the purpose of what a user is, plus the device MAC address is fully logged so it's not like I couldn't see which devices are authenticating anyway.

share|improve this question
1  
It would be interesting to see a packet trace of the RADIUS session, to see if the Access-Accept really gets sent, and whether the MPPE-Key message ever gets sent. –  Spiff Mar 31 '14 at 16:39
    
Just used Wireshark on the Windows server (hosting RADIUS and DHCP) to find out. Yes the Access-Accept packet is being dispatched, not seeing an MPPE-Key though. DHCP discover packet is also being received, and a DHCP offer packet is immediately being dispatched with the expected details. These DHCP messages then just loop infinitely about a second or so apart. –  Adambean Apr 1 '14 at 21:19
    
Also suddenly EVERYTHING WORKS, but don't worry, I'm sure it won't for long. Just tried with 2 iPhones here (one as me, one as someone else) and an Android tablet (as me). All got an IP address instantly from DHCP too... –  Adambean Apr 1 '14 at 21:26
1  
Sorry, my memory failed me. The key isn't sent in a separate RADIUS message, it's sent as an "MS-MPPE-Recv-Key attribute" in the Access-Accept. It would be interesting to know if the RADIUS server is sometimes sending Access-Accepts that don't have a valid MS-MPPE-Recv-Key attribute in them. –  Spiff Apr 1 '14 at 21:38
    
Ah found the attribute. It's present, but everything is working right now (still). I'll probably need to wait for it to break mysteriously again... –  Adambean Apr 2 '14 at 10:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.