The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Tomasz Wolniewicz <twoln AT umk.pl>]

Could it be that you have two RADIUS servers running and only one has the new cert? If so then depending which one you hot you het an accept or reject.

Tomasz

W dniu 09.09.2019 o 20:50, Schwartz, Roger J pisze:

I get this during the test
eduroamTL dk Connected to eduroam.uthsc.edu.
elapsed time: 3381 ms.

Test partially successful: a bidirectional RADIUS conversation with multiple round-trips was carried out, and ended in an Access-Reject as planned. Some configuration errors were observed; the list is below.

  The certificate chain includes the root CA certificate. This does not serve any useful purpose but inflates the packet exchange, possibly leading to more round-trips and thus slower authentication.   At least one certificate is outside its validity period (not yet valid, or already expired)!   The EAP server name does not match any of the configured names in your profile!  

Subject: CN=eduroam.uthsc.edu,OU=ITS Network Services,O=University of Tennessee,street=800 Andy Holt Tower,L=Knoxville,ST=TN,postalCode=37996-1711,C=US Issuer:

This cert is no longer in use and I have uploaded the new certs with a new tool.
 eduroamTL nl Connected to ise-admin1.netsrv.uthsc.edu.
elapsed time: 15096 ms.

Test partially successful: a bidirectional RADIUS conversation with multiple round-trips was carried out, and ended in an Access-Reject as planned. Some properties of the connection attempt were sub-optimal; the list is below.

  The certificate chain includes the root CA certificate. This does not serve any useful purpose but inflates the packet exchange, possibly leading to more round-trips and thus slower authentication.   The certificate contained a CN or subjectAltName:DNS which contains a wildcard ('*'). This can be problematic on some supplicants. If the certificate also contains names which are wildcardless, and you only use those for your supplicant configuration, then you can safely ignore this notice. This is the correct information.
The live login fails, we are having some latency issues with our internet pipe.

Roger Schwartz
Senior Wireless Network Technician The University of Tennessee Health Science Center
Network Services
Alexander Building Room 724
877 Madison Ave
MEMPHIS, TN 38103
rschwart AT uthsc.edu
t: 901.448.2236

---

From: Tomasz Wolniewicz <twoln AT umk.pl>
Sent: Monday, September 9, 2019 1:39 PM
To: Schwartz, Roger J <rschwart AT uthsc.edu>; cat-users AT lists.geant.org <cat-users AT lists.geant.org>
Subject: [Ext] Re: [[cat-users]] Cisco WLC failing auth with cat tool

 

This really looks like a certificate mismatch problem. If you are an admin of your CAT IdP you could run the RADIUS tests from the admin interface and see what it tells you.

Tomasz

W dniu 09.09.2019 o 19:30, Schwartz, Roger J pisze:

I have created a new cat tool for our school as we are moving to Cisco ISE radius servers to authenticate. I am able to connect manually to eduroam, but using the cat tool I keep failing authentication. I have been using the cat tool to connect to our free-radius with no issues. Has anyone seen this or something like it?

Thanks Roger  

Roger Schwartz
Senior Wireless Network Technician The University of Tennessee Health Science Center
Network Services
Alexander Building Room 724
877 Madison Ave
MEMPHIS, TN 38103
rschwart AT uthsc.edu
t: 901.448.2236

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users

-- 
Tomasz Wolniewicz    
          twoln AT umk.pl        http://www.home.umk.pl/~twoln

Uczelniane Centrum Informatyczne   Information&Communication Technology Centre
Uniwersytet Mikolaja Kopernika     Nicolaus Copernicus University,
pl. Rapackiego 1, Torun               pl. Rapackiego 1, Torun, Poland
tel: +48-56-611-2750     fax: +48-56-622-1850       tel kom.: +48-693-032-576

-- 
Tomasz Wolniewicz    
          twoln AT umk.pl        http://www.home.umk.pl/~twoln

Uczelniane Centrum Informatyczne   Information&Communication Technology Centre
Uniwersytet Mikolaja Kopernika     Nicolaus Copernicus University,
pl. Rapackiego 1, Torun               pl. Rapackiego 1, Torun, Poland
tel: +48-56-611-2750     fax: +48-56-622-1850       tel kom.: +48-693-032-576