Hi folks,

I've followed suggestions in an earlier post regarding using certificated
wireless access following the guidelines at Configuring Secure Wireless
Network Access with Microsoft® Windows® Small Business Server 2003
http://home.comcast.net/~clearviewtc/ however I am now getting
authentication failed. I'm trying to fathom out why this could be but
really am not getting anywhere.

Also possibly related to this, companyweb sharepoint site has stopped work
:(

Ruth

Re: Using Certificated Wireless - Authentication Failed? by Dave

Dave
Thu Mar 27 07:51:45 PDT 2008

You've gone through that document step-by-step to verify that every setting
matches exactly?

Two things come to mind that can cause authentication failures.

- Certificate auto-enrollment might have failed on the wireless laptop. You
generally have to log in while connected to the wired network the first
time, to get the certificate to install. I would try connecting to wired,
then starting the laptop and logging in. If auto-enrollment fails, it will
log the failure in the laptop's Application log, so you could look there.
I'm not sure if it logs success, but you can also look for the certificate
in Internet Options -> Content tab -> Certificates. It should be under
trusted root certification authorities.

- Verify that you have selected the exact same wireless connection options
everywhere. Things like WPA, TKIP, etc. have to match everywhere you set
them. For example, if you set WPA one place and WPA2 another, or TKIP one
place and AES another, authentication will fail.

Another suggestion would be to go to IAS on the server. R-click the very
top item, Internet Authentication Service (Local) -> Properties. On the
first tab, turn on the additional logging. After a failed authentication,
look in the system log on the SBS to see if IAS rejected the request. If
so, the error message might be useful. If not, the problem is likely either
on the wireless access point or the laptop.

"Ruth Cheesley suffolkcomputerservices co (dot) uk>" <newsgroup<atdot> wrote
in message news:e5VxPt$jIHA.6136@TK2MSFTNGP03.phx.gbl...
> Hi folks,
>
> I've followed suggestions in an earlier post regarding using certificated
> wireless access following the guidelines at Configuring Secure Wireless
> Network Access with Microsoft® Windows® Small Business Server 2003
> http://home.comcast.net/~clearviewtc/ however I am now getting
> authentication failed. I'm trying to fathom out why this could be but
> really am not getting anywhere.
>
> Also possibly related to this, companyweb sharepoint site has stopped work
> :(
>
> Ruth
>


Re: Using Certificated Wireless - Authentication Failed? by Ruth

Ruth
Thu Mar 27 15:44:16 PDT 2008

Dave,

Many thanks for the information. I checked the logs and it is receiving
auto-enrollment successfully. I followed the instructions to the letter
(they were brilliant, very well written and covered every single check box
unlike some tutorials/guides I've used in the past!). I have the laptop
wired at the moment. I've set it to WPA TKIP (the router/AP doesn't support
AES).

I am currently working back through the documentation to check that I did
not miss anything or incorrectly enter the info.

I found out why Sharepoint stopped working - web publishing had been stopped
when doing the IAS installation - restarted it and companyweb came back
online!

Kind Regards,

Ruth Cheesley

"Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in message
news:98C4F7C2-64EB-4D84-A599-3FF04F1B9CD2@microsoft.com...
> You've gone through that document step-by-step to verify that every
> setting matches exactly?
>
> Two things come to mind that can cause authentication failures.
>
> - Certificate auto-enrollment might have failed on the wireless laptop.
> You generally have to log in while connected to the wired network the
> first time, to get the certificate to install. I would try connecting to
> wired, then starting the laptop and logging in. If auto-enrollment fails,
> it will log the failure in the laptop's Application log, so you could look
> there. I'm not sure if it logs success, but you can also look for the
> certificate in Internet Options -> Content tab -> Certificates. It should
> be under trusted root certification authorities.
>
> - Verify that you have selected the exact same wireless connection options
> everywhere. Things like WPA, TKIP, etc. have to match everywhere you set
> them. For example, if you set WPA one place and WPA2 another, or TKIP one
> place and AES another, authentication will fail.
>
> Another suggestion would be to go to IAS on the server. R-click the very
> top item, Internet Authentication Service (Local) -> Properties. On the
> first tab, turn on the additional logging. After a failed authentication,
> look in the system log on the SBS to see if IAS rejected the request. If
> so, the error message might be useful. If not, the problem is likely
> either on the wireless access point or the laptop.
>
> "Ruth Cheesley suffolkcomputerservices co (dot) uk>" <newsgroup<atdot>
> wrote in message news:e5VxPt$jIHA.6136@TK2MSFTNGP03.phx.gbl...
>> Hi folks,
>>
>> I've followed suggestions in an earlier post regarding using certificated
>> wireless access following the guidelines at Configuring Secure Wireless
>> Network Access with Microsoft® Windows® Small Business Server 2003
>> http://home.comcast.net/~clearviewtc/ however I am now getting
>> authentication failed. I'm trying to fathom out why this could be but
>> really am not getting anywhere.
>>
>> Also possibly related to this, companyweb sharepoint site has stopped
>> work :(
>>
>> Ruth
>>
>



Re: Using Certificated Wireless - Authentication Failed? by Owen

Owen
Fri Mar 28 13:58:38 PDT 2008

In article <e7AiZwFkIHA.4536@TK2MSFTNGP06.phx.gbl>, "Ruth Cheesley"
<newsgroup<at>suffolkcomputerservices<dot>co(dot)uk> says...

> Many thanks for the information. I checked the logs and it is receiving
> auto-enrollment successfully. I followed the instructions to the letter
> (they were brilliant, very well written and covered every single check box
> unlike some tutorials/guides I've used in the past!). I have the laptop
> wired at the moment. I've set it to WPA TKIP (the router/AP doesn't support
> AES).
>
> I am currently working back through the documentation to check that I did
> not miss anything or incorrectly enter the info.

Hello, Ruth. Thank you for the kind words.

As Dave says, the most common problem when the configuration does not
work is a wrong setting somewhere. As you know, there are a LOT of
settings and they all have to be exactly right. It's easy to make a
mistake - been there, done that! So that's the first thing to check.

If you verify every setting and it still doesn't work ... I have on rare
occasions seen cases where authentication failures occur when the
wireless signal is not of sufficient strength or quality. For example, I
had a client in an older building with many thick plaster walls, metal
duct work, and similar. With the wireless computer in the same room as
the WAP, it authenticated almost immediately. When I moved the computer
a few offices down (separated by several walls/doors), I could not get
the PC to authenticate to save my life. Long story short, the client
ended up running an Ethernet cable.

I had a similar situation in my own home (in which I run an SBS using
the certificate-based security). My laptop worked fine in the house but
was flakey outside on my deck. The house has aluminum siding and the
signal strength was MUCH weaker outside. I had to fiddle with the WAP
settings (mostly trying single-mode 802.11g rather than mixed g+n) to
get that working.

Signal strengths can vary greatly with only slight reorientations of the
wireless computer and/or WAP. I was setting up an in-home wireless
network for a client. Sitting in a swivel chair with the laptop in my
lap, the signal strength was Very Good to Excellent ... until I swiveled
90 degrees, when it dropped to Poor!

So, don't give up and don't be afraid to "tweak" things a bit.

-- Owen Williams [SBS MVP]

Re: Using Certificated Wireless - Authentication Failed? by Ruth

Ruth
Fri Mar 28 14:43:51 PDT 2008

Owen,

Thank you for your advice - indeed i am inclined to come to the same
conclusion - that or it's getting interference from somewhere - it's a
catering firm so could be anything. Most likely suspect is very old
cordless phones. Could also be the fact that it's a fairly old router ..
plastic and tacky!

The WAP is on top of the server, under a desk, however the laptops are both
within 10m of the WAP - literally just a desk or two apart - so I wouldn't
have thought it would be weak signal strength (they're both getting 5/5
bars).

I might try changing the wifi channel, and see if this makes any difference.
I know it's picking up the GPO's ok as I've checked in the event viewer and
I can see the certificate there. For now I've told them to use a wire when
in the office, as I am away for a week, but I will want to resolve this asap
on my return!

Many thanks to everyone for your help with these issues, it makes things so
much easier to have a pool of people who've been there and done that
numerous times before!

Kind Regards,

Ruth Cheesley


"Owen Williams [SBS MVP]" <Owen@NoSpam_CVTCLLC.com> wrote in message
news:MPG.225726088e72adcf9896b3@news.microsoft.com...
> In article <e7AiZwFkIHA.4536@TK2MSFTNGP06.phx.gbl>, "Ruth Cheesley"
> <newsgroup<at>suffolkcomputerservices<dot>co(dot)uk> says...
>
>> Many thanks for the information. I checked the logs and it is receiving
>> auto-enrollment successfully. I followed the instructions to the letter
>> (they were brilliant, very well written and covered every single check
>> box
>> unlike some tutorials/guides I've used in the past!). I have the laptop
>> wired at the moment. I've set it to WPA TKIP (the router/AP doesn't
>> support
>> AES).
>>
>> I am currently working back through the documentation to check that I did
>> not miss anything or incorrectly enter the info.
>
> Hello, Ruth. Thank you for the kind words.
>
> As Dave says, the most common problem when the configuration does not
> work is a wrong setting somewhere. As you know, there are a LOT of
> settings and they all have to be exactly right. It's easy to make a
> mistake - been there, done that! So that's the first thing to check.
>
> If you verify every setting and it still doesn't work ... I have on rare
> occasions seen cases where authentication failures occur when the
> wireless signal is not of sufficient strength or quality. For example, I
> had a client in an older building with many thick plaster walls, metal
> duct work, and similar. With the wireless computer in the same room as
> the WAP, it authenticated almost immediately. When I moved the computer
> a few offices down (separated by several walls/doors), I could not get
> the PC to authenticate to save my life. Long story short, the client
> ended up running an Ethernet cable.
>
> I had a similar situation in my own home (in which I run an SBS using
> the certificate-based security). My laptop worked fine in the house but
> was flakey outside on my deck. The house has aluminum siding and the
> signal strength was MUCH weaker outside. I had to fiddle with the WAP
> settings (mostly trying single-mode 802.11g rather than mixed g+n) to
> get that working.
>
> Signal strengths can vary greatly with only slight reorientations of the
> wireless computer and/or WAP. I was setting up an in-home wireless
> network for a client. Sitting in a swivel chair with the laptop in my
> lap, the signal strength was Very Good to Excellent ... until I swiveled
> 90 degrees, when it dropped to Poor!
>
> So, don't give up and don't be afraid to "tweak" things a bit.
>
> -- Owen Williams [SBS MVP]



Re: Using Certificated Wireless - Authentication Failed? by Owen

Owen
Fri Mar 28 20:55:56 PDT 2008

In article <ujmoTzRkIHA.5088@TK2MSFTNGP02.phx.gbl>, "Ruth Cheesley"
<newsgroup<at>suffolkcomputerservices<dot>co(dot)uk> says...

> Thank you for your advice - indeed i am inclined to come to the same
> conclusion - that or it's getting interference from somewhere - it's a
> catering firm so could be anything. Most likely suspect is very old
> cordless phones. Could also be the fact that it's a fairly old router ..
> plastic and tacky!
>
> The WAP is on top of the server, under a desk, however the laptops are both
> within 10m of the WAP - literally just a desk or two apart - so I wouldn't
> have thought it would be weak signal strength (they're both getting 5/5
> bars).
>
> I might try changing the wifi channel, and see if this makes any difference.
> I know it's picking up the GPO's ok as I've checked in the event viewer and
> I can see the certificate there. For now I've told them to use a wire when
> in the office, as I am away for a week, but I will want to resolve this asap
> on my return!

The example I gave of the old building with the thick walls ... the
wireless PC was showing 5 bars there. It was apparently a signal QUALITY
issue rather than STRENGTH. Cordless 2.4GHz phones can be deadly to
802.11b/g/n. In theory, microwave ovens as well, though I've never
personally seen that. But this is a catering firm ...

The firm's WAP placement is far from ideal. A catering firm sounds like
it might have a lot of metal around! In general, placing the WAP "as
high as possible" is a good rule of thumb. The best starting position
for adjustable omnidirectional antennas is usually perfectly vertical
since the dispersion pattern is a similar to a donut. If that's no help,
try one vertical and one horizontal.

What's the desk made of? If there's metal it could be causing problems.
Ditto being so close to a server. Commercial-grade servers (at least in
the U.S.) may not have to meet radio emissions regulations. For example,
I know some Dell servers are not approved for use in residential
environments for this reason.

As for channels ... download NetStumbler
(http://www.netstumbler.com/downloads) which will display all detected
wireless networks, their channels, and signal strengths. I have solved a
couple of "failure to connect" problems with this, though mostly in
homes. At one client's townhouse I discovered 12(!) wireless networks on
the same channel he was using. Changed his WAP to a channel that was not
in use and several channels away from the in-use ones; problem solved.

You mentioned you have an older WAP. Many newer ones solve the channel
issue by having an "auto-select" setting. The WAP sniffs what channels
are in use and picks one that's not. This is dynamic: the WAP will
change channels on-the-fly if the channel it had been using starts
having interference problems.

From time to time I have also seen WAPs that SEEMED to be transmitting
OK but I still could not connect. In one case I had to explicitly
disable then enable the radio. Simply power-cycling the device did not
work! And I've seen a couple of cases where replacing the WAP was the
solution.

Good luck!

-- Owen Williams [SBS MVP]