Windows Radius Server - no RADIUS RX handler found

Hallo zusammen,

wir haben seit kurzen ein merkwürdiges Problem. Zum Aufbau:

Es gibt einen Radius Server und entfernte Standorte, welche per IPSEC Tunnel angebunden sind. An den einzelnen Standorten gibt es ein WLAN Zugang zum Intranet, welches per Radius (Zertifikat für die Clients oder für die User per Geschütztes EAP(PEAP) authentifiziert wird. Vorhanden sind Unifi APs und ein zentrale VM als Controller. Am selben Standort wie der Radius Server, nur ein anderes Subnetz. Im Unifi Controller ist der Radius Server als Profil hinterlegt und dem Wireless Network entsprechend zugewiesen.

Windows Radius Server -> Fortigate VM ---IPSEC Tunnel---> Standort (Lancom Router, Unifi APs)

Das ganze hat problemlos funktioniert, bis wir u.a. den Radius Server und Unifi Controller in ein neues RZ migriert haben. Die Netze sind gleich geblieben bzw. wurden mit umgezogen.

Seitdem klappt die Radiusauthentifizierung nicht mehr. Zu den Logs:

Ereignisanzeige Radiusserver (erfolglos zweiten Radiusserver gebaut, gleiches Phänomen)

Der Netzwerkrichtlinienserver hat einem Benutzer den Zugriff gewährt.

Fortigate Log, Anfrage geht also durch

id=20085 trace_id=3824 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=17, Unifi AP IP:40103->RADIUS IP:1812) from IPSEC TUNNEL NAME. "  
id=20085 trace_id=3824 func=resolve_ip_tuple_fast line=5905 msg="Find an existing session, id-164ecf27, original direction"  
id=20085 trace_id=3824 func=npu_handle_session44 line=1217 msg="Trying to offloading session from IPSEC TUNNEL NAME to vlanXX, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x03040000"  
id=20085 trace_id=3824 func=fw_forward_dirty_handler line=397 msg="state=00000204, state2=00000001, npu_state=03040000"  
id=20085 trace_id=3824 func=ipd_post_route_handler line=490 msg="out vlan23 vwl_zone_id 0, state2 0x1, quality 0.  

Wireshark Lancom

Frame 346: 316 bytes on wire (2528 bits), 316 bytes captured (2528 bits) on interface rpcap://Standort Lancom:2002/LAN-1, id 0
    Section number: 1
    Interface id: 0 (rpcap://Standort Lancom:2002/LAN-1)
        Interface name: rpcap://Standort Lancom:2002/LAN-1
    Encapsulation type: Ethernet (1)
    Arrival Time: Feb 13, 2023 23:31:41.993094000 Mitteleuropäische Zeit
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1676327501.993094000 seconds
    [Time delta from previous captured frame: 0.000631000 seconds]
    [Time delta from previous displayed frame: 23.484170000 seconds]
    [Time since reference or first frame: 53.752804000 seconds]
    Frame Number: 346
    Frame Length: 316 bytes (2528 bits)
    Capture Length: 316 bytes (2528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:radius:eap]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: Ubiquiti_0b:a1:d9 (Unifi MAC), Dst: LANCOM_12:3e:7b (LANCOM MAC)
    Destination: LANCOM_12:3e:7b (LANCOM MAC)
        Address: LANCOM_12:3e:7b (LANCOM MAC)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Ubiquiti_0b:a1:d9 (Unifi MAC)
        Address: Ubiquiti_0b:a1:d9 (Unifi MAC)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: UNIFI AP, Dst: RADIUS SERVER
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 302
    Identification: 0x3979 (14713)
    000. .... = Flags: 0x0
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set  
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 64
    Protocol: UDP (17)
    Header Checksum: 0xab0b [validation disabled]
    [Header checksum status: Unverified]
    Source Address: UNIFI AP
    Destination Address: RADIUS SERVER
User Datagram Protocol, Src Port: 40103, Dst Port: 1812
    Source Port: 40103
    Destination Port: 1812
    Length: 282
    Checksum: 0x5be9 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 3]
    [Timestamps]
        [Time since first frame: 41.965426000 seconds]
        [Time since previous frame: 41.943296000 seconds]
    UDP payload (274 bytes)
RADIUS Protocol
    Code: Access-Request (1)
    Packet identifier: 0x16 (22)
    Length: 274
    Authenticator: 0d55794cbce1212aca135ac0062680e8
    [The response to this request is in frame 348]
    Attribute Value Pairs
        AVP: t=User-Name(1) l=34 val=host/Client
            Type: 1
            Length: 34
            User-Name: host/Client
        AVP: t=NAS-IP-Address(4) l=6 val=UNIFI AP
            Type: 4
            Length: 6
            NAS-IP-Address: UNIFI AP
        AVP: t=NAS-Identifier(32) l=14 val=UNIFI WLAN MAC
            Type: 32
            Length: 14
            NAS-Identifier: UNIFI WLAN MAC
        AVP: t=Called-Station-Id(30) l=29 val=UNIFI WLAN MAC:WLAN SSID
            Type: 30
            Length: 29
            Called-Station-Id: UNIFI WLAN MAC:WLAN SSID
        AVP: t=NAS-Port-Type(61) l=6 val=Wireless-802.11(19)
            Type: 61
            Length: 6
            NAS-Port-Type: Wireless-802.11 (19)
        AVP: t=Service-Type(6) l=6 val=Framed(2)
            Type: 6
            Length: 6
            Service-Type: Framed (2)
        AVP: t=Calling-Station-Id(31) l=19 val=Client MAC
            Type: 31
            Length: 19
            Calling-Station-Id: Client MAC
        AVP: t=Connect-Info(77) l=23 val=CONNECT 0Mbps 802.11b
            Type: 77
            Length: 23
            Connect-Info: CONNECT 0Mbps 802.11b
        AVP: t=Acct-Session-Id(44) l=18 val=85DD4A37A4E6542C
            Type: 44
            Length: 18
            Acct-Session-Id: 85DD4A37A4E6542C
        AVP: t=Acct-Multi-Session-Id(50) l=18 val=3ECE924AEA01C44A
            Type: 50
            Length: 18
            Acct-Multi-Session-Id: 3ECE924AEA01C44A
        AVP: t=Unknown-Attribute(186) l=6 val=000fac04
            Type: 186
            Length: 6
            Unknown-Attribute: 000fac04
        AVP: t=Unknown-Attribute(187) l=6 val=000fac04
            Type: 187
            Length: 6
            Unknown-Attribute: 000fac04
        AVP: t=Unknown-Attribute(188) l=6 val=000fac01
            Type: 188
            Length: 6
            Unknown-Attribute: 000fac01
        AVP: t=Framed-MTU(12) l=6 val=1400
            Type: 12
            Length: 6
            Framed-MTU: 1400
        AVP: t=EAP-Message(79) l=39 Last Segment[1]
            Type: 79
            Length: 39
            EAP fragment: 0218002501686f73742f45462d5345434f2d4e4230312e4449414b4f4e49452e4c4f4341…
            Extensible Authentication Protocol
                Code: Response (2)
                Id: 24
                Length: 37
                Type: Identity (1)
                Identity: host/Client
        AVP: t=Message-Authenticator(80) l=18 val=Message-Authenticator
            Type: 80
            Length: 18
            Message-Authenticator: Message-Authenticator


Access-Accept

Frame 348: 108 bytes on wire (864 bits), 108 bytes captured (864 bits) on interface rpcap://Standort Lancom:2002/LAN-1, id 0
    Section number: 1
    Interface id: 0 (rpcap://Standort Lancom:2002/LAN-1)
        Interface name: rpcap://Standort Lancom:2002/LAN-1
    Encapsulation type: Ethernet (1)
    Arrival Time: Feb 13, 2023 23:31:42.014070000 Mitteleuropäische Zeit
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1676327502.014070000 seconds
    [Time delta from previous captured frame: 0.019964000 seconds]
    [Time delta from previous displayed frame: 0.020976000 seconds]
    [Time since reference or first frame: 53.773780000 seconds]
    Frame Number: 348
    Frame Length: 108 bytes (864 bits)
    Capture Length: 108 bytes (864 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:radius]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: LANCOM_12:3e:7b (LANCOM MAC), Dst: Ubiquiti_0b:a1:d9 (Unifi MAC)
    Destination: Ubiquiti_0b:a1:d9 (Unifi MAC)
        Address: Ubiquiti_0b:a1:d9 (Unifi MAC)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: LANCOM_12:3e:7b (LANCOM MAC)
        Address: LANCOM_12:3e:7b (LANCOM MAC)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: RADIUS SERVER, Dst: UNIFI AP
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 94
    Identification: 0x05f5 (1525)
    000. .... = Flags: 0x0
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set  
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 126
    Protocol: UDP (17)
    Header Checksum: 0xa15f [validation disabled]
    [Header checksum status: Unverified]
    Source Address: RADIUS SERVER
    Destination Address: UNIFI AP
User Datagram Protocol, Src Port: 1812, Dst Port: 40103
    Source Port: 1812
    Destination Port: 40103
    Length: 74
    Checksum: 0x4deb [unverified]
    [Checksum Status: Unverified]
    [Stream index: 3]
    [Timestamps]
        [Time since first frame: 41.986402000 seconds]
        [Time since previous frame: 0.020976000 seconds]
    UDP payload (66 bytes)
RADIUS Protocol
    Code: Access-Accept (2)
    Packet identifier: 0x16 (22)
    Length: 66
    Authenticator: c3e1f5417baf2023edff0f87d2c9f506
    [This is a response to a request in frame 346]
    [Time from request: 0.020976000 seconds]
    Attribute Value Pairs
        AVP: t=Class(25) l=46 val=74bf06d30000013700010200c0a8170c00000000000000000000000001d93ff2bbcfee76…
            Type: 25
            Length: 46
            Class: 74bf06d30000013700010200c0a8170c00000000000000000000000001d93ff2bbcfee76…

Syslog Server Unifi AP

Feb 13 23:20:16 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: kernel: [ 3467.805694]  ieee80211_ioctl_kickmac[10925]
Feb 13 23:20:16 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: kernel: [ 3467.805724] [UNSPECIFIED] vap-0(ath0):iwpriv[6538] ieee80211_ioctl_kickmac sta Client MAC
Feb 13 23:20:17 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1950]: ath0: STA Client MAC MLME: MLME-DEAUTHENTICATE.indication(Client MAC, 2)
Feb 13 23:20:17 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1950]: ath0: STA Client MAC MLME: MLME-DELETEKEYS.request(Client MAC)
Feb 13 23:20:19 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.1X: Sending EAP Packet (identifier 97)
Feb 13 23:20:20 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1950]: ath0: STA Client MAC IEEE 802.11: deauthenticated due to local deauth request
Feb 13 23:20:25 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.1X: Sending EAP Packet (identifier 97)
Feb 13 23:20:31 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: stahtd: stahtd[1948]: [STA-TRACKER].stahtd_dump_event(): {"message_type":"STA_ASSOC_TRACKER","mac":"Client MAC","event_type":"failure","vap":"ath6","assoc_delta":"0","auth_ts":"3467.400530","assoc_status":"0","auth_delta":"0","wpa_auth_failures":"1","avg_rssi":"-54","event_id":"6"}  
Feb 13 23:20:31 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: stahtd: stahtd[1948]: [STA-TRACKER].stahtd_dump_event(): {"event_id":"1","message_type":"STA_ASSOC_TRACKER","event_type":"fixup","mac":"Client MAC","vap":"ath7","assoc_status":"0","auth_failures":"1"}  
Feb 13 23:20:37 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.1X: Sending EAP Packet (identifier 97)
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.1X: received EAP packet (code=2 id=97 len=37) from STA: EAP Response-Identity (1)
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.1X: STA identity 'host/Clientname'  
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: RADIUS Sending RADIUS message to authentication server
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: RADIUS Next RADIUS client retransmit in 3 seconds
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: RADIUS Received 66 bytes from RADIUS server
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: RADIUS Received RADIUS message
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.02 sec
Feb 13 23:20:44 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC RADIUS: No RADIUS RX handler found (type=0 code=2 id=16) [INVALID AUTHENTICATOR] - dropping packet
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.11: sta_stats
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC RADIUS: updated TX/RX stats: rx_bytes=1544 [0:1544] tx_bytes=92 [0:92] bytes_64bit=0
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC IEEE 802.11: disassociated
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: hostapd[1955]: ath6: STA Client MAC WPA: event 2 notification
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: kernel: [ 3497.723629] peer_unmap_event (pdev:85148000) peer_id 8 peer 84164000 peer_mac Client MAC
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: kernel: [ 3497.723664] Deleting peer 84164000 (Client MAC)
Feb 13 23:20:46 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: : wevent[1947]: wevent.ubnt_custom_event(): EVENT_STA_LEAVE ath6: Client MAC / 1
Feb 13 23:20:47 AP NAME f492bf0ba1d9,UAP-AC-Mesh-6.2.49+14111: kernel: [ 3498.698021] [wifi1] FWLOG: [3600833] WLAN_DEBUG_DBGID_PEER ( 0xdead, 0x382ff2f6, 0x1 )

Das einzig auffällige ist die Meldung "No Radius RX handler found...dropping packet" - die Recherche dazu fällt aber nicht sehr umfangreich aus. Wir haben jetzt schon umfangreiche Tests durchgeführt, aber bisher erfolglos und langsam gehen uns die Ideen aus. Die Konstruktion lief bis zum Umzug in ein neues RZ. Der einzige Unterschied sind jetzt unterschiedliche Zwischenhops und die neue Fortigate VM.

Vielleicht hat ja hier jemand einen Ansatzpunkt?

Vielen Dank im Vorraus.

Bitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben

Content-ID: 6019601482

Url: https://administrator.de/forum/windows-radius-server-no-radius-rx-handler-found-6019601482.html

Ausgedruckt am: 02.06.2025 um 11:06 Uhr

2 Kommentare

Neuester Kommentar

Hallo,

kurzer Nachtrag. Wenn ich das WLAN über den Lancom ausstrahle und dort eine RADIUS Weiterleitung einrichte, dann erhalte ich auch keinen Zugriff. Auf dem Client bekomme ich die Meldung "Keine Verbindung mit diesem Netzwerk möglich" - auf dem NPS wird mir mitgeteilt, dass dem Benutzer Zugriff erteilt wurden ist.

Gruß