IT Toolbox
Guide

How to test RADIUS authentication

This BAOI guide provides a structured method for testing an authentication XXVI without multiplying unnecessary changes.

TopicStorage / NAS / SAN →
⌚ About 2 min read
View my favorites
& Security Network Intermediate. 15-30 min

This BAOI guide provides a structured method for testing an authentication XXVI without multiplying unnecessary changes.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Set perimeter

    Identify the equipment, service, affected users and start time.

  2. 2

    Collect Elements

    Record the exact messages, logs and useful settings.

  3. 3

    Test methodically

    Start with the basic dependencies before the application components.

  4. 4

    Apply correction

    Change only the identified parameter or component.

  5. 5

    Validate

    Rewrite the full scenario and document the result.

À retenir

  • Keep the initial values for a backwards.
  • Avoid multiple simultaneous changes.
  • Compare with a functional configuration when possible.
← All les guides
Technical deep dive

802.1X / WPA3 / RADIUS: identify the exact rejection stage

Technical checkpoints

  • In 802.1X, the supplicant, authenticator (AP/switch) and RADIUS server have distinct roles; RADIUS logs often identify the exact stage.
  • EAP-TLS validates the client certificate and trust in the server certificate; time, chain, EKU and revocation are critical.
  • WPA3-Personal uses SAE while WPA3-Enterprise relies on 802.1X/EAP; diagnostics therefore differ.

EAP chain

Compare a working client and a failing client, including certificates, then read the matching RADIUS log.

certutil -store -user My
# on RADIUS: record EAP type, reject reason and NAS

Topic-specific pitfalls

  • Disabling server certificate validation to “make EAP-TLS work” removes an essential protection.
  • A wrong RADIUS shared secret can look like a complete absence of valid requests on the server.

How to validate

  • The client validates the server certificate and RADIUS accepts the expected identity/certificate.
  • Post-authentication VLAN

Operational diagnosis

RADIUS troubleshooting requires matching the network-device request with the RADIUS-server decision. A reachable host does not prove that UDP authentication, shared secret or policy evaluation is correct.

Step-by-step checks

  1. Confirm the NAS/client IP configured on the RADIUS server matches the real source IP of requests.
  2. Verify UDP 1812/1813 path, shared secret and time synchronization.
  3. Correlate Access-Request events with Accept/Reject/Challenge responses and the exact policy reason.
  4. For 802.1X/EAP, validate certificate trust, EAP method and identity format independently from network reachability.

How to validate the fix

A controlled authentication must produce a matching request and explicit Accept on the RADIUS server, followed by the expected authorization on the network device.

Evidence to keep

Record NAS IP, username format, RADIUS event/request identifier, policy decision and EAP/certificate error if present.

Related BAOI resources: IT tools · procedures · IT dictionary.

♡ 0