This section is a subset of mbox HSG troubleshooting guide. Many times we know that mbox is properly configured and hotspot service is running fine, but somehow users are experiencing login issues, so it’s faster to jump straight to focus on authentication issues.

This guide focuses on concept of troubleshooting authentication issues is applicable to other scenarios, eg. private portal with private user database, self-registered database, social media integrations, or external API etc.

mbox HSG has build in RADIUS server that provides user/client authentication for both local hotspot services or external Wireless LAN Controllers (WLC). Sometimes it’s also called User Access Manager (UAM). Details. 

For mbox UAM server to successfully authenticate user access, there’re a few prerequisites:

• 1. mbox RADIUS client must be added (local and WLC)

  2. mbox RADIUS proxy must be configured

  3. use mbox swiss-knife - tcpdump

TESTING & TROUBLESHOOTING STEPS

1. mbox RADIUS clients must be added

Wireless@SG services includes both Wireless@SG (WSG) SSID and Wireless@SGx (WSGx) SSID. These two are essentially two different type of services.

WSG is an open SSID, where clients are immediately associated to wireless SSID, WLC relays client DHCP requests to mboxx and clients are assigned with IP addresses immediately. Only when clients try to browse Internet, their browser is redirected/prompted with WSG login portal, asking for login credentials. Once the correntials is entered, it’s passed to mbox access controller, which forwards authentication requests to mbox RADIUS server. Checkout this concept here. 

In this scenario, mbox localhost must be configured as its own RADIUS Server’s RADIUS client (local access controller “talks” to local RADIUS).

User ---- AP ----WLC ---- [ mbox access controller (RADIUS client) ----mbox RADIUS (RADIUS server)] 

WSGx is using WPA-EAP for wireless authentication, where clients are first prompted by WLC to authenticate via 801x protocol, and only if authentication is successful, WLC will relay client DHCp requests to mbox for address assignment. When WLC prompts user for authentication, WLC does not validate client credentials instead it forwards to mbox and it’s processed by mbox RADIUS server. Once user is authenticated and assigned with IP address, they can access Internet directly without being redirected to login portal again (therefore no mbox access controller involved). NOTE: In the case of EAP-SIM, the concept is the same, except user credentials are automatically forwarded by phone using SIM card IMEI details.

User ---- AP ----WLC (RADIUS client)---- [mbox RADIUS (RADIUS server)]

To add a RADIUS client config, three parameters are needed:

• • IP address of RADIUS client

  • Pre-shared key

  • Name of client

Below are the checking/troubleshooting we need to take to validate if RADIUS clients are added:

NOTE:

• • “testing123” is the pre-shared key configured between RADIUS server and RADIUS client and must be configured the same on all WLC

  • “192.168.16.” are the WLC ip addresses, they must be able to reach mbox LAN interface IP via those address

  • “firewall-input” rules open local port access for external hosts/WLC to communicate with mbox using RADIUS protocols. We can potentially restrict to individual WLC host IP for tighter security.

2. mbox RADIUS proxy must be configured

mbox RADIUS appears to be a RADIUS server to both its own access controller (eg. WSG) and WLC (eg. WSGx), however for Wireless@SG services, mbox RADIUS does not host any real user accounts, instead it “proxies” all user authentication requests to external ISP RADIUS server.

In this case, mbox is added as a RADIUS client on ISP RADIUS server, and ISP RADIUS server is added as a RADIUS proxy on mbox.

[ mbox RADIUS (RADIUS server)] ------- ISP RADIUS (RADIUS proxy)

To add a RADIUS proxy config, three parameters are needed:

• • IP address of remote ISP RADIUS server

  • Pre-shared key

  • Realm

NOTE: mbox needs to be configured as a RADIUS client on ISP RADIUS server so it must have a static WAN IP address. “Realm” defines which user accounts need to be proxied to external RADIUS server. Because by default, mbox RADIUS always use it’s local RADIUS user database for authentication and if user accounts non-exists, authentication will fail unless explicitly defined by “realm” to proxy to external ISP RADIUS server.

Below are the checking/troubleshooting we need to take to validate if RADIUS proxy are added:

To check if above proxy config is correct and also verify if ISP RADIUS has added mbox as a RADIUS client with the correct IP and pre-shared key, do a local test on mbox.

NOTE:

• • In the test command we used “localhost”, which is the local mbox RADIUS server, and the user name 92746928@stm has a suffix of “stm”, so it should match the config of “realm stm @ suffix nostrip x.x.x.x testing123”, and the authetnication would have been proxied to and validated by “x.x.x.x”

  • The realm of “wlan.mncxxxx” refers to EAP-SIM accounts.

  • always use “show security radius-log” to check the authentication results and status

3. Use tcpdump

Sometimes all configurations seem working and testing worked fine, users still complain about authentication problem. For WSG, when there’s authentication problem, users keep getting back to the login portal with error show “wrong username or password”; for WSGx, client device simply shows “trying to get IP address” and will fail after a long wait.

There can be many causes for authentication failure, eg. WLC not correctly configured or configured with wrong pre-shared key, ISP RADIUS has not added mbox as a RADIUS client or is not responding to authentication requests (maybe too busy etc).

To isolate, use tcpdump. First, run tcmpdump on the LAN interface, where the WLC communicates with mbox, filter to port 1812

NOTE:

• vlan901 is the LAN interface

  • if we do not see any “Access Request” at all, the WLC is not correctly configured to use mbox as RADIUS server, either wrong IP address or wrong VLAN.

  • Observe for longer time, if we see “Access Request” but do not see any “Access Accept” at all, it could be because mbox is not correctly proxying the request to external RADIUS, or it could be RADIUS is not responding to requests. Then move to next step to perform tcpdump on mbox WAN interface.

NOTE:

• eth0 is the WAN interface

  • if we do not see any “Access Request” at all, that means mbox is not proxying requests to external ISP RADIUS, check our proxy realm configurations.

  • Observe for longer time, if we see “Access Request” but do not see any “Access Accept” at all, that means ISP RADIUS is not responding to requests. It could be because it has not added mbox as a RADIUS client or is too busy to respond. Contact ISP support.