topic Re: Jumpcloud RADIUS Auth failure in General Topics

Jumpcloud RADIUS Auth failure

Marc_T — Tue, 26 Mar 2019 12:00:15 GMT

Hi,

I have configured a RADIUS profile to use a "Directory as a service" provider (JumpCloud) for authentication, I have tested this with LDAP and everything seems to work as intended but when I configure the Radius profiles and test authentication via the cli I get the following response

Failed EAPOL auth (-1).
Response for user: "bob" from RADIUS server: "self signed certificate in certificate chain; unknown CA"

I have been through and installed the certificate chains for JumpCloud as well as the certificate they provide so I am not sure I understand exaclty what this certificate error is refering to.

Any help will be appreciated.

Re: Jumpcloud RADIUS Auth failure

Marc_T — Thu, 04 Apr 2019 18:21:05 GMT

Looks like I have managed to solve this issue, appears I had the wrond certificate chains loaded.

Re: Jumpcloud RADIUS Auth failure

sgenius — Sat, 16 Nov 2019 00:38:05 GMT

Hi @Marc_T,

Please can you share more light on how you resolved this issue?

I'm having the same issue as well. However, this time, it is Palo Alto RADIUS authentication via Aruba ClearPass, using EAP-MSCHAPv2 as Authentication protocol. My experience in SSL certificates is not so fantastic.

Actually, an SSL certificate was installed on the RADIUS server (ClearPass) which I exported and imported into the Palo Alto firewall.

Patiently waiting for your feedback.

Re: Jumpcloud RADIUS Auth failure

nolansuess — Sun, 23 Feb 2020 15:59:37 GMT

Hi @Marc_T ,

I'm having this exact same issue with JumpCloud RADIUS auth; any chance you could let us know what resolved the issue for you? I'v tried every possible version of certificates/certificate chains that I can think of, but still no luck. Would really like to know how you resolved this.

Thanks!

Re: Jumpcloud RADIUS Auth failure

Marc_T — Sun, 23 Feb 2020 19:44:48 GMT

Hi @nolansuess ,

Its been a while since I used this so I hope all the information I have still configured in my firewall is still valid.

There are the certificates I had to install and then create a certificate profile from:

You should be able to download any updated certs from here: https://support.jumpcloud.com/support/s/article/jumpcloud-radius-certificate-for-eap-ttls-client-deployments1-2019-08-21-10-36-47

Once I had all that configured I created the Radius profile as per usual

Let me know if this helps

Re: Jumpcloud RADIUS Auth failure

RichardGreville — Sat, 03 Oct 2020 13:03:00 GMT

Did you also add both the GD CA and GD Inter to the certificate profile (which is assigned to the radius server profile)

Thanks

Re: Jumpcloud RADIUS Auth failure

RichardGreville — Sat, 03 Oct 2020 20:58:48 GMT

So... I was also getting the "self signed certificate in certificate chain; unknown CA" issues after following;

https://support.jumpcloud.com/support/s/article/jumpcloud-radius-certificate-for-eap-ttls-client-deployments1-2019-08-21-10-36-47

I just installed all the other ROOT and INTER CAs off the below repo, I then added them all to my certificate profile and I was able to auth with peap-mschapv2.. So I think the doc is out of date. I have raised a ticket with JC and once I have the definitive list I will post.

Heres the repo;

https://certs.godaddy.com/repository

Re: Jumpcloud RADIUS Auth failure

jochristian — Thu, 10 Dec 2020 11:29:24 GMT

Hi @Marc_T,

Is this setup still working for you for Jumpcloud?
If I enable "Make Outer Identity Anonymous" radius authentication does not work.
Works fine if I disable this option. Setup is the same other than this.

/Jo Christian