Microsoft KB Archive/183337

= IAS: Error Code 8199 Trying to Authenticate with Microsoft RADIUS =

Article ID: 183337

Article Last Modified on 8/18/2005

-

APPLIES TO


 * Microsoft Internet Information Server 4.0
 * Microsoft Open Enterprise Information System Pack 1.1

-



This article was previously published under Q183337



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



SYMPTOMS
If you are using a U.S. Robotics/3Com Net8, Net8 plus, or Net8/16 NAS device, you may not be able to authenticate through the Microsoft Remote Authentication Dial-In User Service (RADIUS) server. You may receive an error code of 8199 in the event log, and a network monitor trace may show an "access-reject" being sent back from the RADIUS box. In addition, Radius log files will not be created.



CAUSE
By default, the U.S. Robotics/3Com Net8 and Net8/16 are configured to send vendor specific attributes (VSAs) to the Microsoft Radius server. Because these attributes are specific to the U.S. Robotics/3Com hardware, the Microsoft Radius server is not set up to handle them. Thus the user cannot log on.



RESOLUTION
To resolve the problem, set up the following attributes for the U.S. Robotics/3Com hardware on the Profiles tab, vendor specific area:  Create a new profile on the Profile tab on the Microsoft RADIUS server.  Add the following attributes to the profile:     a. Framed-Compression     Van-Jacobsen-TCP-IP b. Framed-IP-Address     255.255.255.254 c. Framed-IP-Netmask     255.255.255.255 d. Framed-MTU            1514 e. Framed-Protocol       PPP f. Framed-Routing        None g. Service-Type          Framed 

NOTE: If you are using U.S. Robotics Netserver Plus software, use 1514. For Netserver, use 1500. Commands used on U.S. Robotics hardware, Netserver Plus software:
 * 1) Set authentication primary_server .
 * 2) Set authentication primary_secret .
 * 3) Enable authentication remote (by default, this is enabled).
 * 4) Set accounting primary_server .
 * 5) Enable accounting (by default, this is enabled).
 * 6) Save all.

-OR-

Commands used if you are running U.S. Robotics Netserver software:
 * 1) Set authentic .
 * 2) Set secret <secret key>.
 * 3) Set accounting <ip address of accounting server> <secret key>.
 * 4) Set acct_authchk on.
 * 5) Save all.

Be sure to enable security on the ports:
 * 1) Set all security on.
 * 2) Save all.
 * 3) Reset all.

For example:
 * 1) Set authentic 1.2.3.4.
 * 2) Set secret secret.
 * 3) Set accounting 1.2.3.4 secret.
 * 4) Set acct_authchk on.
 * 5) Save all.

If you follow the above steps, U.S. Robotics will now authenticate to Microsoft RADIUS software, but the RADIUS logging files will not show up. See Resolution #2 below.

Resolution #2:

With the current release of U.S. Robotics Netserver Plus code (v4.1.7), RADIUS accounting cannot be configured to use a shared secret. RFC2139 requires that a shared secret be sent. In addition, Microsoft RADIUS software expects that the shared secret used for authentication is also used for accounting. This is why logging does not work.

USR/3Com is aware of the problem and as of June 25th 1998 has agreed to issue a fix for this problems; however, there is no ETA for when this will be available. Customers effected should contact USR support for the status of this fix. This problem only effects the netserver8/16 family and not the USR total control line of products.

<div class="status_section">

STATUS
Net8, Net8 plus, and Net8/16 NAS are manufactured by U.S. Robotics/3Com, a vendor independent of Microsoft; we make no warranty, implied or otherwise, regarding this product's performance or reliability.

Keywords: kbprb KB183337

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.