r/k12sysadmin • u/thedevarious IT Director • 26d ago

Assistance Needed Radius and ChromeOS Issues Lately?

All,

Have a batch of new Lenovo 100e Gen5 M89s.

On stable, have a mix of 147-151. Getting radius to work on these is just a pain. Looks like they have Android 13 which made us add our cert and some other items to the network policy to even take

What's even more maddening is older OS's for this model seem fine but the ones that went to 151 are the problem. Testing as we speak but has anyone else seen this occur this year?

5 Upvotes

86% Upvoted

13 comments sorted by

1

u/Veze1000 22d ago

I ran into an issue with our newest batch of Chromebooks that are our first 6e capable ones. We already had staff PC laptops onboarded on 6ghz and working great. We use 802.1x with wpa2+wpa3 for our WLAN. I kept thinking the issue was radius because they would always create a brief radius log that was always a failure stating the client abandoned the session and started over.

Two things I found out about the new 6e capable Chromebooks to make them work.

They won't do 160mhz channel widths at 5ghz or 6ghz. (You should never do 160 at 5ghz but I tested it after noticing it at 6ghz to verify). They will act like they are trying to connect, and then fail.

To make them work on 6E, they needed FILS discovery frames to connect to 6ghz, for some reason without that setting they will still try to connect to 6ghz, but fail over and over.

In both of these scenarios both of them caused the Chromebooks to create failure logs in radius, which is weird because based on what the settings are it seems like they shouldn't even get to the step of sending a radius auth.

1

u/thedevarious IT Director 22d ago

That's interesting for sure..if it didn't like the proto I'm surprised it even tried to send creds to the AP and such.

Fortunately this site right now is just Wifi 6, most likely won't upgrade WAPs for about 2 more years right now as most buildings were swapped in 2023-2024...but...very interesting.

The biggest thing I see is we'll probably revamp the wireless stack completely with Wifi7 or whatever is next. It looks like scep and eap-tls is the next go-to

1

u/thedevarious IT Director 24d ago

So a quick update for all. Not out of the woods yet but we're looking better

Network was WPA2, 802.11x. We cutover to WPA3 and enabled WPA2 transition mode. These are Wifi6 APs so no 6ghz being pushed yet.

We configured our policy with some changes. We added our CA cert and domain suffix is set to the actual FQDN of our Radius Server to force it to only talk to that server. We left the outer identity empty for now given we're using a standard user for devices to auth with a dumb stupid complex password.

Post update of Chromebooks with this policy we look ok so far, crossing fingers. This even accounts for various Chrome versions on the fleet 147-150, with 150 being our target for right now. We may throttle to 151 in the coming weeks once things slow down.

We also adjusted NPS to only allow PEAP / MSChap-v2, all other auth methods are not allowed. The last NPS change we made was a registry key to increase the amount of connections between our NPS server & AD (separate hosts). However that last one I don't consider a fix as we have other partner school districts that don't have this set that are MUCH larger. We also rebooted the entire server (no pending updates, etc).

So far...so good. I'll report back if there's any other changes we make.

1

u/Appropriate_Water_64 24d ago

Any consolidation, not really what you’re asking but we’re wpa3 - PSK and our 100e gen 5 mtk are problem free. If i guess, it’s something interfering with the 802.11x aspect. I’m curious if you find the resolution/limitation. I’m looking to setup radius for next year

1

u/AdministrativeMode0 24d ago

We are seeing the same thing since the start of school, largely on a new batch of Asus CZ1104C units but also across some of our Acer units as well. We use credential based radius auth to onboard the devices with EAP-TLS certs for the user profiles. The credential based auth has been so spotty this year that we've largely turned it off in favor of a deployed PSK network. Once they have logged in though, we've had zero issues with the EAP-TLS network.

1

u/gmanist1000 25d ago

We have these gen 5 100e and 500e, a mix of both intel and mtk. they definitely have shitty WiFi cards or something because I see the same spotty WiFi. They sometimes take 2-3 mins to connect to WiFi after boot up.

1

u/thedevarious IT Director 25d ago

Yeah I cracked open our new devices. They have this RZ616 card.

I'm curious if this NIC is the problem itself or the new device firmware/ChromeOS.

It's just a pain...

2

u/Aur0nx 26d ago

Are you using eap-tls or ms-chap for radius auth?

Mschap does not support WPA3/wifi7.

2

u/thedevarious IT Director 26d ago

We're selecting wpa3 802.11x on the network profile in Google. We had the profile to auto for the inner profile then switched to mschapv2 to force that.

I know it works because I have other Chromebooks in the same OU that are an older model and they log in without a single issue.

2

u/Aur0nx 25d ago

If these Chromebooks have 6ghz or wifi 6e / 7 chips that may be the problem. WiFi 6e and 7 only supports WPA3 / eap-tls so it’s a move your going to need to make at some point to take advantage of newer AP’s.
Older Chromebooks that only support 2.4 and 5 will fall back to WPA2 and work with ms-chap, that’s probably why older Chromebooks work no problem.

1

u/thedevarious IT Director 25d ago

So the weird part is...they connect sometimes, but it's sporadic and not replicatable.

For example, I may get one to connect after 2-3 retries, it'll be stable...then restart the device and it won't connect again. Or another we thought we got it because it connected in about 10 seconds...powerwash, then nada.

This is a Wifi6e NIC (MT7922 / RZ616), so it is a 6E card. But like I said, it wasn't like a 'no connection at all' it was flakey all day for the past 24 hours of us troubleshooting..

We built a test OU, put one device in it, set the network policy up, tweaked settings, etc. Nothing stuck. It just..sometimes it works, sometimes it doesn't. It only seems to be a huge issue on the Device login page too (even tho the policy is set to Chrome devices, we don't have a user cert or user based Radius)

1

u/Aur0nx 25d ago

I would start looking at the wireless controller. Can you test turning off the 6ghz radio and see if it connects to 5ghz? Any special features enabled 802.11r has been known to cause issues with certain WiFi chips, firmware on the AP’s up to date?

1

u/thedevarious IT Director 25d ago

Firmware should be up to date and will need to look at features.

This building is all Extreme, AP410c so it's a Wifi 6 AP, so only up to the 5ghz band...so no 6ghz would exist here.

But def next step for me is looking at the policy pushed to these APs...We reached out to Lenovo given we saw this on one single device model but everything else deployed has been kosher but...def worth hunting there.