Authentication Failure or event 201

  • 1
  • Question
  • Updated 4 weeks ago
I am using a radius server. sometimes I have a device that is still trying to connect using a users old password, and after trying the bad password 3 times in a roll, it locks the user out. I see that there is a EVENT 201 in the event viewer. Shouldn't these type events of Client authentication failed get logged? 201 is set to log, but I never get any 201 logs. Is there a way I can see authentication failures to maybe see the device type, name or mac address of the device the password is failing on? 
Photo of Eddie Scarberry

Eddie Scarberry

  • 5 Posts
  • 0 Reply Likes

Posted 1 month ago

  • 1
Photo of Syamantak Omer

Syamantak Omer, Official Rep

  • 551 Posts
  • 175 Reply Likes
Hi Eddie,

Are you referring event 201 on ZD or auth server?

For the controller it is just a authentication failure. It depends upon the log level set on ZD, If it is set to Show more, you will be able to see authentication failure in the ZD event logs with client's MAC address.

Go to ZD >> System >> system settings >> Log settings >> "show more".

Regards,
Syamantak Omer
Photo of Eddie Scarberry

Eddie Scarberry

  • 5 Posts
  • 0 Reply Likes
I am referring to ZD.  I do not have authentication server sat up.  if I did, would it show more than the ZD?   Any good links to show how to set one up?   In my ZD, I have SYSTEM, but under that I just have General, AP, Cluster, Maps, Certificates and Templates.  I do not have a System Settings.     is there anywhere that it would show a failure referencing the username?   I need to be able to search for a username and see failures.  

Photo of Eddie Scarberry

Eddie Scarberry

  • 5 Posts
  • 0 Reply Likes
Thanks, I must have a different version of firmware, as I dont have a SYSTEM>SYSTEM SETTINGS.  I have done a screen shot.    
Photo of Syamantak Omer

Syamantak Omer, Official Rep

  • 491 Posts
  • 159 Reply Likes
Hi Eddie,

You have posted this question under Zonedirector product. However, you are using SmartZone or virtual SmartZone. This is why provided information is not matching.


Regards,
Syamantak Omer
Photo of Eddie Scarberry

Eddie Scarberry

  • 5 Posts
  • 0 Reply Likes
Thank you.  can you provide me with SmartZone info?  should I post this also under Smartzone?  
Photo of Syamantak Omer

Syamantak Omer, Official Rep

  • 491 Posts
  • 159 Reply Likes
Reason Code 201 is applicable for the WLAN which has MAC Auth enabled, not for PSK or 802.1X. I don't think you will get more information like client IP or hostname.

Could you share a sample event.

Regards,
Syamantak Omer
Photo of Eddie Scarberry

Eddie Scarberry

  • 5 Posts
  • 0 Reply Likes
ok thank you.  its always been a chore to try to find out what devices are locking an account out.  Some I have never found.