Why are clients experiencing RADIUS timeout authentication failures in an R1 tenant when using a non-proxy external RADIUS configuration, even though the NPS server appears operational and network connectivity is intact?

 

1. Verified authentication failure timeline and identified recurring issue start time around 09:50 CST, consistent with previous occurrences.

2. Confirmed that wireless clients were failing authentication due to RADIUS timeout errors reported by the APs.

3. The  AP uplink captures showed that the server was not responding to RADIUS requests
4. The same was validated against the AP hostapd logs - server request timing out after 10 retries

5. Reviewed NPS server performance and observed high CPU utilization for EAP

6. Rebooted the NPS server at approximately 10:25 CST; however, authentication failures continued after the reboot.

7. Disabled RADIUS Accounting on WLAN profiles to reduce authentication processing overhead and eliminate accounting traffic as a contributing factor.

8. Reviewed Windows Security Logs and observed OCSP validation errors.

9. Validated OCSP responder status from the server command line and confirmed that OCSP responses were functioning correctly.

10. Verified Active Directory connectivity by adding new AD groups to the NPS server. Group enumeration and policy updates completed successfully.

11. Reviewed security logs and noted that available entries primarily referenced anonymous authentication attempts, providing limited insight into the root cause.

12. Captured traffic at the firewall and observed significantly fewer authentication packets reaching the firewall than expected.

13. Installed Wireshark on the NPS server and captured authentication traffic.

14. 1. Analysis of packet captures showed that the NPS server was not responding to PEAP Identity Requests.

    2. Confirmed that APs retried authentication requests and ultimately timed out after 10 retries.

    3. Obtained user-level authentication logs and identified the recurring error:

• • • "The Active Directory Global Catalog cannot be accessed."

14. Isolated NPS policies by disabling all Network Policies and monitoring CPU utilization.

15. Re-enabled policies incrementally:

• • IT Administrator Policy: CPU remained normal.
  • Employee Policy: CPU remained normal.
  • Student Policy: CPU immediately increased to 100%.

16. Investigated the Student Policy constraints and identified the following AD groups configured in the policy:

• • Student1
  • Student2
  • Student3
  • Student4
  • AllStudents

17. Determined that the AllStudents group contained the other student groups as nested members.

18. Removed the AllStudents group from the Student Policy.

19. Following removal of the group, CPU utilization normalized and authentication processing resumed immediately.

The issue was caused by excessive Active Directory group membership evaluation within the NPS Student Network Policy. The policy contained a nested group (AllStudents) that included the same student access groups already individually referenced by the policy. During authentication, NPS spent excessive processing time evaluating group memberships, causing CPU utilization to reach 100%.

As CPU resources became exhausted, the NPS server was unable to process PEAP authentication requests in a timely manner. This resulted in:

• RADIUS timeout errors reported by APs.
• Lack of responses to PEAP Identity requests.
• Authentication retries and eventual client failures.
• Active Directory Global Catalog access errors.
• Reduced authentication traffic observed in packet captures.

Removing the AllStudents group from the Student Policy eliminated the excessive group membership evaluation overhead. Following this change, CPU utilization returned to normal levels and RADIUS authentication was restored successfully.