A client is failing PEAP authentication and a debug shows the server is sending an Access-Reject message. Which action must you take to resolve authentication?

An Access-Reject message from the authentication server during PEAP authentication strongly suggests that the provided username or password by the client does not match the credentials stored on the authentication server. PEAP (Protected Extensible Authentication Protocol) first establishes a secure TLS tunnel, and then client credentials (username/password) are exchanged and validated within this tunnel.

PEAP typically uses username/password for client authentication within the secure tunnel, not client certificates for the user account itself, unless specifically configured for PEAP-TLS which is less common for standard PEAP failures.

Disabling server certificate validation on the client is a security risk and would not resolve a username/password mismatch, which is indicated by an Access-Reject; server certificate validation ensures the client is connecting to a legitimate server.

While ensuring proper CA and server certificates is crucial for establishing the initial secure tunnel in PEAP, an Access-Reject message indicates a failure *after* the tunnel is established and the client attempts to authenticate, usually due to incorrect user credentials.