802.1x accounting does not reflect correct port status

Hi,
I've just discovered an issue when trying to use MSFT supplicant and Cisco 802.1x accounting. This makes 802.1x accounting completely unusable.
Facts:
1. MSFT supplicant does not send EAPOL-Logoff messages and there's no way to enable this (btw. Aegis client does not send it either, except when disabling interface).
2. I am doing machine authentication along with domain authentication.
3. Windows XP SP2 is used with EAP registry hacks applied.
4. PEAP/MS-CHAPv2 method is used.
Now when the computer is started it is logged into 802.1x with 'host/machine' account and RADIUS accounting start is sent by the switch. That's fine.
When a user logs on with its 'domain\user' identity, then EAPOL-Start is sent from the host triggering new EAP message exchange and the user is authenticated correctly. However the switch sends Interim Accounting still using 'host/machine' credentials which is obviously wrong.
Even more bizarre accounting happens when the user subsequently logs off from the machine. The EAPOL-Start is sent from the host triggering new authentication process for 'host/machine' identity and the host is authenticated ok. The accounting being sent is:
- first Accounting Stop for 'host/machine' User-Name
- then strange Interim Accounting with most attributes empty or missing
256970: Jul 10 15:56:41.211 MET-DST: RADIUS: authenticator 68 CA 1A 46 85 4F F5 95 - 87 B4 84 61 72 85 42 F3
256971: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Session-Id [44] 10 "013F0000"
256972: Jul 10 15:56:41.211 MET-DST: RADIUS: Vendor, Cisco [26] 34
256973: Jul 10 15:56:41.211 MET-DST: RADIUS: Cisco AVpair [1] 28 "connect-progress=Auth Open"
256974: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Session-Time [46] 6 0
256975: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Input-Octets [42] 6 0
256976: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Output-Octets [43] 6 0
256977: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Input-Packets [47] 6 0
256978: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Output-Packets [48] 6 0
256979: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Authentic [45] 6 RADIUS [1]
256980: Jul 10 15:56:41.211 MET-DST: RADIUS: Acct-Status-Type [40] 6 Watchdog [3]
256981: Jul 10 15:56:41.211 MET-DST: RADIUS: Vendor, Cisco [26] 24
256982: Jul 10 15:56:41.211 MET-DST: RADIUS: cisco-nas-port [2] 18 "FastEthernet0/11"
256983: Jul 10 15:56:41.211 MET-DST: RADIUS: NAS-Port [5] 6 50011
256984: Jul 10 15:56:41.211 MET-DST: RADIUS: NAS-Port-Type [61] 6 Eth [15]
256985: Jul 10 15:56:41.211 MET-DST: RADIUS: Class [25] 27
256986: Jul 10 15:56:41.215 MET-DST: RADIUS: 43 41 43 53 3A 30 2F 32 39 32 66 2F 61 38 31 38 [CACS:0/292f/a818]
256987: Jul 10 15:56:41.215 MET-DST: RADIUS: 30 32 38 2F 35 30 30 31 31 [028/50011]
256988: Jul 10 15:56:41.215 MET-DST: RADIUS: Service-Type [6] 6 Framed [2]
256989: Jul 10 15:56:41.215 MET-DST: RADIUS: NAS-IP-Address [4] 6 10.129.128.40
256990: Jul 10 15:56:41.215 MET-DST: RADIUS: Acct-Delay-Time [41] 6 0
256991: Jul 10 15:56:41.239 MET-DST: RADIUS: Received from id 1646/238 10.129.128.38:1813, Accounting-response, len 20
256992: Jul 10 15:56:41.239 MET-DST: RADIUS: authenticator ED 8E 8B 15 28 5F E4 37 - BF A8 F5 9E 10 43 5E A8
So that the accounting sent from the switch does not reflect current status of the authenticated user on a given port.
How to deal with this issue? Any ideas?
thanks,
robert

Does your radius proxy-table is populated wrong for EAP- SIM users ?

Similar Messages

Itunes account does not relfect correct iphone 4 apps

HELP. I am not sure what to do. I just updated my iphone 4 software and cant seem to make my itunes apps the same as what is on my phone. I only want the apps on my phone. It is showing all old apps on my itunes account. I also cant click on anything when I go into the apps tab of my itunes account. I would think it would be easy to just delete the apps from my itunes but I cant click on anything. It looks like the box is already checked to "sync apps" but it wont let me click and manage the apps???

Read
http://support.apple.com/kb/TS1538. Or
http://support.apple.com/kb/ts1591

Emctl status dbconsole does not reflect correct status of dbcontrol

hi gurus
Emctl status dbconsole command shows that the Oracle Enterprise Manager 10g is not running. But in fact that I can access the Enterprise Manager and it is running.It seems that the emctl status dbconsole command show incorrect status about the dbconsole.
Why and how to solve this problem?
Thank you very much!
Edited by: KevinMao on Apr 26, 2010 6:14 AM

It might work if you had an operating system. However, you do not have one.
Or at least you are very reluctant to tell us which one you use.
And troubleshooting techniques differ based on OS.

IPone 6, iOs 8.1.2 when removing the phone from the charging does not reflect the increase in the percent charge level , by reconnecting displays correctly

when removing the phone from the charging does not reflect the increase in the percent charge level , by reconnecting displays correctly

Addendum
Last night charging for around 3-4 hours only charged a dead phone by 55% then left it to charge overnight
Today the battery dropped from 6:15 am full charge to 53% at 10:38 am at time of writing this with
1 phone call out for 30 secs
1 incoming missed call,
Whatsapp fetched around 10 msgs
Email fetched around 20 ermail from 4 accounts but not viewed yet on phone

AR Down Payment Invoice Does Not Reflect in BP Master Data...

We have placed a sales order for a BP.
We select payment means and accept the payment
In the background a AP Down Payment Invoice is created
When we view the BP master data - the account ballance window does NOT reflect this "down payment"
If we select the golden arrow at account ballance, uncheck "reconciled transactions" you can see the payment and AP down payment and they clear each other out.
The problem is that when the final invoice is created it is not obvious that a down payment has been received. Even if you are simply working at the BP master data window, it is not obvious that a down payment has been received. I belive our process is correct because If you click the TDP box, the payment is listed and will be applied to the final invoice.
It simply does not alert the user that a payment had been received.
What are we doing wrong?????\
Thank you!
Edited by: Andrew Bleier on Feb 4, 2009 1:27 AM

Keith Taylor
You are right this feature is only available in Version 2007A. There account posting happen purely due to the pay SAP has been designed and the configuration of GL Accounts.
To make fundametal change to the core product is very difficult if you explain me your business process exactly as you do, I could think of alternatives.
Please let know.
Suda

My WishList does not reflect current purchases

Ever since transferring my iTunes library from my PC to iMac, I have noticed that My WishList in iTunes store, while it lists all the previously "wished for" apps and songs, does not reflect which ones I have purchased. In other words, it used to be that the purchased apps were listed, and instead of a price it would just say "purchased." Now it just shows a price, as if I never purchased the app. Even when I open the app description in the itunes store, the price remains, as if I never purchased it. I have occasionally seen this happen when the iTunes store account took time to refresh the information it had, but this has been going on for several weeks.
Is there someway to "remind" my iTunes account of what purchases I have, so that my purchase history is correctly reflected? I've been using the same account the whole time, so I know that is not the problem.

Where did it show as a portable device? If in My Computer try:
Removing and reinstalling iTunes, QuickTime, and other software components for Windows Vista or Windows 7
iTunes: Syncing media content to iOS devices and iPod

While configuring speed 1000 i am getting error as sw2-storage-vdc(config-if)# speed 1000 ERROR: Ethernet2/6: Configuration does not match the port capability.

storage-vdc(config-if)# show module
Mod Ports Module-Type                         Model              Status
2    32     1/10 Gbps Ethernet Module           N7K-F132XP-15      ok
sw1-gd78(config-if)# sh module
Mod Ports Module-Type                         Model              Status
2    48     1/2/4/8 Gbps FC Module              DS-X9248-96K9      ok
4    8      10 Gbps FCoE Module                 DS-X9708-K9        ok
7    0      Supervisor/Fabric-2a                DS-X9530-SF2AK9    active *
8    0      Supervisor/Fabric-2a                DS-X9530-SF2AK9    ha-standby
10   22     4x1GE IPS, 18x1/2/4Gbps FC Module   DS-X9304-18K9      ok
Mod Sw              Hw      World-Wide-Name(s) (WWN)
2    5.2(2)          1.1     20:41:00:0d:ec:fb:8a:00 to 20:70:00:0d:ec:fb:8a:00
4    5.2(2)          0.107   --
7    5.2(2)          1.8     --
8    5.2(2)          1.8     --
10   5.2(2)          1.3     22:41:00:0d:ec:fb:8a:00 to 22:52:00:0d:ec:fb:8a:00
sw1-gd78(config-if)# sh run int ethernet4/6
!Command: show running-config interface Ethernet4/6
!Time: Mon Feb 20 22:56:12 2012
version 5.2(2)
interface Ethernet4/6
no shutdown
sw1-gd78(config-if)# no shut
sw1-gd78(config-if)# speed 1000
ERROR: Ethernet4/6: Configuration does not match the port capability.
sw1-gd72# sh int ethernet4/6 capabilities
Ethernet4/6
Model:                 DS-X9708-K9
Type (SFP capable):    10Gbase-SR
Speed:                 1000,10000
Duplex:                full
Trunk encap. type:     802.1Q
Channel:               yes
Broadcast suppression: percentage(0-100)
Flowcontrol:           rx-(off/on/desired),tx-(off/on/desired)
Rate mode:             dedicated
QOS scheduling:        rx-(2q4t),tx-(1p3q4t)
CoS rewrite:           yes
ToS rewrite:           yes
SPAN:                  yes
UDLD:                  yes
Link Debounce:         yes
Link Debounce Time:    yes
MDIX:                  no
Port Group Members:    none
TDR capable:           no
FabricPath capable:    yes
Port mode:             Switched
sw1-gd72# sh int ethernet4/6 transceiver details
Ethernet4/6
    transceiver is present
    type is 10Gbase-SR
    name is CISCO-FINISAR
    part number is FTLX8571D3BCL-CS
    revision is C
    serial number is FNS12090EMJ
    nominal bitrate is 10300 MBit/sec
    Link length supported for 50/125um OM2 fiber is 82 m
    Link length supported for 50/125um OM3 fiber is 300 m
    Link length supported for 62.5/125um fiber is 26 m
    cisco id is --
    cisco extended id number is 4
           SFP Detail Diagnostics Information (internal calibration)
                                     Alarms                  Warnings
                                High        Low         High          Low
Temperature   36.21 C        75.00 C     -5.00 C     70.00 C        0.00 C
Voltage        3.29 V         3.63 V      2.97 V      3.46 V        3.13 V
Current        8.11 mA       11.80 mA     4.00 mA    10.80 mA       5.00 mA
Tx Power       -2.65 dBm       1.49 dBm -11.30 dBm   -1.50 dBm     -7.30 dBm
Rx Power       -2.21 dBm       1.99 dBm -13.97 dBm   -1.00 dBm     -9.91 dBm
Transmit Fault Count = 0
Note: ++ high-alarm; + high-warning; -- low-alarm; - low-warning

Ankit,
You are trying to set speed 1000 on a 10g sfp.
type is 10Gbase-SR
You will need to insert a 1gig sfp and then you will be able to set the speed.
Also, I noticed that you posted first with interface 2/6 and the output you gave me was for 4/6. Are you sure you're in the right interface?

The e-mail account does not exist at the organization

Hi, I have a user account that people receive the following message from:
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.
<mailserverishere #5.1.1>"
I'ved looked and this particular case could be a quirky one.
The details are:
User account A is the account that Exchange thinks doesn't exist.
User account B is her boss.
A copy of user B's email is sent to A. (done through Delivery Options)
Senders sometime receive an email back saying user A's address doesn't exist.
(which really confuses them because they sent the email to B)
This is the only time the bounce message appears.
I've removed the forward and added it again. Still the problem.
Any clues?

You need to verify old delegates in UserB's mailbox by going to Tools -> Options -> Delegates. Remove old UserA and re-add it.
This is because of option “Delegates receives copy of meeting-related mails sent to me” is ticked with old UserA id in Delegates.
If you can't see any delegates then you have another option to delete delegates rule with MFCMapi.
- Open UserB's Mailbox with MFCMapi where UserB's outlook profile configured in online mode (not Cache mode)
- Double click the Mailbox of userB to open.
- Expand Root Container -> Top of the information store -> Inbox folder
- Right-click the "Inbox" folder, and then click "Display Rules Table".
- You can see all rules configured in mailbox.
- Delete the Delegate Rule with "PR_RULE_PROVIDER" column property shows "Schedule+EMS Interface". (this is the same option which you can set with GUI Delegation "Delegates receives copy of meeting-related mails sent to me" but stale copy is still in mailbox.)
THANK YOU! Amit Tank

SharePoint group containing AD security group - Check Permissions does not show correct information

I'm seeing a problem with SharePoint 2013 groups that contain Active Directory security groups. When using the Check Permissions feature to see what permissions a specific user has, it does not reflect the correct permissions for a user inside of the AD
security group. This occurs when checking permissions on a site, library, list or folder. When a user is added as a direct member of the SharePoint group it lists their proper permissions. I should note that the users ability to access the site or list works
properly and coincides with the SP/AD group the user belongs to. It's only the Check Permissions that doesn't work. This does not happen with SharePoint 2010 and the Check Permissions tool is very useful. Any ideas?

It's not wrong, it is expected behavior and working as designed. Until a user logs into the SharePoint site that is granted access via AD group, the user is not going to show under 'check permissions' as having access. SharePoint must have a record of the
user in the UIL in order to validate their access.
You're free to file an RFC with Microsoft, but the monetary impact to you must be extremely high in order for this behavior to be changed.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Devanagari font in layed out in Indesign (using IndicPlus) does not export correctly to a PDF.

Namaste InDesign gurus,
I have a problem at hand. Wondering if anyone has encoutered similar problem before? Any help is greatly appreciated. And if you're in San Francisco bay area - I can buy you a lunch :-)
Short description: Devanagari font in layed out in Indesign (using IndicPlus) does not export correctly to a PDF. All the ligatures are assembled and displayed in the PDF.
Adobe Indesign Version: InDesign CS5 Design Premium - regular U.S. version (not ME).
Steps I took:
I purchased CS5 Design Premium and also purchased the IndicPlus plugin to author sanskrit documents in InDesign. I create Sanskrit text using either of the following methods.
1) Itranslator
2) Paste the devanagari from the Itranslator directly into InDesign or paste it first into MSWord and then copy from MSWord and paste it to Indesign.
It doesn't matter how I paste it. After I apply the IndicPlus character/paragraph style so that the sanskrit looks good in InDesign, when I try to export it to a PDF. The PDF does not display the ligatures currectly. It just lists all the characters in order without assembling.
I've spent a lot of money buying CS5, IndicPlus and then I can't even create a simple PDF document from InDesign. It is very frustrating.
Has anyone been able to successfully export a sanscrit document from InDesign PDF ?
(Please let me know if my problem description needs more fleshing out).
I could create the PDF from MSWord directly but I'm trying to use indesign to layout my book. If InDesign cannot export to PDF I'll just have to use MSWord for my book layout. I've spend probably scores of hours trying to learn InDeisn and formatting my book content - seems like it is all going to be waste.
Is MSWord the best choice or only choice for laying out books that have sanskrit text in them?
-Ravi

Has anyone been able to successfully export a sanscrit document from InDesign PDF ?
Not Sanskrit, no, but plenty of Hindi, Nepali, Marathi, and other languages written in Devanagari script - so it should be possible. I don't even use IndicPlus, which by most accounts makes working with Indic text much easier.
1) Itranslator
I've never seen this, but a quick Google led me to the homepage of ITranslator for Windows, where I saw this:
Itranslator 99 (Build 1.3.0.86) & New Beta Version
uses 8-bit true type fonts and is compatible
with Windows 95/98/ME/NT/2000/XP.
For more information, click here.
Itranslator 2003 (Build 2.0.0.38) & New Beta Version
uses 16-bit Unicode-compatible fonts and is working
only on Windows 2000 / XP / Server 2003.
For more information, click here.
So, if you're using ITranslator 99, there's the problem - those "8-bit true type fonts" won't work in InDesign. Can you post a sample of the text you're trying to paste into InDesign? Name the font(s) you are using, both in Word and in Indesign, and if possible make a small sample of the text available for us to test. It's also possible that InDesign is using a substituted font, which could cause this problem. So, if the font name in InDesign has brackets around it, you know that InDesign doesn't actually have that font installed and is auto-substituting. Also, if you go to View -> Screen Mode -> Normal and the text is highlighted pink, you know that the font has dropped. (Unless the highlighting for dropped fonts was turned off - check in Edit -> Preferences -> Composition and make sure that "Substituted Fonts" is checked.
Also, for what it's worth, is there any way you could Place your text instead of copying and pasting? This may be cause of your problem - but even though it probably isn't, it's still worth a try.
Lastly - no, I've found InDesign to be superior for typesetting for almost all languages, but the learning curve is pretty steep, and many of the problems faced by people working in non-English languages are not easy to research when you have a problem.

VMM Shared ISO error "User account does not have permission required to open attachment"

I had this error once because the local service account was selected during installation of VMM. I have reinstalled VMM with a Domain service account and the error went away. However, the error is back.
"User account does not have permission required to open attachment '\\[servername]\VMMLibrary\server.ISO'. Error: 'General access denied error' (0x80070005). (Virtual machine ID GUID)"
I tried to create this VM on Host1 and got the error.
I then went to Host2 and was able to create the VM while using the same ISO on the same VMM library that failed on the Host1.
Both hosts have agent 3.2.7634.0 and are both running Hyper-V Server 2012 R2.
What is wrong with Host1 and how do I correct it?
Thank you.

This is a share configuration permissions issue.
http://technet.microsoft.com/en-us/library/ee340124.aspx
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.

Net Price does not reflect on Consignment PO even after maintaining info re

Dear Experts,
I have created consignment PO but the net price does not reflect on it. I have already maintained valid consignment info record for this material with reference to standard purchasing organization in ME11.
Would appreciate your views ...
Cheers !
Sachin Narvekar

Hi,
the system behaviour is correct here.
The basic concept of vendor consignment lies in this.
In this case PO is a request to put his stocks at the company.
The moment we uses( Transfer from vendor stock to Company's own stock, using 411, or direct issue to cost centres using 201K) this stock, liability will be generated.
Then the price from the info record will be used as well as the tax code.
Then u can run a settlement transation , for payment settlements.
Until the moment u uses the stock, it will be vendors stock only, thats why only Issue create liability.
So the system behaviour is correct.
Regards
Krishna

Business area does not reflecting in IT 0001

Dear Expert,
I have assign cost center to organization unit, then hire employee through PA40, so position assign into IT0001,
system pick up the cost center but does not reflecting the business area in infotype 0001.
i checked with FI consultant, there is proper intergation between cost center and business area.
Please tell me, how to resolved this issue.
Many Many Thanks
Urvashi

Hi Urvashi,
You will get the Default values for Company code, Personal area, Personal Sub Area and Business Area because of Account assignment infotype - IT1008 - for your position or Org Unit
check from PO10 or PO13 and infotype 1008.
You will have PA value defaulted on IT 0000 screen and others defaulted on IT 0001 screen.
You can change these values on respective screens. A warning will be issued but you can overwrite them.
Regards,
HARANATH

Updating Flash Player Does Not Reflect In Add-Ons Manager or Plug-In Check

The add-ons Manager shows I have Flashplayer version 11.3.300.265. The Plug-ins Check shows there is an update, and I downloaded and installed Flash Player version 11.3.300.268. Six times! Each time, the installation shows as successful on the Adobe site, but FF14 does not reflect the new version, and the Plug-in check continues to insist that the version is out of date.
I had no problems whatsoever updating to the latest Flashplayer version in IE (8). But FF is once again giving me trouble with this.
In addition, the add-ons manager shows a version of Flash 9.0.45.0, last updated Feb 20, 2007. There's a big red warning that it's out of date. This is in addition to Shockwave Flash (the correct one) and Shockwave for Director (which is current). It's been like this for awhile, and I disabled the antique version of Flash and it does not affect FF or Flashplayer performance.
I tried deleting my plug-ins database, but I just get all the same info when it is rebuilt. Any suggestions or solutions would be appreciated.

Such old version are usually located in the plugins folder in the Firefox program folder (C:\Program Files\Mozilla Firefox\).
You can enable the plugin and verify the path on the about:plugins page.
You can set the plugin.expose_full_path pref to true on the about:config page to see the full path of plugins on the about:plugins page.
*http://kb.mozillazine.org/Issues_related_to_plugins#Identifying_installed_plugins
*http://kb.mozillazine.org/about:plugins
*http://kb.mozillazine.org/about:config
It is best not to leave that pref set to true as it exposes that full path to web servers, so reset that pref to false after you are done with the about:plugins page.
See "Manually uninstalling a plugin":
*https://support.mozilla.org/kb/Troubleshooting+plugins

Messaging Server 4.1: Received mail is not returned to the sender if the receiving local account does not exist.

I have found that received mail is not returned to the sender if the receiving
local account does not exist. This problem occurs even if I use Console to
enable the Return message to sender option under the error handling methods.
In addition, I have used the configutil
to confirm that I have set the value
for Unknown account action to "13," which corresponds to the settings "Return
message to sender," "Notify the postmaster via email," and "Log the error in
the log file." Yet, in this situation, an error message is being sent to
postmaster, but not to the sender, and the error is not being recorded in the
log file.

Do the following steps: 

<OL>
<LI>From Console, open the appropriate Messaging Server.
<LI>Click the Configuration tab.
<LI>Open the Services folder.
<LI>Select SMTP.
<LI>Click the System tab.
</OL>

Check the "Domain handled by this server exclusively" field to make sure that
your mail domain is listed. If your mail domain is not listed, then Messaging
Server will assume that there is another mail server that is handling the
domain listed and will forward requests to this server.

For more information, please see the document Messaging Server
Administrator's Guide, Chapter 3, Configuring SMTP Services at 
http://docs.iplanet.com/docs/manuals/messaging/nms41/ag/smtp.htm#1010371

On Thu, 12 Dec 2013 16:16:02 +0000, lpphiggp wrote:
> I'm seeing this XTCOM error occur all over our /var/log/messages for one
> server, running SLES11sp2 / OES11/sp1;
>
> I don't really know what this is even for. We don't use NetStorage or
> iPrint even, this server only does basic NCP file serving, DHCP, and
> hosts a GroupWise PO.
> Is this anything to be concerned about?
If this:
http://www.linuxquestions.org/questi...entication-vs-
edirectory-825043/
is to be believed, it seems to indicate that your NAM configuration on
this server is not valid. I'm not seeing this message here on the OES
servers I looked at, and NAM is working correctly here.
David Gersic dgersic_@_niu.edu
Knowledge Partner http://forums.netiq.com
Please post questions in the forums. No support provided via email.
If you find this post helpful, please click on the star below.

802.1x accounting does not reflect correct port status

Similar Messages

Maybe you are looking for