802.1x and WOL issues

Question

OK here is the deal. We use 802.1x with ACS as the Radius server. We also use WOL to wake computers for patching and remote use. We cannot get rid of WOL or 802.1x. We also cannot have ports assigned to our Data VLAN since that would, in the eyes of the auditors, allow unauthorized devices on the VLAN. We use a "Sleep" VLAN and then use ACS policies to assign the authenticated device to the proper VLAN. We also have VOIP with the computers connected to them. Here is the actual issue we are having. It seems that on some switches even with sleeping computers the "Sleep" VLAN is down/down or up/down. If there is at least one computer that is asleep and not behind a phone everything works fine. It looks like an issue with the phone and enhanced CDP. We are looking for a way to have the "Sleep" VLAN always up/up even without devices connected. We have been tossing around ideas like having a loop so that STP runs for that VLAN, connecting a layer 3 interface to a layer 2 interface on the same switch, even connecting a phone on every access switch and placing it in the "Sleep" VLAN. We are looking for better ideas.
Thanks.                

Answer 1

Hello,
I suspect your problem is the fact that you're using self-signed certificates, but you haven't installed and trusted the root cert that issued them. The reason the phone can't validate the certificate is because it doesn't trust the issuer (or you don't have all of the certificates in the chain if you have intermediate CAs). That's also the problem with your Mac client forcing you to hit 'Accept' each time you authenticate - it doesn't trust the root CA. You should be able to talk to your IT folks to get a copy of it to import and trust (the certificate itself isn't secret).
1. Once you have the certificate, import it into your Mac's keychain and set the appropriate trust settings.
2. You should use the iPhone Configuration utility to create a profile to install the certificates onto the phone. On the Credentials tab hit '+' and browse to the location of the root certificate you got from IT. Once it's part of the profile you can then setup the Wi-Fi settings as needed.
This can get tricky, depending on the configuration your IT staff has in place. They should be amenable to providing you the same information they'd provide a Windows client (hopefully). Do you know what kind of EAP type you're using on your network? From the log the client is negotiating PEAP, which I assume is correct.
You'll need to get the certs ironed out before this will work reliably.