802.1x on Cisco 3750 switch: How to stop retrying the authentication for the un-authorized guests
Hi experts,
I'm trying to stop the authentication retry for the guests. They won't have the credential to be authorzied and will be put in the guest VLAN. However the switch seems by default always retries the authentication every 15 seconds or so. It's fine if the guests are few but I'm implementing it at a hotel where most users are guests (like 1000 of them at the same time...).
I really need to turn it off or at least find some timer to decrease the frenquency... It's urgent because the hotel is about to open... The following is the config I put on an interface:
switchport access vlan 1055
switchport mode access
switchport nonegotiate
switchport voice vlan 657
ip access-group ACL_PortIso_IDF21 in
authentication event fail action authorize vlan 1055
authentication event no-response action authorize vlan 1055
authentication host-mode multi-domain
authentication port-control auto
authentication violation protect
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout quiet-period 300
dot1x timeout tx-period 2
dot1x timeout supp-timeout 2
dot1x max-reauth-req 10
dot1x timeout held-period 300
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
no ip igmp snooping tcn flood
Thanks!
Elly,
Soon I will have a Windows laptop plugged in. Then I will be able to run the wireshark. Now I have to run the "debug dot1x packets" since the attached device is a phone.
So first I "clear dot1x session int f3/0/13". After a couple of "failure" eventually it will show this:
"%AUTHMGR-5-SUCCESS: Authorization succeeded for client (Unknown MAC) on Interface Fa3/0/13"
(Weird... why it's showing "success"? Anyway when the authentication restarts again after several minutes there won't be any "sucess" any more, as shown in my previous text file. They are)
Then I have the debug turnned on:
.Jan 25 12:47:21: %AUTHMGR-5-START: Starting 'dot1x' for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
INDJWSW01-2104#
.Jan 25 12:47:21: EAPOL pak dump Tx
.Jan 25 12:47:21: EAPOL Version: 0x3 type: 0x0 length: 0x0005
.Jan 25 12:47:21: EAP code: 0x1 id: 0x1 length: 0x0005 type: 0x1
.Jan 25 12:47:21: dot1x-packet(Fa3/0/13): EAPOL packet sent to client 0x5600009F (0019.f302.a378)
INDJWSW01-2104#
.Jan 25 12:47:23: EAPOL pak dump Tx
.Jan 25 12:47:23: EAPOL Version: 0x3 type: 0x0 length: 0x0005
.Jan 25 12:47:23: EAP code: 0x1 id: 0x1 length: 0x0005 type: 0x1
.Jan 25 12:47:23: dot1x-packet(Fa3/0/13): EAPOL packet sent to client 0x5600009F (0019.f302.a378)
INDJWSW01-2104#
.Jan 25 12:47:25: EAPOL pak dump Tx
.Jan 25 12:47:25: EAPOL Version: 0x3 type: 0x0 length: 0x0005
.Jan 25 12:47:25: EAP code: 0x1 id: 0x1 length: 0x0005 type: 0x1
.Jan 25 12:47:25: dot1x-packet(Fa3/0/13): EAPOL packet sent to client 0x5600009F (0019.f302.a378)
INDJWSW01-2104#
.Jan 25 12:47:27: %DOT1X-5-FAIL: Authentication failed for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
.Jan 25 12:47:27: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
.Jan 25 12:47:27: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
INDJWSW01-2104#
.Jan 25 12:47:27: %AUTHMGR-5-START: Starting 'mab' for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
.Jan 25 12:47:28: %MAB-5-FAIL: Authentication failed for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
.Jan 25 12:47:28: %AUTHMGR-7-RESULT: Authentication result 'fail' from 'mab' for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
.Jan 25 12:47:28: %AUTHMGR-7-FAILOVER: Failing over from 'mab' for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
.Jan 25 12:47:28: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (0019.f302.a378) on Interface Fa3/0/13 AuditSessionID 0A8F7325000010629B960A41
Then the message will repeat and repeat forever... It seems that the switch Tx the packets first... Any ideas???
Thanks!
Similar Messages
-
I have a website (Still being developed but at the testing stage) which works fine in IE but when viewed in Firefox It insists on authentication at every page, instead of just one login it repeats the login at every page.
Hi,
If it's Basic auth, please check if this happens in a [https://support.mozilla.org/en-US/kb/Managing-profiles new profile]. If it's okay, you can later [https://support.mozilla.org/en-US/kb/Recovering%20important%20data%20from%20an%20old%20profile?s=profile&r=1&e=sph&as=s copy the needed personal data] from the old profile. Firefox stores your personal data and settings in another location separate from its [http://kb.mozillazine.org/Installation_directory files/folder]. A new profile would have the default Firefox settings ('''Tools''' ('''Alt''' + '''T''') > [https://support.mozilla.org/en-US/kb/Options%20window '''Options'''], and [http://kb.mozillazine.org/About:config about:config] ), and usually would also be empty of any '''Extensions''' and themes ('''Appearance''') in Tools > Add-ons) and their settings. Also, a new profile would have no previous stored website data/settings etc., ('''Tools''' > [https://support.mozilla.org/en-US/kb/Clear%20Recent%20History '''Clear Recent History''']).
[https://support.mozilla.org/en-US/kb/Profiles?s=profile&r=2&e=sph&as=s Profiles Howto]
[http://kb.mozillazine.org/Profile_folder_-_Firefox Profile Folder & Files]
[http://kb.mozillazine.org/About:config_entries about:config Entries]
For NTLM authentication, you can try to automatically trust the domain in the [http://kb.mozillazine.org/Network.automatic-ntlm-auth.trusted-uris network.automatic-ntlm-auth.trusted-uris] list in [http://kb.mozillazine.org/About:config about:config], eg. domain.com
Not sure, but for Kerberos, I think you would have to use '''network.negotiate-auth.trusted-uris''' instead. -
How can I mirror all ports on CISCO 3750 switches to one Gigabyte port?
Hi,
I have a requirement to mirror all the ports on my 7 CISCO 3750 switches, which are in 3 separate stacks, to one single Gigabyte Ethernet port.
Does anyone know how I can do that?
Thanks in advance.Vlad, thanks a heap for your response.
I want to apply to my sitation. Please let me know if I get them right in the following:
Catalyst A
vlan 901
remote-span
monitor session 1 source interface fastethernet 1-48 (I want to monitor all ports on the CISCO 3725)
monitor session 1 destination remote vlan 901
Catalyst B
vlan 901
remote-span (If I don't need to monitor this switch, do I still need to put anything into this switch at all?)
Catalyst C
vlan 901
remote-span
monitor session 1 source interface fastethernet 1-48 (I want to monitor all ports on this switch as well)
monitor session 1 source remote vlan 901
monitor session 1 destination interface gigabitethernet 3 (There are 4 Gigabit Ethernet Uplink in CISCO 3750, I want all the traffic to go to port 3, is this the right way to do?)
Thanks in advance. -
How to stop itunes to react to the play key and apple remote?
Hi,
I guess this one is a popular one:
How can I stop iTunes from starting anytime I hit the "Play" / F8 key? The same for the Apple remote.
I don't want to use iTunes for music playback (It just can't handle my library and lacks tons of options like browse by date, etc.) other players have. I just need it to pump stuff into my iPod Touch (otherwise would have simply removed it from the system completely).
I am using an iMac and Macbook Pro with OSx 10.6.4.
Any working solutions appreciated; ideally an undocumented switch in the OS.
@Apple: This is annoying. The system is all about ease of use and most of the time it works great. Running into an issue like this is simply negating the whole philosophy.
Thanks and regsthis takes a while but if you want to hear the end of your songs do this:
1.right click on a song
2.click on the options tab
3.there is a space that reads: stop time. change that time to five seconds later and you will hear the end of the song
hope this helps -
the back button no longer works. I have disabled all add-ons,rebooted & reset the defaults for the browser and nothing has changed. This happens on all webpages.How do I get the back button to light up again?
Start Firefox in <u>[[Safe Mode]]</u> to check if one of the extensions or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox (Tools) > Add-ons > Appearance/Themes).
*Don't make any changes on the Safe mode start window.
*https://support.mozilla.com/kb/Safe+Mode
If it does work in Safe-mode then disable all extensions and then try to find which is causing it by enabling one at a time until the problem reappears.
*Use "Disable all add-ons" on the [[Safe mode]] start window to disable all extensions.
* Close and restart Firefox after each change via "File > Exit" (Mac: "Firefox > Quit"; Linux: "File > Quit")
Another possible cause is a problem with the file places.sqlite that stores the bookmarks and the history.
*http://kb.mozillazine.org/Bookmarks_history_and_toolbar_buttons_not_working_-_Firefox
*https://support.mozilla.com/kb/Bookmarks+not+saved#w_places-database-file -
How to arrange RJ45-DB25 converter for the 8 pins
Hi guys
I am trying to connect my laptop to cisco router console and so far I have roll-over cable with RJ45-DB25 and my laptop has DB25 connector which I usually use for printer.
can anyone tell me how to arrange the 8 pins from RJ45-db25 converter?I am trying to access the console the cisco router using RJ45-DB25 converter since my laptop does not have DB9 connector for me to use the Cisco management cable.
Any hint will greatly appreciated ... thx...
By the way, I found this website explaining lots of combination for the pinouts...but I am doubting myself to which I should apply...
http://64.233.183.104/search?q=cache:VlyAwdwuGT4J:www.perle.com/support/cabling/documents/RJ45_Non-Standard_Cabling_Example.doc+how+to+wiring+rj45-db25&hl=en&client=firefox-a
I am also able to narrow it down by finding from this website below:
http://pinouts.ru/data/pin_rj45todb25_cisco.shtml
I am confused with pin number 7 since from the diagram above link there are 2 pinouts I can use i.e. 4 and 5 for the RJ45...is that mean I can use either?
well hopefully someone has experiences in this...That is the only way that you will be able to get it to work, short of adding a standard serial port to your laptop. I am forced to use the same method to access my equipment also as my laptop has no serial port either, only USB.
The drivers for the USB to Serial adapter will make it look like a COM port on your laptop. Mine shows up as COM5. This will allow you to use your favorite terminal application with the adapter.
Steve -
Can't install the software for the Brother MFC-9440CN because it is not currently available from the Software Update server....how do I get the driver then..it ised to work in my old mac..but cant print to it in my new unit
Download the Brother Mountain Lion drivers here.
-
BODS 3.1 : How to trigger an email alert for the jobs on BODS server ?
Hi All.
I have this request.
BODS 3.1 : How to trigger an email alert for the jobs on BODS server ?
We have jobs scheduled on BODS running smoothly and absolutely fine.
But to check, i am logging into the admin console and check for the jobs status.
I would like to have an email to be received from BODS after each job is finished.
It could succuessful. Or it could fail.
Whatsoever, i wish to receive an email alert as soon as a job is finished.
Can anyone advise me as to whether this could be made possible.
And if yes, how this could be done.
Thanks for your help in advance.
In BOE CMC / for webi / schedule / we find an option to send email for a job success or a job failure.
Is there any option similar to that in BODS ?
Also would like to know :
how to use the smtp_to or mail_to functions ?
how to set up the smtp server for this ?
thanks
REgards
indu
Edited by: Indumathy Narayanan on May 31, 2011 3:47 PMHi.
Since am new to this BODS. I need some help.
I already have many jobs which are running absolutely fine.
And when a job runs, and finishes, am able to see the trace saying
e.g. :
Job_abc is completed successfully.
We got the smtp service activated for our test server.
and we hae a group email id.
I have put the details of the smtp server / ip address / and said apply restarted.
The i created a simple test script as below :
print (' Before email ' );
smtp_to('abc@company_name.com', 'Job ' || job_name() ||' on ' || host_name() || ' has FAILED',
' the job has failed', 0, 0);
print('After Email ');
It does send a email to as per smtp_to whatever email is specified.
But how to differentiate between a job success
And a job which has failed.
I wish to have a mail which says on the subject :
'Job ' || job_name() ||' on ' || host_name() || ' has completed successfully'
==> IF it is a success
OR
'Job ' || job_name() ||' on ' || host_name() || ' has failed'
==> if it has failed
How to make the system identify, whether
to send a success message or a error message whatever
Could anyone advise.
thanks
indu -
I am unable to share photos from the Iphoto program because I don't know the password for the SMTP account. How can I either retrieve or change that password? Or is it one I already should know?
Have you set the general preferences in iPhoto to email using iPhoto? Then change it to email using "Mail". This way iPhoto will use your regular Mail account.
-
How do I use the VIs for the Fluke Hydra Series 2620a multimeter?
This message refers to the VIs found at this link:
http://sine.ni.com/apps/we/niid_web_display.download_page?p_id_guid=E3B19B3E9468659CE034080020E74861
How do I use the VIs for the Fluke Hydra Series 2620a multimeter? I am conducting a Senior Design Project at Temple University. It is a Control System where I need to read voltages from sensors and output voltages to different system components. I am trying to set up a VI using the VIs found above to make sure that I can successfully read and send voltages. There was no documentation given with the 2620a VIs.Unfortunately, you've got a very old driver for an old instrument. The only available help is to turn on Context Help and move your mouse over the VI icon. It doesn't appear to have any help for individual controls and indicators. The only good news is that it appears to be a simple instrument with only a few functions. There's some main ones line initialize (to set serial port), configure channel, configure instr, and read values. One main thing is whether you're using gpib or serial, Each front panel has a setting. If it's gpib, set the port to the gpib address. If it's serial, set the port to one number less than the com port you're connected to. For example, if you're using Com1, set the port to 0. For the other controls, I'm afraid that you're going to have to try and compare what's there with the controls and settings of the actual instrument. Having access to the instrument manual will be essential. I would engourage you to experiment a little. There's probably very little chance of damaging the instrument especially if nothing is hooked up to it. Send a command and see what happens or set the instrument up manually and see if you can reproduce that via remote control.
-
I have bought an used Iphone 5. I dont have the password for the existing login id of the old owner. How do i use the phone and change the log in id?
Unfortunatly the only way that you can get it off is to get the old user to input the password. You may need to contact that old user and see if he can put the old password in. hope this helps.
-
How to get the values for the Authorization Object Fields....
Hi Everyone,
I'm pretty new to the SAP Security and have been working on the Basis sides...I created a new role in PFCG and added a few transactions (ME13) and clicked on the Authorizations tab. In there, the authorization tree is in yellow and red. After providing the Org Values, only the yellow lights remain (apart from the green one ofcourse). Now how do we get the values for the different auth obj fields that are in yellow... say for example
Conditions COND
Maintain Condition: Auth. for Use/Appl./Cond.Type/Table V_KOND_VEA
Activity 03 ACTVT
Application KAPPL
Condition table KOTABNR
Condition Type KSCHL
Usage of the condition table KVEWE
Here the values for V_KOND_VEA fields e.g. KAPPL, KOTABNR etc are missing.
My question is how do we get these values in regard to the requirement provided by the client...is it the functional guys who provide these values or else how is a security person supposed to know it...
All the help in this regard is sincerely appreciated along with the awarding of points...Hey thanks Alex and Catastrophe for the quick response...
I'll be sitting with the functional team and reviewing the roles created.
Thanks for all the help once more
Regards,
Akash. -
How to set up automatic payment for the purchase order
Hi, All,
I have one question how to set up automatically payment for the Rent Office purchase Order?
There is the requirement from the client. They want to create one kind of purchase order for the Office Rent, then pay the fees in the certain time of every month to the vendor for the rent fees without any invoice. Whatu2019s the normal solution for this kind of purchase order? Is it ERS? Or something else?
Please give me the details and business flow. Also please tell me how to setup in the SAP and T-code.
Thanks in advanceEither you can set up ERS or you can pay directly from the FI side.
Prerequisites
Evaluated receipt settlement must be flagged in the purchase order item.
The vendor must be flagged as being subject to ERS in the vendor master record.
The goods receipt must refer to a purchase order.
Goods-receipt-based Invoice Verification must be defined for the purchase order item.
A tax code must have been maintained in the purchase order item.
The order price of the materials may not be an estimated price.
If you flag a vendor as being subject to ERS, the system sets the ERS indicator as a default in each item when you create a purchase order for the vendor. You can prevent this happening for certain vendors by flagging the info record for the material and the vendor as not being subject to ERS.
In Purchasing, you can delete the default ERS indicator in a purchase order item.
Choose Logistics Invoice Verification ® Automatic Settlement ® Evaluated Receipt Settlement (ERS).
The selection screen appears.
You can use the following criteria to narrow down selection of the transactions to be settled:
Company code
Plant
Goods receipt posting date
Goods receipt document
Fiscal year of the goods receipt
Vendor
Purchase order and order item
You can define the selection criteria for the invoice documents by:
Delivery
Purchase order
Purchase order item
Goods receipt document
Credit memo
Invoice
Currency
Choose Execute.
The system issues a log for Evaluated Receipt Settlement, which displays the following:
Settled
In line with your selection criteria, the system displays all the order items that were settled (or if you are working in test mode, which would have been settled).
Could not be settled
In line with your selection criteria, the system displays all order items for which ERS is defined but could not be settled. It also lists the reasons.
If the system reports being unable to invoice a transaction, you should exclude the transaction from ERS to avoid it being included in the log the next time ERS is run.
Select the item and choose Exclude from ERS.
The system also generates and possibly sends a message to inform the vendor(s) about the transaction settled, depending on the settings in Customizing.
You can display the following environment information for the order items selected. To do this, choose Goto ®:
Display purchase order
Display invoice
Display material document
Display long text -
How to make a RTF-Template for the Bill Presentment Architecture (BPA)
Hallo,
I search a way to make an external RTF-template for the Oracle Receivables Balance Forward - Detail report in the Bill Presentment Architecture (BPA).
I've never done that.
I don't know how to get a XML-file of this request to use for the creation of the RTF-file.
And so I don't know how to specify in the RTF the LOOPs for the Lines and other If-conditions and so on.
Can anybody help me?
Thanks.
Edited by: user2609890 on 23.06.2009 01:25HI,
Can you please help me in finding XML output for Invoice Print BPA Child Program. I have tried changing the output format to XML but no luck. If you can send me any suggestion to my email address [email protected] would be very helpful.
Also, Did you try adding any conditional formatting (eg. <?if:column_name='value'?>) in RTF template? is it working?
Any help is appreciated.
Thanks
Deepak -
How to obtain the license for the mentioned products.
Hi All,
Please help me in below licensing issues.
1) Our functional team got the below error while accessing "Job Scheduling Workbench".
Error: The Workbench is inaccessible because Oracle Manufacturing Scheduling has not been licensed. Please work with your Account Manger to purchase the license.
2) Another error message while accessing the navigation Flow Manufacturing --> Product Sync --> Flow Routings
Error: APP-BOM 20972: You cannot access this form
Cause: You do not have a license for Oracle Flow Manufacturing.
Action: Obtain a license for Oracle Flow Manufacturing.
Please guide me how to obtain the license for the above products.
Environment: eBS R12.1.3 on Linux 5.8
Regards,
SivaThanks for providing the document. I follow the document and get back to you for any issues.
Regards,
Siva.
Maybe you are looking for
-
Problems in exporting data to Excel from WebDynpro
Hi, I'm trying to transport data to Excel using the WebDynpro Binary Cache. The table data I have has certain special characters like & , < and > . I get an XML Parse error while trying to retrieve the XML List from the Binary Cache. The detailed err
-
Where is View Source? How can the source code of a website be viewed?
Where is View Source? How can the source code of a website be viewed? View Source used to be accessed via a drop-down menu, but no longer. Why? I'm using Firefox 24.0.
-
I am trying to export a slideshow from iPhoto in HD720p however upon the completion of the export into a USB, the file is much smaller in size than it should be and the slideshow freezes at about halfway ALTHOUGH the music that is over the top of the
-
When I try to play a video tap play and the address bar goes to blank WHY
When I click on play mu address bar goes to blank like its not finding the address
-
Can I open Organizer in PSE 9 without having it organize my images?
I'm using PSE 9 strictly for its editing capabilities. I have over 8,000 images stored on my PC and don't want their organizational system changed. Horror stories seem to indicate Organizer will automatically try to reorganize my images if I open i