802.1x - Secuirty policies

Hello All
for 802.1x authentication what should be the security policy confgiured on the WLC
[WPA2][Auth(PSK)]
or
[WPA2][Auth(802.1X)]
or
hope to get some help
VR

WPA2 is not available alone. You need to select WPA+WPA2 as many clients still work on WPA.
Wi-Fi Protected Access (WPA or WPA1) and WPA2 are standards-based security solutions from the Wi-Fi Alliance that provide data protection and access control for wireless LAN systems. WPA1 is compatible with the IEEE 802.11i standard but was implemented prior to the standard’s ratification; WPA2 is the Wi-Fi Alliance's implementation of the ratified IEEE 802.11i standard.
By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and message integrity check (MIC) for data protection while WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Both WPA1 and WPA2 use 802.1X for authenticated key management by default.
You should select [WPA2][Auth(802.1X)]. 802.1x is the standard for wireless LAN security, as defined by IEEE, is called 802.1X for 802.11, or simply 802.1X. An access point that supports 802.1X acts as the interface between a wireless client and an authentication server, such as a RADIUS server, to which the access point communicates over the wired network. If 802.1X is selected, only 802.1X clients are supported.
-Thanks
Vinod
**Encourage Contributors. RATE Them.**

Similar Messages

  • Applet- RS232 serial communication

    Hi,
    Can any one tell how to do applet -RS232 serial communication?Do i signed applets? any secuirty policies to incorporated?
    Thanx
    /JP

    you need to install the jre, and place the win32.dll at JavaSoft\JRE\1.3.1_06\bin, that properties file place at JavaSoft\JRE\1.3.1_06\lib, comm.jar at JavaSoft\JRE\1.3.1_06\lib\ext\
    and in ur code try to use it to open ur com port
    public String test() {
    String drivername = "com.sun.comm.Win32Driver";
    try
    CommDriver driver = (CommDriver) Class.forName(drivername).newInstance(); driver.initialize();
    catch (Throwable th)
    {* Discard it */}
    drivername = "javax.comm.*";
    try
    CommDriver driver = (CommDriver) Class.forName(drivername).newInstance(); driver.initialize();
    catch (Throwable th)
    {* Discard it */}
    portList = CommPortIdentifier.getPortIdentifiers();
    while (portList.hasMoreElements()) {
    portId = (CommPortIdentifier) portList.nextElement();
    if (portId.getPortType() == CommPortIdentifier.PORT_SERIAL) {
    if (portId.getName().equals("COM2")) {
    //if (portId.getName().equals("/dev/term/a")) {
    try {
    serialPort = (SerialPort)
    portId.open("SimpleWriteApp", 2000);
    } catch (PortInUseException e) {}
    try {
    outputStream = serialPort.getOutputStream();
    } catch (IOException e) {}
    try {
    serialPort.setSerialPortParams(9600,
    SerialPort.DATABITS_8,
    SerialPort.STOPBITS_1,
    SerialPort.PARITY_NONE);
    } catch (UnsupportedCommOperationException e) {}
    int i=0;
    while(true)
    try {
    messageString="hi";
    System.out.println(i++);
    outputStream.write(messageString.getBytes());
    } catch (IOException e)
    System.out.println(e);
    messageString=String.valueOf(e);
    return messageString;
    and yet u need to signed the applet
    1. Compile the applet
    2. Create a JAR file
    3. Generate Keys
    4. Sign the JAR file
    5. Export the Public Key Certificate
    6. Import the Certificate as a Trusted Certificate
    7. Create the policy file
    8. Run the applet
    Susan
    Susan bundles the applet executable in a JAR file, signs the JAR file, and exports the public key certificate.
    1. Compile the Applet
    In her working directory, Susan uses the javac command to compile the SignedAppletDemo.java class. The output from the javac command is the SignedAppletDemo.class.
    javac SignedAppletDemo.java
    2. Make a JAR File
    Susan then makes the compiled SignedAppletDemo.class file into a JAR file. The -cvf option to the jar command creates a new archive (c), using verbose mode (v), and specifies the archive file name (f). The archive file name is SignedApplet.jar.
    jar cvf SignedApplet.jar SignedAppletDemo.class
    3. Generate Keys
    Susan creates a keystore database named susanstore that has an entry for a newly generated public and private key pair with the public key in a certificate. A JAR file is signed with the private key of the creator of the JAR file and the signature is verified by the recipient of the JAR file with the public key in the pair. The certificate is a statement from the owner of the private key that the public key in the pair has a particular value so the person using the public key can be assured the public key is authentic. Public and private keys must already exist in the keystore database before jarsigner can be used to sign or verify the signature on a JAR file.
    In her working directory, Susan creates a keystore database and generates the keys:
    keytool -genkey -alias signFiles -keystore susanstore -keypass kpi135 -dname "cn=jones" -storepass ab987c
    This keytool -genkey command invocation generates a key pair that is identified by the alias signFiles. Subsequent keytool command invocations use this alias and the key password (-keypass kpi135) to access the private key in the generated pair.
    The generated key pair is stored in a keystore database called susanstore (-keystore susanstore) in the current directory, and accessed with the susanstore password (-storepass ab987c).
    The -dname "cn=jones" option specifies an X.500 Distinguished Name with a commonName (cn) value. X.500 Distinguished Names identify entities for X.509 certificates.
    You can view all keytool options and parameters by typing:
    keytool -help
    4. Sign the JAR File
    JAR Signer is a command line tool for signing and verifying the signature on JAR files. In her working directory, Susan uses jarsigner to make a signed copy of the SignedApplet.jar file.
    jarsigner -keystore susanstore -storepass ab987c -keypass kpi135 -signedjar SSignedApplet.jar SignedApplet.jar signFiles
    The -storepass ab987c and -keystore susanstore options specify the keystore database and password where the private key for signing the JAR file is stored. The -keypass kpi135 option is the password to the private key, SSignedApplet.jar is the name of the signed JAR file, and signFiles is the alias to the private key. jarsigner extracts the certificate from the keystore whose entry is signFiles and attaches it to the generated signature of the signed JAR file.
    5. Export the Public Key Certificate
    The public key certificate is sent with the JAR file to the whoever is going to use the applet. That person uses the certificate to authenticate the signature on the JAR file. To send a certificate, you have to first export it.
    The -storepass ab987c and -keystore susanstore options specify the keystore database and password where the private key for signing the JAR file is stored. The -keypass kpi135 option is the password to the private key, SSignedApplet.jar is the name of the signed JAR file, and signFiles is the alias to the private key. jarsigner extracts the certificate from the keystore whose entry is signFiles and attaches it to the generated signature of the signed JAR file.
    5: Export the Public Key Certificate
    The public key certificate is sent with the JAR file to the whoever is going to use the applet. That person uses the certificate to authenticate the signature on the JAR file. To send a certificate, you have to first export it.
    In her working directory, Susan uses keytool to copy the certificate from susanstore to a file named SusanJones.cer as follows:
    keytool -export -keystore susanstore -storepass ab987c -alias signFiles -file SusanJones.cer
    Ray
    Ray receives the JAR file from Susan, imports the certificate, creates a policy file granting the applet access, and runs the applet.
    6. Import Certificate as a Trusted Certificate
    Ray has received SSignedApplet.jar and SusanJones.cer from Susan. He puts them in his home directory. Ray must now create a keystore database (raystore) and import the certificate into it. Ray uses keytool in his home directory /home/ray to import the certificate:
    keytool -import -alias susan -file SusanJones.cer -keystore raystore -storepass abcdefgh
    7. Create the Policy File
    The policy file grants the SSignedApplet.jar file signed by the alias susan permission to create newfile (and no other file) in the user's home directory.
    Ray creates the policy file in his home directory using either policytool or an ASCII editor.
    keystore "/home/ray/raystore";
    // A sample policy file that lets a JavaTM program
    // create newfile in user's home directory
    // Satya N Dodda
    grant SignedBy "susan"
    permission java.security.AllPermission;
    8. Run the Applet in Applet Viewer
    Applet Viewer connects to the HTML documents and resources specified in the call to appletviewer, and displays the applet in its own window. To run the example, Ray copies the signed JAR file and HTML file to /home/aURL/public_html and invokes Applet viewer from his home directory as follows:
    Html code :
    </body>
    </html>
    <OBJECT classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93"
    width="600" height="400" align="middle"
    codebase="http://java.sun.com/products/plugin/1.3/jinstall-13-win32.cab#Version=1,3,1,2">
    <PARAM NAME="code" VALUE="SignedAppletDemo.class">
    <PARAM NAME="archive" VALUE="SSignedApplet.jar">
    <PARAM NAME="type" VALUE="application/x-java-applet;version=1.3">
    </OBJECT>
    </body>
    </html>
    appletviewer -J-Djava.security.policy=Write.jp
    http://aURL.com/SignedApplet.html
    Note: Type everything on one line and put a space after Write.jp
    The -J-Djava.security.policy=Write.jp option tells Applet Viewer to run the applet referenced in the SignedApplet.html file with the Write.jp policy file.
    Note: The Policy file can be stored on a server and specified in the appletviewer invocation as a URL.
    9. Run the Applet in Browser
    Download JRE 1.3 from Javasoft
    good luck! [email protected]
    i already give u many tips, i use 2 weeks to try this to success, hopw that u understand that, a result of success is not important, the process of how to get things done is most usefull!

  • BB 9630 Not accepting drivers in Windows

    Ok, this is my first post, but I'm not a newbie to BBs, but I'm open to ideas (hince this website
    Here's the issue:
    We have a bunch of BB 9630s with the 4.7.1.57 OS
    We are not able to upgrade our BBs (secuirty policies by our company)
    We are using BDM 4.2.18
    Root Issue: When connecting the BB to the computer by USB, it asks for the drivers. I point windows to C:\PROGRAM FILES\COMMON FILES\RESEARCH IN MOTION\USB DRIVERS, but it does not take to it (states that it could not find any drivers for this device, etc...)
    I have fully uninstalled the BDM, BBHH Drivers (for the 9630) and reinstalled them. I have even tried using BDM 5.0 and no joy.
    I pulled the drivers from Sprints website and they did not work.
    I tried a few different BBs (all same 9630s, 4.7.1.57 OS and all Sprint) and they all do the same thing.
    Here's a kicker, tried it on different computers and still getting the same thing.
    Am I missing something?

    Verizon  ver 4.7.1.61 is the OS I'm running on my Tour.  The only difference is that my pc OS is Win 7.
    Did you also check HK_Current_User to see if any traces of RIM are left under the Software key after your uninstall?
    I would also check the %windir%\inf folder to see if there's a .inf driver file related to your device. Keep in mind that if you do find one, there will also be an associated .pnf file as well. 
    Here's a ref.  http://support.microsoft.com/kb/813449
    It's only happened to me once but I did run into a similar situation where I couldn't install a device until I deleted the existing .inf and .pnf files.  In that particular case, the new driver inf file and the old one had the exact same name and the old file was never overwritten during the install.
    Search the folder looking for any .inf or .pnf file that contains "Research or "Research in Motion"
    Err on the side of caution and make a copy of the files before you delete them if you do find any.
    Instead of launching the executable directly, you can extract the install files to a directory of your choice using WinRAR.  By doing so, you will know the exact name of the folder which "should" contain the proper drivers.
    I have Blackberry Device Manager running in my system tray.  The drivers listed are as follows:
    Blackberry Device Manager     ver.  5.0.1.11
    BBDevMgr.                               ver.  4.1.0.12
    RIM USB Driver                        ver.  4.1.0.4
    RIM USB Serial Driver              ver.  2.2.0.3
    Also, what's the file date and timestamp on the .inf file in C:\Program Files\Common Files\Research In Motion\USB Drivers?

  • 802.1x/EAP-TTLS and EAP Certificate Policies

    Hello,
    I am having a hard time with 802.1x authentication against a radius server I manage. Every time I try to connect, I get a pop up about certificate verification - the certificate cannot be verified because there are no explicit trust settings. This system is to be used to authenticate people on a wireless network we are setting up. The machines and people being authenticated are not managed - I do not have the ability to force a configuration on their computer.
    After researching this it looks like OS X has certificate policies that are consulted depending on the certificate operation requested. For 802.1x, I think the EAP certificate policy and the x.509 basic policy are consulted. These policies are outlined here.
    The problem is that when I get the certificate popup and hit 'View Certificate', I don't see anything that would explain why it is not being verified. Both the server certificate and the CA root certificate are listed as valid. There are no messages about insufficient extended key usage values or hostname mismatches or anything. How can I tell what is actually wrong?

    I was hoping this could be accomplished without having to change the trust settings from whatever the default is. The people who will ultimately be using this are students and staff at a University - a moderate number of which are bothered by any appearance of lower security.
    The root cert is in X509Anchors. The certificate CN is the IP address and the RADIUS server does not have a PTR record in the DNS server.
    If I point Firefox at a website set up on the same machine with the same certificate, there are no complaints. If I use Safari, there is an error about the names not matching but the name listed on the cert according to Safari is the same name I typed in the address field and the same name listed in the ServerName configuration of the web server.
    Just kind of a weird problem.

  • 802.1X wirelss restriction on User Login policies

    Hi all,
    Seeking some technical idea on Wireless 802.1x setup.
    Business requirement is:
    "User login policy: to limit the number of concurrent login by a single user only apply to one device at any given time. "
    There is no problem on PEAP/MSCHAPv2 login, only thing is the same user credential able to be use and login on multiple device, in the same time.
    On the NAD part, we configure these on WLC but still cannot achieve our objective
    - advanced eap max-login-ignore-identity-response disable
    - netuser maxuserLogin 1
    Seeking technical solution on this case, please advice. Is there anything need to tweak on the directory server or ACS part?
    The components using as below:
    Supplicant 1: Window 7, authentication method using PEAP/MSCHAPv2
    Supplicant 2: iPhone iOS version 6.x
    Authenticator: Cisco Wireless Controller 5800 Series on code version 7.2
    Authentication server: Cisco secure server ACS 5.3.0.40
    Identity Source : Microsoft server 2008 R2 ADDS, single forest single domain.
    attached the network diagram: topo1.png

    http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/112175-acs51-peap-deployment-00.html

  • 802.1X and automatic vlan assignment

    Hello,
    I'm testing a 802.1X infrastructure :
    Switch : Try with Netgear Prosafe GS728TPS and Cisco SF300
    Radius Server  : Microsoft NPS
    DHCP Relay for address assignement by Vlan
    I have created some policies with simple authentication for testing (MSCHAP V2) and vlan assignement or not (depend on Active Directory Group).
    All work fine on a Windows 7 Pro. The user 1 is authenticated whithout vlan and the user 2 is authenticated with a vlan.
    The DHCP works fine and the 2 users have an IP.
    When I try on MAC OS X (ver. 10.7.2 and ver. 10.9.2) the user 1 (whithout vlan) work fine. I have an IP and access to the LAN. But the user 2 (with vlan) don't work. The Mac don't get an IP and I'm not on the VLAN. If i push manually an IP of the vlan, I have no access to the VLAN.
    There are some specifics parameters to add for enable vlan on Mac OS X ?
    Thanks for reply
    Ben

    Edit : It's for wired connections

  • 802.1x Windows 2012 IAS

    Hello I´m trying to setup 802.1x on an old 3560 switch.
    The Switch is a:
    Switch   Ports  Model              SW Version              SW Image
    *    1   52     WS-C3560-48TS      12.2(25)SEE3            C3560-ADVIPSERVICESK
    I´m using Windows 2012 IAS as RADIUS with the following policies:
    I have the folling config on the switch:
    aaa group server radius RadiusAuth
    server 172.29.8.12 auth-port 1645 acct-port 1646
    aaa authentication login default local
    aaa authentication login local enable
    aaa authentication dot1x default group RadiusAuth
    aaa authorization network default group RadiusAuth
    dot1x system-auth-control
    interface FastEthernet0/31
    description 802.1x tests
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x timeout quiet-period 3
    dot1x timeout tx-period 5
    dot1x guest-vlan 106
    spanning-tree portfast
    radius-server host 172.29.8.12 auth-port 1645 acct-port 1646
    radius-server retry method reorder
    radius-server transaction max-tries 10
    radius-server timeout 4
    radius-server deadtime 2
    radius-server key KEYSECRET
    radius-server vsa send authentication
    And I cant authenticate , I think it is a RADIUS problem.
    I have this aditional debug info related with RADIUS and Dot1x:
    004898: Aug  5 12:32:28: %LINK-3-UPDOWN: Interface FastEthernet0/31, changed state to down
    004899: 7w6d: RADIUS(00000019): Storing nasport 50031 in rad_db
    004900: 7w6d: RADIUS(00000019): Config NAS IP: 0.0.0.0
    004901: 7w6d: RADIUS/ENCODE(00000019): acct_session_id: 27787264
    004902: 7w6d: RADIUS(00000019): sending
    004903: 7w6d: RADIUS/ENCODE: Best Local IP-Address 172.29.11.1 for Radius-Server 172.29.8.12
    004904: 7w6d: RADIUS(00000019): Send Access-Request to 172.29.8.12:1645 id 21645/77, len 173
    004905: 7w6d: RADIUS:  authenticator A7 3A 07 F8 8D 5B C1 76 - 67 8E 66 54 05 04 0C DB
    004906: 7w6d: RADIUS:  User-Name           [1]   19  "DOMAIN\User"
    004907: 7w6d: RADIUS:  Service-Type        [6]   6   Framed                    [2]
    004908: 7w6d: RADIUS:  Framed-MTU          [12]  6   1500
    004909: 7w6d: RADIUS:  Called-Station-Id   [30]  19  "00-17-94-97-D9-23"
    004910: 7w6d: RADIUS:  Calling-Station-Id  [31]  19  "00-24-BE-C7-09-6F"
    004911: 7w6d: RADIUS:  EAP-Message         [79]  24
    004912: 7w6d: RADIUS:   02 02 00 16 01 44 49 47 49 54 41 49 4E 45 52 5C  [?????DOMAIN\]
    004913: 7w6d: RADIUS:   6F 6C 6F 70 65 7A                                [USER]
    004914: 7w6d: RADIUS:  Message-Authenticato[80]  18
    004915: 7w6d: RADIUS:   31 C9 68 BA B8 E9 DC 78 6E 87 7E A4 89 D5 0C 81  [1?h????xn?~?????]
    004916: 7w6d: RADIUS:  Vendor, Cisco       [26]  24
    004917: 7w6d: RADIUS:   cisco-nas-port     [2]   18  "FastEthernet0/31"
    004918: 7w6d: RADIUS:  NAS-Port            [5]   6   50031
    004919: 7w6d: RADIUS:  NAS-Port-Type       [61]  6   Eth                       [15]
    004920: 7w6d: RADIUS:  NAS-IP-Address      [4]   6   172.29.11.1
    004921: Aug  5 12:32:32: %LINK-3-UPDOWN: Interface FastEthernet0/31, changed state to up
    004922: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004923: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004924: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004925: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004926: 7w6d: RADIUS(00000019): Storing nasport 50031 in rad_db
    004927: 7w6d: RADIUS(00000019): Config NAS IP: 0.0.0.0
    004928: 7w6d: RADIUS/ENCODE(00000019): acct_session_id: 27787264
    004929: 7w6d: RADIUS(00000019): sending
    004930: 7w6d: RADIUS/ENCODE: Best Local IP-Address 172.29.11.1 for Radius-Server 172.29.8.12
    004931: 7w6d: RADIUS(00000019): Send Access-Request to 172.29.8.12:1645 id 21645/78, len 173
    004932: 7w6d: RADIUS:  authenticator 84 B1 75 9D 4C 21 0F 9D - 19 01 A6 23 DE 1B 74 1A
    004933: 7w6d: RADIUS:  User-Name           [1]   19  "DOMAIN\User"
    004934: 7w6d: RADIUS:  Service-Type        [6]   6   Framed                    [2]
    004935: 7w6d: RADIUS:  Framed-MTU          [12]  6   1500
    004936: 7w6d: RADIUS:  Called-Station-Id   [30]  19  "00-17-94-97-D9-23"
    004937: 7w6d: RADIUS:  Calling-Station-Id  [31]  19  "00-24-BE-C7-09-6F"
    004938: 7w6d: RADIUS:  EAP-Message         [79]  24
    004939: 7w6d: RADIUS:   02 03 00 16 01 44 49 47 49 54 41 49 4E 45 52 5C  [?????DDOMAIN\]
    004940: 7w6d: RADIUS:   6F 6C 6F 70 65 7A                                [User]
    004941: 7w6d: RADIUS:  Message-Authenticato[80]  18
    004942: 7w6d: RADIUS:   D3 1E DC 03 5E 13 CF 93 6B 7F F4 B8 DB 20 65 A6  [????^???k???? e?]
    004943: 7w6d: RADIUS:  Vendor, Cisco       [26]  24
    004944: 7w6d: RADIUS:   cisco-nas-port     [2]   18  "FastEthernet0/31"
    004945: 7w6d: RADIUS:  NAS-Port            [5]   6   50031
    004946: 7w6d: RADIUS:  NAS-Port-Type       [61]  6   Eth                       [15]
    004947: 7w6d: RADIUS:  NAS-IP-Address      [4]   6   172.29.11.1
    004948: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004949: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004950: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004951: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004952: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004953: Aug  5 12:33:04: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.29.8.12:1645,1646 is not responding.
    004954: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004955: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004956: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004957: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/77
    004958: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004959: 7w6d: RADIUS: No response from (172.29.8.12:1645,1646) for id 21645/77
    004960: 7w6d: RADIUS/DECODE: parse response no app start; FAIL
    004961: 7w6d: RADIUS/DECODE: parse response; FAIL
    004962: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004963: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004964: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004965: 7w6d: RADIUS: Retransmit to (172.29.8.12:1645,1646) for id 21645/78
    004966: 7w6d: RADIUS: No response from (172.29.8.12:1645,1646) for id 21645/78
    004967: 7w6d: RADIUS/DECODE: parse response no app start; FAIL
    004968: 7w6d: RADIUS/DECODE: parse response; FAIL
    004969: Aug  5 12:35:04: %RADIUS-4-RADIUS_ALIVE: RADIUS server 172.29.8.12:1645,1646 has returned.
    DOT1X
    005294: 7w6d: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/31
    005295: 7w6d: dot1x-registry:dot1x_switch_port_linkcomingup invoked on interface Fa0/31
    005296: 7w6d: dot1x-ev:dot1x_mgr_if_state_change: FastEthernet0/31 has changed to UP
    005297: 7w6d:     dot1x_auth Fa0: initial state auth_initialize has enter
    005298: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_initialize_enter called
    005299: 7w6d:     dot1x_auth Fa0: during state auth_initialize, got event 0(cfg_auto)
    005300: 7w6d: @@@ dot1x_auth Fa0: auth_initialize -> auth_disconnected
    005301: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_disconnected_enter called
    005302: 7w6d:     dot1x_auth Fa0: idle during state auth_disconnected
    005303: 7w6d: @@@ dot1x_auth Fa0: auth_disconnected -> auth_restart
    005304: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_enter called
    005305: 7w6d: dot1x-ev:Sending create new context event to EAP for 0000.0000.0000
    005306: 7w6d:     dot1x_auth_bend Fa0: initial state auth_bend_initialize has enter
    005307: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_initialize_enter called
    005308: 7w6d:     dot1x_auth_bend Fa0: initial state auth_bend_initialize has idle
    005309: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_initialize, got event 16383(idle)
    005310: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_initialize -> auth_bend_idle
    005311: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_enter called
    005312: 7w6d: dot1x-ev:Created a client entry for the supplicant 0000.0000.0000
    005313: 7w6d: dot1x-ev:Created a default authenticator instance on FastEthernet0/31
    005314: 7w6d: dot1x-ev:dot1x_switch_enable_on_port:  Enabling dot1x on interface FastEthernet0/31
    005315: 7w6d: dot1x-ev:dot1x_switch_enable_on_port: set dot1x ask handler on interface FastEthernet0/31
    005316: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005317: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005318: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005319: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_enter called
    005320: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_connecting_action called
    005321: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005322: 7w6d: dot1x-sm:Posting RX_REQ on Client=39E7F78
    005323: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    005324: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_authenticating
    005325: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authenticating_enter called
    005326: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_authenticating_action called
    005327: 7w6d: dot1x-sm:Posting AUTH_START on Client=39E7F78
    005328: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_idle, got event 4(eapReq_authStart)
    005329: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_idle -> auth_bend_request
    005330: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005331: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1  data:
    005332: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005333: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005334: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005335: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005336: 7w6d: EAPOL pak dump Tx
    005337: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005338: 7w6d: EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1
    005339: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005340: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_request_action called
    005341: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005342: 7w6d: dot1x-packet:dot1x_mgr_process_eapol_pak: queuing an EAPOL pkt on Authenticator Q
    005343: 7w6d: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    005344: 7w6d: dot1x-packet:Received an EAPOL frame on interface FastEthernet0/31
    005345: 7w6d: dot1x-ev:Received pkt saddr =0024.bec7.096f , daddr = 0180.c200.0003,
                        pae-ether-type = 888e.0100.0016
    005346: 7w6d: dot1x-ev:Created a client entry for the supplicant 0024.bec7.096f
    005347: 7w6d: dot1x-ev:Found the default authenticator instance on FastEthernet0/31
    005348: 7w6d: dot1x-registry:EAPOL traffic seen on FastEthernet0/31
    005349: 7w6d: dot1x-packet:Received an EAP packet on interface FastEthernet0/31
    005350: 7w6d: EAPOL pak dump rx
    005351: 7w6d: EAPOL Version: 0x1  type: 0x0  length: 0x0016
    005352: 7w6d: dot1x-packet:Received an EAP packet on the FastEthernet0/31 from mac 0024.bec7.096f
    005353: 7w6d: dot1x-sm:Posting EAPOL_EAP on Client=39E7F78
    005354: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 6(eapolEap)
    005355: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_response
    005356: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_response_enter called
    005357: 7w6d: dot1x-ev:dot1x_sendRespToServer: Response sent to the server from 0024.bec7.096f
    005358: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_request_response_action called
    005359: Aug  5 12:39:28: %LINK-3-UPDOWN: Interface FastEthernet0/31, changed state to up
    005360: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005361: 7w6d: dot1x-packet:dot1x_mgr_process_eapol_pak: queuing an EAPOL pkt on Authenticator Q
    005362: 7w6d: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    005363: 7w6d: dot1x-packet:Received an EAPOL frame on interface FastEthernet0/31
    005364: 7w6d: dot1x-ev:Received pkt saddr =0024.bec7.096f , daddr = 0180.c200.0003,
                        pae-ether-type = 888e.0101.0000
    005365: 7w6d: dot1x-packet:Received an EAPOL-Start packet on interface FastEthernet0/31
    005366: 7w6d: EAPOL pak dump rx
    005367: 7w6d: EAPOL Version: 0x1  type: 0x1  length: 0x0000
    005368: 7w6d: dot1x-sm:Posting EAPOL_START on Client=39E7F78
    005369: 7w6d:     dot1x_auth Fa0: during state auth_authenticating, got event 4(eapolStart)
    005370: 7w6d: @@@ dot1x_auth Fa0: auth_authenticating -> auth_aborting
    005371: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_authenticating_exit called
    005372: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_aborting_enter called
    005373: 7w6d: dot1x-sm:Posting AUTH_ABORT on Client=39E7F78
    005374: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_response, got event 1(authAbort)
    005375: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_response -> auth_bend_initialize
    005376: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_response_exit called
    005377: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_initialize_enter called
    005378: 7w6d:     dot1x_auth_bend Fa0: idle during state auth_bend_initialize
    005379: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_initialize -> auth_bend_idle
    005380: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_idle_enter called
    005381: 7w6d: dot1x-sm:Posting !AUTH_ABORT on Client=39E7F78
    005382: 7w6d:     dot1x_auth Fa0: during state auth_aborting, got event 20(no_eapolLogoff_no_authAbort)
    005383: 7w6d: @@@ dot1x_auth Fa0: auth_aborting -> auth_restart
    005384: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_aborting_exit called
    005385: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_restart_enter called
    005386: 7w6d: dot1x-ev:Resetting the client 0024.bec7.096f
    005387: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_aborting_restart_action called
    005388: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005389: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005390: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005391: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_connecting_enter called
    005392: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_restart_connecting_action called
    005393: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0024.bec7.096f
    005394: 7w6d: dot1x-sm:Posting RX_REQ on Client=39E7F78
    005395: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    005396: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_authenticating
    005397: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_authenticating_enter called
    005398: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_connecting_authenticating_action called
    005399: 7w6d: dot1x-sm:Posting AUTH_START on Client=39E7F78
    005400: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_idle, got event 4(eapReq_authStart)
    005401: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_idle -> auth_bend_request
    005402: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_request_enter called
    005403: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1  data:
    005404: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005405: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005406: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005407: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005408: 7w6d: EAPOL pak dump Tx
    005409: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005410: 7w6d: EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1
    005411: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent to client (0024.bec7.096f)
    005412: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_idle_request_action called
    005413: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005414: 7w6d: dot1x-packet:dot1x_mgr_process_eapol_pak: queuing an EAPOL pkt on Authenticator Q
    005415: 7w6d: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    005416: 7w6d: dot1x-packet:Received an EAPOL frame on interface FastEthernet0/31
    005417: 7w6d: dot1x-ev:Received pkt saddr =0024.bec7.096f , daddr = 0180.c200.0003,
                        pae-ether-type = 888e.0100.0016
    005418: 7w6d: dot1x-packet:Received an EAP packet on interface FastEthernet0/31
    005419: 7w6d: EAPOL pak dump rx
    005420: 7w6d: EAPOL Version: 0x1  type: 0x0  length: 0x0016
    005421: 7w6d: dot1x-packet:Received an EAP packet on the FastEthernet0/31 from mac 0024.bec7.096f
    005422: 7w6d: dot1x-sm:Posting EAPOL_EAP on Client=39E7F78
    005423: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 6(eapolEap)
    005424: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_response
    005425: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_response_enter called
    005426: 7w6d: dot1x-ev:dot1x_sendRespToServer: Response sent to the server from 0024.bec7.096f
    005427: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_request_response_action called
    005428: 7w6d: dot1x-sm:Posting A_WHILE_EXPIRE on Client=39E7F78
    005429: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_response, got event 9(aWhile_expire)
    005430: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_response -> auth_bend_timeout
    005431: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_response_exit called
    005432: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_timeout_enter called
    005433: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_response_timeout_action called
    005434: 7w6d:     dot1x_auth_bend Fa0: idle during state auth_bend_timeout
    005435: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_timeout -> auth_bend_idle
    005436: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_bend_idle_enter called
    005437: 7w6d: dot1x-sm:Posting AUTH_TIMEOUT on Client=39E7F78
    005438: 7w6d:     dot1x_auth Fa0: during state auth_authenticating, got event 14(authTimeout)
    005439: 7w6d: @@@ dot1x_auth Fa0: auth_authenticating -> auth_fallback
    005440: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_authenticating_exit called
    005441: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_fallback_enter called
    005442: 7w6d: dot1x-sm:Posting AUTH_FAIL on Client=39E7F78
    005443: 7w6d:     dot1x_auth Fa0: during state auth_fallback, got event 15(authFail)
    005444: 7w6d: @@@ dot1x_auth Fa0: auth_fallback -> auth_authc_result
    005445: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_authc_result_enter called
    005446: 7w6d: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not applicable.  Supplicant disabled and EAPOL seen on port FastEthernet0/31.
    005447: 7w6d: dot1x-sm:Posting AUTHC_FAIL on Client=39E7F78
    005448: 7w6d:     dot1x_auth Fa0: during state auth_authc_result, got event 23(authcFail)
    005449: 7w6d: @@@ dot1x_auth Fa0: auth_authc_result -> auth_held
    005450: 7w6d: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not applicable.  Supplicant disabled and EAPOL seen on port FastEthernet0/31.
    005451: 7w6d: dot1x-sm:Posting RESTART on Client=39E7F78
    005452: 7w6d:     dot1x_auth Fa0: during state auth_held, got event 13(restart)
    005453: 7w6d: @@@ dot1x_auth Fa0: auth_held -> auth_restart
    005454: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_held_exit called
    005455: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_restart_enter called
    005456: 7w6d: dot1x-ev:Resetting the client 0024.bec7.096f
    005457: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005458: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005459: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005460: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_connecting_enter called
    005461: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_restart_connecting_action called
    005462: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0024.bec7.096f
    005463: 7w6d: dot1x-sm:Posting REAUTH_MAX on Client=39E7F78
    005464: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 11(reAuthMax)
    005465: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_disconnected
    005466: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_disconnected_enter called
    005467: 7w6d: dot1x-sm:Fa0/31:0024.bec7.096f:auth_disconnected_enter sending canned failure to version 1 supplicant
    005468: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x4  id: 0x4  length: 0x0004 type: 0x0  data:
    005469: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005470: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005471: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005472: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005473: 7w6d: EAPOL pak dump Tx
    005474: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0004
    005475: 7w6d: EAP code: 0x4  id: 0x4  length: 0x0004
    005476: 7w6d: dot1x-packet:dot1x_auth_txCannedFail: EAPOL packet sent to client (0024.bec7.096f)
    005477: 7w6d:     dot1x_auth Fa0: idle during state auth_disconnected
    005478: 7w6d: @@@ dot1x_auth Fa0: auth_disconnected -> auth_restart
    005479: 7w6d: dot1x-ev:dot1x_switch_port_unauthorized: Unauthorizing interface FastEthernet0/31
    005480: 7w6d: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/31
    005481: 7w6d: dot1x-ev:dot1x_vlan_assign_client_deleted on interface FastEthernet0/31
    005482: 7w6d:     dot1x_auth Fa0: initial state auth_initialize has enter
    005483: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_initialize_enter called
    005484: 7w6d:     dot1x_auth Fa0: during state auth_initialize, got event 0(cfg_auto)
    005485: 7w6d: @@@ dot1x_auth Fa0: auth_initialize -> auth_disconnected
    005486: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_disconnected_enter called
    005487: 7w6d:     dot1x_auth Fa0: idle during state auth_disconnected
    005488: 7w6d: @@@ dot1x_auth Fa0: auth_disconnected -> auth_restart
    005489: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_enter called
    005490: 7w6d: dot1x-ev:Sending create new context event to EAP for 0000.0000.0000
    005491: 7w6d:     dot1x_auth_bend Fa0: initial state auth_bend_initialize has enter
    005492: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_initialize_enter called
    005493: 7w6d:     dot1x_auth_bend Fa0: initial state auth_bend_initialize has idle
    005494: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_initialize, got event 16383(idle)
    005495: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_initialize -> auth_bend_idle
    005496: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_enter called
    005497: 7w6d: dot1x-ev:Created a client entry for the supplicant 0000.0000.0000
    005498: 7w6d: dot1x-ev:Created a default authenticator instance on FastEthernet0/31
    005499: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005500: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005501: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005502: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_enter called
    005503: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_connecting_action called
    005504: Aug  5 12:40:17: %RADIUS-4-RADIUS_ALIVE: RADIUS server 172.29.8.12:1645,1646 has returned.
    005505: 7w6d: dot1x-ev:dot1x_critical_active_state_change: Critical Auth Active state changed to FALSE
    005506: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005507: 7w6d: dot1x-sm:Posting RX_REQ on Client=39E7F78
    005508: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    005509: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_authenticating
    005510: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authenticating_enter called
    005511: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_authenticating_action called
    005512: 7w6d: dot1x-sm:Posting AUTH_START on Client=39E7F78
    005513: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_idle, got event 4(eapReq_authStart)
    005514: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_idle -> auth_bend_request
    005515: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005516: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1  data:
    005517: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005518: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005519: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005520: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005521: 7w6d: EAPOL pak dump Tx
    005522: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005523: 7w6d: EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1
    005524: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005525: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_request_action called
    005526: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005527: 7w6d: dot1x-sm:Posting EAP_REQ on Client=39E7F78
    005528: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 7(eapReq)
    005529: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_request
    005530: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_request_action called
    005531: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005532: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1  data:
    005533: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005534: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005535: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005536: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005537: 7w6d: EAPOL pak dump Tx
    005538: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005539: 7w6d: EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1
    005540: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005541: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005542: 7w6d: dot1x-sm:Posting EAP_REQ on Client=39E7F78
    005543: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 7(eapReq)
    005544: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_request
    005545: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_request_action called
    005546: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005547: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1  data:
    005548: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005549: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005550: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005551: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005552: 7w6d: EAPOL pak dump Tx
    005553: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005554: 7w6d: EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1
    005555: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005556: 7w6d: dot1x-ev:Received an EAP Timeout on FastEthernet0/31 for mac 0000.0000.0000
    005557: 7w6d: dot1x-sm:Posting EAP_TIMEOUT on Client=39E7F78
    005558: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 12(eapTimeout)
    005559: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_timeout
    005560: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_timeout_enter called
    005561: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_timeout_action called
    005562: 7w6d:     dot1x_auth_bend Fa0: idle during state auth_bend_timeout
    005563: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_timeout -> auth_bend_idle
    005564: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_enter called
    005565: 7w6d: dot1x-sm:Posting AUTH_TIMEOUT on Client=39E7F78
    005566: 7w6d:     dot1x_auth Fa0: during state auth_authenticating, got event 14(authTimeout)
    005567: 7w6d: @@@ dot1x_auth Fa0: auth_authenticating -> auth_fallback
    005568: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authenticating_exit called
    005569: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_fallback_enter called
    005570: 7w6d: dot1x-sm:Posting AUTH_FAIL on Client=39E7F78
    005571: 7w6d:     dot1x_auth Fa0: during state auth_fallback, got event 15(authFail)
    005572: 7w6d: @@@ dot1x_auth Fa0: auth_fallback -> auth_authc_result
    005573: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authc_result_enter called
    005574: 7w6d: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not applicable.  Supplicant disabled and EAPOL seen on port FastEthernet0/31.
    005575: 7w6d: dot1x-sm:Posting AUTHC_FAIL on Client=39E7F78
    005576: 7w6d:     dot1x_auth Fa0: during state auth_authc_result, got event 23(authcFail)
    005577: 7w6d: @@@ dot1x_auth Fa0: auth_authc_result -> auth_held
    005578: 7w6d: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not applicable.  Supplicant disabled and EAPOL seen on port FastEthernet0/31.
    005579: 7w6d: dot1x-sm:Posting RESTART on Client=39E7F78
    005580: 7w6d:     dot1x_auth Fa0: during state auth_held, got event 13(restart)
    005581: 7w6d: @@@ dot1x_auth Fa0: auth_held -> auth_restart
    005582: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_held_exit called
    005583: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_enter called
    005584: 7w6d: dot1x-ev:Resetting the client 0000.0000.0000
    005585: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005586: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005587: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005588: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_enter called
    005589: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_connecting_action called
    005590: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005591: 7w6d: dot1x-sm:Posting RX_REQ on Client=39E7F78
    005592: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    005593: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_authenticating
    005594: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authenticating_enter called
    005595: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_authenticating_action called
    005596: 7w6d: dot1x-sm:Posting AUTH_START on Client=39E7F78
    005597: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_idle, got event 4(eapReq_authStart)
    005598: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_idle -> auth_bend_request
    005599: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005600: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1  data:
    005601: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005602: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005603: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005604: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005605: 7w6d: EAPOL pak dump Tx
    005606: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005607: 7w6d: EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1
    005608: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005609: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_request_action called
    005610: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005611: 7w6d: dot1x-sm:Posting EAP_REQ on Client=39E7F78
    005612: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 7(eapReq)
    005613: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_request
    005614: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_request_action called
    005615: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005616: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1  data:
    005617: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005618: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005619: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005620: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005621: 7w6d: EAPOL pak dump Tx
    005622: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005623: 7w6d: EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1
    005624: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005625: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005626: 7w6d: dot1x-sm:Posting EAP_REQ on Client=39E7F78
    005627: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 7(eapReq)
    005628: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_request
    005629: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_request_action called
    005630: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005631: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1  data:
    005632: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005633: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005634: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005635: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005636: 7w6d: EAPOL pak dump Tx
    005637: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005638: 7w6d: EAP code: 0x1  id: 0x3  length: 0x0005 type: 0x1
    005639: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005640: 7w6d: dot1x-ev:Received an EAP Timeout on FastEthernet0/31 for mac 0000.0000.0000
    005641: 7w6d: dot1x-sm:Posting EAP_TIMEOUT on Client=39E7F78
    005642: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_request, got event 12(eapTimeout)
    005643: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_request -> auth_bend_timeout
    005644: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_timeout_enter called
    005645: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_timeout_action called
    005646: 7w6d:     dot1x_auth_bend Fa0: idle during state auth_bend_timeout
    005647: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_timeout -> auth_bend_idle
    005648: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_enter called
    005649: 7w6d: dot1x-sm:Posting AUTH_TIMEOUT on Client=39E7F78
    005650: 7w6d:     dot1x_auth Fa0: during state auth_authenticating, got event 14(authTimeout)
    005651: 7w6d: @@@ dot1x_auth Fa0: auth_authenticating -> auth_fallback
    005652: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authenticating_exit called
    005653: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_fallback_enter called
    005654: 7w6d: dot1x-sm:Posting AUTH_FAIL on Client=39E7F78
    005655: 7w6d:     dot1x_auth Fa0: during state auth_fallback, got event 15(authFail)
    005656: 7w6d: @@@ dot1x_auth Fa0: auth_fallback -> auth_authc_result
    005657: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authc_result_enter called
    005658: 7w6d: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not applicable.  Supplicant disabled and EAPOL seen on port FastEthernet0/31.
    005659: 7w6d: dot1x-sm:Posting AUTHC_FAIL on Client=39E7F78
    005660: 7w6d:     dot1x_auth Fa0: during state auth_authc_result, got event 23(authcFail)
    005661: 7w6d: @@@ dot1x_auth Fa0: auth_authc_result -> auth_held
    005662: 7w6d: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not applicable.  Supplicant disabled and EAPOL seen on port FastEthernet0/31.
    005663: 7w6d: dot1x-sm:Posting RESTART on Client=39E7F78
    005664: 7w6d:     dot1x_auth Fa0: during state auth_held, got event 13(restart)
    005665: 7w6d: @@@ dot1x_auth Fa0: auth_held -> auth_restart
    005666: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_held_exit called
    005667: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_enter called
    005668: 7w6d: dot1x-ev:Resetting the client 0000.0000.0000
    005669: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005670: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005671: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005672: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_enter called
    005673: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_connecting_action called
    005674: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005675: 7w6d: dot1x-sm:Posting REAUTH_MAX on Client=39E7F78
    005676: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 11(reAuthMax)
    005677: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_disconnected
    005678: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_disconnected_enter called
    005679: 7w6d:     dot1x_auth Fa0: idle during state auth_disconnected
    005680: 7w6d: @@@ dot1x_auth Fa0: auth_disconnected -> auth_restart
    005681: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_enter called
    005682: 7w6d: dot1x-ev:Resetting the client 0000.0000.0000
    005683: 7w6d: dot1x-sm:Posting !EAP_RESTART on Client=39E7F78
    005684: 7w6d:     dot1x_auth Fa0: during state auth_restart, got event 6(no_eapRestart)
    005685: 7w6d: @@@ dot1x_auth Fa0: auth_restart -> auth_connecting
    005686: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_enter called
    005687: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_restart_connecting_action called
    005688: 7w6d: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    005689: 7w6d: dot1x-sm:Posting RX_REQ on Client=39E7F78
    005690: 7w6d:     dot1x_auth Fa0: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    005691: 7w6d: @@@ dot1x_auth Fa0: auth_connecting -> auth_authenticating
    005692: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_authenticating_enter called
    005693: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_connecting_authenticating_action called
    005694: 7w6d: dot1x-sm:Posting AUTH_START on Client=39E7F78
    005695: 7w6d:     dot1x_auth_bend Fa0: during state auth_bend_idle, got event 4(eapReq_authStart)
    005696: 7w6d: @@@ dot1x_auth_bend Fa0: auth_bend_idle -> auth_bend_request
    005697: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_request_enter called
    005698: 7w6d: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x5  length: 0x0005 type: 0x1  data:
    005699: 7w6d: dot1x-ev:FastEthernet0/31:Sending EAPOL packet to group PAE address
    005700: 7w6d: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/31.
    005701: 7w6d: dot1x-registry:registry:dot1x_ether_macaddr called
    005702: 7w6d: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/31
    005703: 7w6d: EAPOL pak dump Tx
    005704: 7w6d: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    005705: 7w6d: EAP code: 0x1  id: 0x5  length: 0x0005 type: 0x1
    005706: 7w6d: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    005707: 7w6d: dot1x-sm:Fa0/31:0000.0000.0000:auth_bend_idle_request_action called
    005708: 7w6d: dot1x-registry:dot1x_switch_port_physical_linkchange invoked on interface Fa0/31
    005709: 7w6d: dot1x-ev:dot1x_mgr_if_state_change: FastEthernet0/31 has changed to DOWN
    005710: 7w6d: dot1x-ev:Cleared all authenticator instances on FastEthernet0/31
    Dot1x Info for FastEthernet0/31
    PAE                       = AUTHENTICATOR
    PortControl               = AUTO
    ControlDirection          = Both
    HostMode                  = SINGLE_HOST
    ReAuthentication          = Disabled
    QuietPeriod               = 3
    ServerTimeout             = 30
    SuppTimeout               = 30
    ReAuthPeriod              = 3600 (Locally configured)
    ReAuthMax                 = 2
    MaxReq                    = 2
    TxPeriod                  = 5
    RateLimitPeriod           = 0
    Guest-Vlan                = 106
    Any idea? thanks in advance.

    Did you try "Unencrypted authentication (PAP, SPAP)" tick in Network Policies?
    It's probably going to solve your problem

  • Client Exclusion Policies on WLC not working with ISE as RADIUS Server

    Hi,
    for our Guest WLAN (Security Setting for this SSID:Layer2: MAC filtering, Layer3:none) we use ISE as RADIUS Server. On WLC I enabled client exclusion polices and checked all options (Excessive 802.11 Auth. Failures etc..).. But even if a client fails 20times at authentication, it is not excluded on the wlc. It works with other SSIDs, where security settings are set to 802.1x.
    Am I missing any settings here or do you have some tipps on how to troubleshoot this?
    Thanks very much!

    Hi Renata,
    If those guest failures are not associated with valid guest users (i.e. people who have forgotten their account or entering the wrong password) there isn't anything that can be done. The main point of Guest WLAN is to make it as easy as possible for Guests - individuals with device configurations you don't want to deal with or know about, to connect your network for internet access. From a WiFi/802.11 perspective, the standard Guest WLAN setup means its easy for any device to connect.
    If your Guest WLAN has the following:
    SSID is broadcast enabled, Security = OPEN, Encryption = none, then any 802.11 device can find the WLAN via passive scanning and connect. And any device that connects will get the ISE portal. Once recieveing that portal they can guess away at valid username/password.
    I would suspect that unless your Guest WiFi is adjacent to a Mall, school, hotel or other hi-density area of individuals  with time and electronics on their hands, other than alerts in your ops window and logs, resources associated with this (WLC & ISE) are very low.
    You can try and dull the noise a few ways.
    Option 1. create and ISE log filter on those alerts so they don't cluter the console.
    Option 2. Stop broadcasting the SSID.  This is not a security measure, but will cut volume of people connecting to the SSID significantly. You will have to tell your guests what SSID or include it in their credential communication.
    Option 3. Put a very simple PSK on the SSID. The PSK will become a public secret - shared with valid guests, doesn't have change as it's purpose is not security.  You will have to include this information on their credential communication.
    Option 4 - both 2 and 3
    The most effective option would be 3.
    Good Luck!

  • 802.1x - ACS authentication issue.....

    I will attempt to explain the history of our wireless controller configurations as best I can.  We are currently using a 4400 controller running 7.x software which authenticates to and ACS 4.1 appliance.  All of this was set up prior to my arrival on the job and the previous engineers had already left with no documentation in place so I'm trying to piece it together.  The ACS is setup to map to AD for specific groups. 
      In the controller we have an SSID called triton which is our corporate SSID that all internal users connect to.  Three different interfaces have been defined, a general one for most users and two others( lets call them INT1 and INT2) that place users on separate ip networks.  The reason for this is those ip networks can reach certain services that are not allowed for general users.  ACS maps those users upon authentication to the Vlans associated with those separate ip networks.
    Problem 1.  When I first took this job, users could not map drives or any services because only user authentication was taking place..After some troubleshooting and realization that ACS was authenticating, placing the "Domain Computers" group as an ACS group mapping fixed that issue, allowing the computers to authenticate prior and therefore execute the login script
    Problem 2.  Recently it has come to my attention that some of the users on one of the other interfaces (INT1 and INT2) that should be placed in the vlans associated with their AD group mapping are not.  Upon further investigation it was discovered that the reason they are not is that the authentication is not correct.  When the computer first authenticates before the user logs on its shows in ACS as host/xxxxx.yyyy.org where the user authentication shows as xxxxx/username .  So some of the computers never change from authenticating as a host to a user and the ip address ends up in the wrong vlan.
    Please help.  I'm not extremely familiar with Cisco 802.1x setup and the documentation is poor at best.

    Ok, maybe I should be asking what the proper way to set up both machine authentication and user authentication through the 4400 and ACS 4.1 is then.
      The topology that I know of is this.  Single 4.1 ACS appliance and single 4400 controller with approximately 35 LWAPP's.  In the past ONLY user authentication was being used which presented problems with Group Policies and login scripts executing.  Adding the AD "Domain Computers" group as an ACS mapped group solved that problem by allowing the domain computers to authenticate and gain access to the network prior to logon (but maybe they were still actually using "user authentication"?).  Not sure if this was the proper way to solve the issue but it worked and we at the time didn't notice any side effects.  Although now we are seeing users end up in the wrong VLans and when we look at the logs in the controller the computer they are on is only registering as host/xxxx.yyyy.org (machine authentication) which drops them into the default vlan instead of the vlan which they should be based upon AD group membership from ACS.
      I am very familiar with other wireless products and controllers such as Aruba.  In the Aruba, when the machine first booted up and gained access to the network it was using machine authentication, but as soon as the user logged on the supplicant would push the user credentials and change the method to user authentication.  In the Aruba we used the windows supplicant.  I'd like to do the same with Cisco. 
      As far as I can tell, there is only a server side (ACS) certificate from Thwate that is used to authenticate.

  • Windows 7 / 2008 duplicate static address when using 802.1x / MAB - ISE

    Hi all!
    ISE 1.1.3
    Cisco 3750 switches
    Windows XP / 7 / 2008 clients
    I'm having some weird issues were if a client connects to a switchport and happens to be using a static IP address then the client warns of a duplicate address problem.  Also the client will then only show the default gateway within ipconfig even though the IP address / mask is still in the GUI network properties of the adaptor.  This is happening with Windows 7 and Windows 2008 devices.
    Windows XP clients don't get the issue.
    Some clients will use 802.1x native supplicant and some will be authenticated based on MAB.  Not noticed the problem with 802.1x clients but it always occurs on MAB.
    I came across a similar issue here:
    http://networkingblog.vvlabs.com/2012/07/cisco-ise-duplicate-ip-address-windows-7.html
    Going of that blog I tried using the "ip device tracking delay probe delay" command but the switches don't recognise the "delay" keyword.
    The switches are 3750  switches running version 12.2(58)SE2.
    All I have is  "count, interval, use-svi" as extra options.
    Catalyst 4500 switch guide has  "delay" option but no "count, interval or use-svi".
    The only way I have managed to avoid the problem is using the second solution which is a registry hack on each client.  This is fine for the odd server but not realistic when there will be hundreds of other clients.
    Any ideas?

    Hi
    We are doing 802.1x for clients using the Windows supplicant.  For clients not using supplicants we are using MAB.  So the print servers and printers use MAB.
    Extract of config...
    aaa new-model
    aaa authentication login default local
    aaa authentication dot1x default group radius
    aaa authorization network default group radius
    aaa authorization auth-proxy default group radius
    aaa accounting update periodic 5
    aaa accounting dot1x default start-stop group radius
    aaa accounting system default start-stop group radius
    aaa server radius dynamic-author
    client x server-key 7 x
    client x server-key 7 x
    aaa session-id common
    clock summer-time BST recurring last Sun Mar 23:00 last Sun Oct 23:00
    system mtu routing 1500
    vtp mode transparent
    authentication mac-move permit
    ip routing
    no ip domain-lookup
    ip device tracking
    dot1x system-auth-control
    dot1x critical eapol
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface FastEthernet1/0/1
    description ### Dot1x with MAB fallback ###
    switchport mode access
    switchport voice vlan 2
    ip access-group ACL-DEFAULT in
    srr-queue bandwidth share 10 10 60 20
    priority-queue out
    authentication event fail action next-method
    authentication event server dead action authorize vlan 1
    authentication event server alive action reinitialize
    authentication host-mode multi-auth
    authentication open
    authentication order dot1x mab
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer restart 0
    authentication timer reauthenticate server
    authentication violation restrict
    mab
    mls qos trust device cisco-phone
    mls qos trust cos
    auto qos voip cisco-phone
    dot1x pae authenticator
    dot1x timeout tx-period 5
    spanning-tree portfast
    service-policy input AutoQoS-Police-CiscoPhone
    ip http server
    ip http secure-server
    ip access-list extended ACL-DEFAULT
    remark Deny access to new network
    deny   ip any 172.x.x.x 0.0.0.255 log
    remark Allow everything else to other networks
    permit ip any any
    ip radius source-interface Vlan2
    logging esm config
    logging host x transport udp port 20514
    logging host x transport udp port 20514
    radius-server attribute 6 on-for-login-auth
    radius-server attribute 8 include-in-access-req
    radius-server attribute 25 access-request include
    radius-server dead-criteria time 30 tries 3
    radius-server vsa send accounting
    radius-server vsa send authentication
    radius server ISE-1
    address ipv4 x auth-port 1645 acct-port 1646
    key 7 x
    radius server ISE-2
    address ipv4 x auth-port 1645 acct-port 1646
    key 7 x

  • 802.1x EAP-PEAPv0 (MSCHAPV2) with computer authentication

    I am a network administrator at seven schools, and a few of these schools are now using 802.1x EAP-PEAPv0 (MSCHAPV2) with computer authentication  only, for wireless security. 
    We are a mixture of 2008 and 2003 (Windows Domain) servers running IAS or NPS for RADIUS.  
    I push out the wireless client’s setting via group policy, and the clients are using WZC. 
    Every now and then, a client will be unable to authenticate/validate during the authentication phase. 
    Some clients this will never happen to and a few it will happen repeatedly. 
    To fix this I have to hard wire the computer and do a gpupdate, even though the computer already had the updates applied previously, and is still part of the domain. 
    Many of our classrooms lack network drops, so wireless is the best for us. 
    Except for this one downfall, it is working great. Any help is appreciated.

    Hi Ryan,
    Thanks for posting here.
    Could you discuss the situation that you mentioned “a client will be unable to authenticate/validate during the authentication phase. 
    Some clients this will never happen to and a few it will happen repeatedly. ”
      in detail ? Can you verify if there is any error or warring that relate with this authentication issue recorded in event log on client and radius server ?
    Only certain computers are facing this issue or all?
    What’s OS running on these client computers?
    According the situation right now , I’d like to share some suggections with you:
    1. An 802.1x client may fail to connect to an Radius server if the Trusted Root CA certificate that issued the Radius server certificate is not installed on
    the client computer. Either verify that the trusted root authority is installed on the client computer or disable certificate validation on the client. To disable certificate validation, access the properties of the connection, and on the Authentication tab,
    click Properties. Click to clear the Validate server certificate check box. EAP-TLS requires the installation of a computer certificate on each RADIUS server and a computer or user certificate, or smart card on all clients. PEAP-MS-CHAPv2 requires the installation
    of a computer certificate on each RADIUS server and the root CA certificates of the issuing CAs of the RADIUS server certificate on each of the client computers.
    2. Verify that Radius is configured for the logging of rejected authentication attempts to the event log. Try the connection again, and then check the system
    event log for an IAS event for the failed connection attempt. Use the information in the log to determine the reason the connection attempt was either rejected or discarded. Logging options are configured on the General tab of the Radius server Properties
    dialog.
    3. Any rejected or discarded connection attempt recorded should identify the Connection Request Policy used. A RADIUS request message is processed only if the
    settings of the incoming RADIUS request message match at least one of the connection request policies. Examine the conditions of the policy identified to see where the request fails.
    4. Determine from the IAS system event log entries whether the authentication failure is for computer auth, user auth, or both. By default, Windows performs
    an 802.1x authentication with computer credentials before displaying the Windows logon screen. Another authentication with user credentials is performed after the user has logged on, and if this fails the machine will be disconnected from the network. Similarly,
    if computer authentication fails but user auth is successful, symptoms will include failure to process login scripts or apply group policies and machine password expiration will not be updated since the user will only be able to logon with cached credentials.
    If you use a smart card for authentication, you can only perform user authentication because smart card usage requires manual entry of a personal identification number (PIN). There is no way to provide the PIN to unlock the smart card certificate during computer
    authentication.
    5. Examine the wireless trace logs captured and search for keywords error, failed, failure, or rejected. This should give an indication as to what point in the
    authentication process the failure occurs.
    Meanwhile, I ‘d like suggest you may start troubleshooting with following the guides below and see if it will help:
    Windows Server 2003 Wireless Troubleshooting
    http://technet.microsoft.com/en-us/library/cc773359(WS.10).aspx
    Troubleshooting Windows Vista 802.11 Wireless Connections
    http://technet.microsoft.com/en-us/library/cc766215(WS.10).aspx
    Thanks.
    Tiger Li
    TechNet Subscriber Support in forum
    If you have any feedback on our support, please contact
    [email protected]
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Random computers running Windows XP have this problem.  It does not happen to all of them at once. 
    It is very random.  A computer that has been connecting to the secure network for weeks will all of a sudden not be able to connect. The message is “attempting to authenticate” and it never makes the connection. 
    I checked if logging is turned on and I can see successful events from computers that are working. 
    I can also see failed events from computers that are not ours that tried to connect to our wireless. 
    However for the computers that are having this problem there are no logged events. 
    It is as if they don’t even communicate with the server. 
    Other clients on the same AP are working fine.  I rebooted the IAS service, and RADIUS clients, but this did not help. 
    I also checked all the settings and they are correct, using PEAP, and validating the server certificate is disabled. 
    I did notice that the firewall is also turned on through group policy when the domain is not available.
       Do you think the firewall is blocking the communication? 
    I added an exception to port 1812 UDP and this did not make a difference.

  • 802.1x EAP PEAP MSCHAPv2 on Windows 7 Client.

    I have problems autenticate a w7 client at our Enterprice WiFi network. XP, Apple clients and all SmartPhones works fine...  We use Radius assigned Vlans based on username and ream routed on our Meru Network to Navis radius as centralied point of
    autentication. Navis proxes client autenticatinon recuest to the customers Radiuses based on the realm.
    Windows 7 32 client use the radius CA (installed and ticked) and EAP PEAP MSCHAPv2 in the SSID settings. The customer radius is an Freeradius. In autentication logs we se that the client sends the Maschinename, eg. Machine-x200/username@realm
    even we in the client settings, under SSID Propirties, Security, MS Protected EAP(PEAP), Settings and EAP-MSCAPv2 Configuration, have removed tick on the default setting:
    Use Autom. Windows-username... AND under Security Advanced (back one step), in the 802.1X Settings, choose User autentication only! (not user and maschine, mascine only or guest) and we have saved corectly username@reame =(username here) and password...
    in the username password Setting.
    Is it possible edit or change the way the client PC is sett up to prevent this?
    Is there any way make a policy setting? or is there other solutions?
    I have teste te Cisco: PEAP option too, but stil noe autenticatoin from Radius
    Thanks

    Hi,
    As I know, this goal cannot be achieved.
    Reference:
    Use the 802.1X Wizard to Configure NPS Network Policies
    For authentication using Extensible Authentication Protocol – Transport Layer Security (EAP-TLS), select
    Microsoft: Smart Card or other certificate, click
    Configure, click
    OK, and then click
    Next.
    For authentication using Protected Extensible Authentication Protocol – Transport Layer Security (PEAP-TLS), select
    Microsoft: Protected EAP (PEAP). In
    Eap Types, click
    Add, click
    Smart Card or other certificate, click the
    Move Up button to position a smart card or other certificate at the top of the list, click
    OK, and then click
    Next.
    For secure password authentication using Protected Extensible Authentication Protocol – Microsoft Challenge Handshake Authentication Protocol
    version 2 (PEAP-MS-CHAP v2), select Microsoft: Protected EAP (PEAP). In
    Eap Types, click
    Add, click
    Secured password (EPA-MSCHAP v2), click the
    Move Up button to position the secured password authentication type at the top of the list, click
    OK, and then click
    Next.
    Regards,
    Sabrina
    TechNet Subscriber Support
    in forum.
    If you have any feedback on our support, please contact
    [email protected]
    This posting is provided "AS IS" with no warranties or guarantees, and confers no rights. |Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question.
    This can be beneficial to other community members reading the thread.

  • How can i deploy macbooks and 802.1x authentication using PEAP/MSChap version 2

    How can i deploy macbooks and 802.1x authentication for wireless connectivity using PEAP/MSChap version 2. The Cert is generated by a 2008 Windows CA authority. I am trying to get to join but the MAC doesnt seem to want to accecpt the cert. Can i not validate the cert and still have it join the 802.1x wireless netqwotk? The wireless netwotk is using a Cisco 5508 wireless controller and Cisco 1142 access points. All works fine with Windows devices.

    Hi Tarik,
    Thanks for your answers,
    I've attached my configured AuthZ rules and AuthZ profile for provisioning,
    I want the process to be the same for iPhone, Android and Windows.
    1) Connect to the SSID
    2) Login using your AD credentials PEAP-MS-CHAP-v2
    3) Redirect to device registration portal (So I can set a limit of 3 devices per employee)
    4) As soon as the client click "register" no more redirects and PERMIT-ALL
    I think that I don't need to rely on profiling because In terms of AuthZ policies it should be something like this:
    1) if WIRELESS802.1x and PEAP-MS-CHAPV2 and BYODREGISTRATION=!YES(Unknown or not reg) then "Redirect to device registration(that is NSP right?)"
    2) if WIRELESS802.1x and PEAP-MS-CHAPV2 then PERMIT-ALL(no redirection)
    3) everything else = DENY-ALL
    But the NSP looks for Client Provisioning policies, so if I don't configure any policy it should Allow Network Access(See attachment photo3.png) but as I said on the post it shows that cannot retrieve the MAC-Address so the client can't register his device and don't have access to the network. (To grant access I've configured provisioning policies, that way the clients can register their devices but they are redirected to google play or are forced to install the profile at iOS and this is what I don't want because it is not necessary)
    What screenshoot do you need after the registration? the Auth report?
    Thank you very much for your time!

  • 802.1X Authentication failed without 802.1X authentication enabled

    Hi,
    we are using 2 WISMs, with version 4.2.207 and a WCS to control them.
    It seemed to work fine for about 2 weeks, and now we detected the following problem in some users. They were connected to the wireless without problems, and then they lost the connection. For authentication we use WPA2, we also use mac-filter.
    When they lost the connection we can see the following error:
    Message:
    Client 'mac address' which was associated with AP 'mac address', interface '1' is excluded. The reason code is '4(802.1X Authentication failed 3 times.)'.
    Message:
    Client 'mac' which was associated with AP 'mac', interface '0' is excluded. The reason code is '4(802.1X Authentication failed 3 times.)'.
    I also attach an output of the troubleshoot mac address...
    Can some help me with this?
    Thank you.
    Best regards,

    Hi Kirbus,
    we open a TAC and we were advised for now to do the following changes:
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:10.0pt;
    font-family:"Times New Roman","serif";}
    1.       please make sure to disable Aironet extensions (if present)  , on the WLAN advanced configuration
    2.       disable management frame protection (MFP) signature generation (if present) , MFP also on the WLAN advanced configuration
    3.       on the WLC general configuration , can you please disable aggressive load balancing
    4.       on the security tab on the WLC , please wireless protection policies > disable client exclusion policies
    5.       on the AP network configuration please disable short preamble the original standard was long preambles
    6.       Wireless -> disable auto-RRM channel & power assignment & try "on demand"
    7.       apply these modification on the WLC CLI
    Config advanced eap identity-request-timeout 20
    Config advanced eap identity-request-retries 10
    Config advanced eap request-timeout 20
    Config advanced eap request-retries 10
    Save config, and see if you still face the problem.
    We are still monitoring the solution, but until now we didn't face the problem again.
    Let me now how it goes for you.
    Thank you.
    Best regards,

  • 802.1x with EAP-TLS and dACLs

    Hi,
    i'm looking to enable 802.1x on the wired network using EAP-TLS. The radius server will be an ACS5.2 running on the appliance. We'd also need some authorization for different machines - we'd like to use dACLs for that so that machine A will get full access while machine B will get restricted access (both client machines are related to different business units). So machine based auth (clients run XP SP3 or Vista).
    I'm not very clear about the following...based on the presented client machine certificate, we should be able to apply an authorization policy (dACL). How can we set this up...anyone else tried this before?
    in 'worst'  case we could do machine auth (EAP-TLS) to validate it's a corporate machine connecting, followed by user authentication & authorization (EAP-PEAP) to apply access policies based on the user id..with PEAP is see it might be easier to extract user info out of AD to make policy decision...?
    Thanks,
    Guy

    Hi Guy,
    provided that the dACL is just part of the Authorization profile that you return to the client, you need to make sure that you have the correct attributes so to allow the authorization policy evaluation.
    In ACS 5 when you configure a "Certificate Authentication Profile", the basic option is just to validate the client certificate.
    So as long as ACS can validate the cert using the trusted CA certificates installed on ACS, the authentication is successful.
    However, if you do so the only attributes you can base your authorization policy evaluation are the non-binary attributes of the certificate itself, as there's no query done to any backend DB in this case.
    If you want to evaluate the authorization policy where you want to check for additional attributes that are stored on an external DB (e.g. Active Directory), you can do it in two ways:
    1) enable certificate binary comparison on the "Certificate Authentication Profile": this will both perform the binary comparison of the cert and it will fetch the user attributes from AD; this of course requires that the certificate for the user is also stored on the "userCertificate" attribute in Active Directory.
    2) configure an "Indentity Store Sequence" where you select:
      - Authentication Method List : Certificate based : "Certificate Authentication Profile"
      - Additional Attribute Retrieval Search List : Add "AD1" among the selected Identity Stores
    In this case ACS won't perform binary comparison of the cert, but it will look for the corresponding user account in AD so to fetch additional attributes (group membership, etc..)
    You can find relevant documentation about this on the ACS user guide:
    - Configuring "Certificate Authentication Profile"
    http://www.cisco.com/en/US/customer/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/users_id_stores.html#wp1054057
    - Configuring "Identity Store Sequence"
    http://www.cisco.com/en/US/customer/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/users_id_stores.html#wp1054132
    - Managing policy elements:
    http://www.cisco.com/en/US/customer/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/pol_elem.html
    I hope this helps.
    Regards,
    Federico
    If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.

Maybe you are looking for