802.1x wired authentication to AD

Wired authentication:
This is what I want to accomplish:
Switch - ACS 4.0 -> Active Directory
Assume a new user is logging into the network for the first time and he starts his computer which has been configured for 802.1x PEAP. I have checked off the option 'Automatically use my Windows logon name and password' in LAN properties
Now, after the computer starts, the user is presented with the regular Windows dialog logon box to which he hits Ctrl+Alt+Del and enters his Windows AD credentials. I want those credentials to be sent to the switch as part of the 802.1x logon. After the port is authorized, those same credentials should be passed onto Active Directory to become authenticated to the Windows network.
Possible? I'm assuming this is the way it should & can work

Hi, you need machine authentication as well. Otherwise Windows will not be able to verify the user's identity and cannot log the user in. Windows authentication of the user takes place before the switchport authenticates for the user. Machine authentication allows the computer to authenticate and get access to the network before the user logs in. Thus the user authentication CAN take place because the DC's are only available after machine authentication succeeded.

Similar Messages

  • Windows 7 802.1x (Wired) Authentication Failure when logging into Lync 2010

    Hi
    My company has implemented 802.1x Wired authentication, we use GPO to specify a
    Wired Profile that uses a COMPUTER certificate.
    We are finding that when a Windows 7 laptop comes out of sleep or hibernation, the laptop fails 802.1x authentication and does not connect to the network.
    This issue only occurs intermittently, but have been proven to occur only when Lync 2010 is open.  If we close Lync 2010 the issue does not occur.  Lync 2010 installs a self signed USER certificate for authentication.
    I am aware that there are some issues around Windows 7 not selecting the correct certificate when responding to authentication requests (KB2710995,
    KB2769121) but these always specify that the issue occurs when 802.1x authentication uses USER certificates, not a mix of USER and COMPUTER.  We have installed these hotfixes and the
    issue still occurs.

    Hi,
    From the description, you suspect the DHCP request cause this issue. Would you please send us the packets? Since it seems that you have looked into the traffic and found some clues.
    Meanwhile, I found the following hotfix which may related to this issue.
    No response to 802.1X authentication requests after authentication fails on a computer that is running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/980295/en-us
    Next Action Plan:
    1.Clean Boot
    a. Click Start, click Run, type "msconfig" (without the quotation marks) in the Open box, and then click OK.
    b. In the Startup tab, click the "Disable All" button.
    c. In the Services tab, check the "Hide All Microsoft Services" checkbox, and then click the "Disable All" button.
    ======================================================
    Clean Boot + binary search
    In a Clean Boot, all the 3rd party services and startup programs are disabled. If the server can start normally in Clean Boot, we can be sure that the issue was caused by some 3rd party service or application. And then we can do a "binary search".
    You can enable half of all the services in Services tab, and then restart the server to check the result. If the issue reoccurs, it means the culprit is in this list; if not, the culprit is in the other half. And then, we can continue the binary search, until
    we find out the root cause. Please let me know if this action plan is OK for you.
    2.Collect etl trace on the problematic client.
    netsh trace start capture=yes overwrite=yes tracefile=c:\net.etl filemode=circular
    ****Try to reproduce this issue****
    netsh trace stop
    Please send the net.etl to us for underlying analysis.
    For any concerns, please let us know.
    Best regards,
    Steven Song
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • 802.1x wired authentication via PEAP, MD5

    Hi everyone,
    Thank you for taking the time for reading this, I am implementing a security solution and wanted to take th benefit of implementing 802.1x over wire. I have been searching a bit but no much info from start to finish on how to implementing this solution,
    i would really appreciate if someone could point me some where  to find  detailed instruction on how to do this, as so far i have been configuring in multiple way bit no result out of it. Still a orange port color on my switch, that means the first
    hop of security work but the next no.
    Thank you in advance to read this.

    Hi,
    According to your description, my understanding is that you want to deploy 802.1x wired authentication via PEAP, MD5 and need instructions about this.
    Some articles and just for your reference:
    802.1X Authenticated Wired Access Overview
    https://technet.microsoft.com/en-us/library/hh831831.aspx
    802.1X Authenticated Wired Access Design Guide
    https://technet.microsoft.com/library/dd378864(WS.10).aspx
    IEEE 802.1X Wired Authentication
    https://technet.microsoft.com/en-us/magazine/2008.02.cableguy.aspx
    Best Regards,
    Eve Wang
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • NAP / 802.1x wired authentication issues

    NAP/NPS Server = 2012R2 NPS Role installedClient Swiches: HP Proliant 5400 seriesSupplicant: Windows 7 Pro domain joined, built in Windows 802.1x suplicant.We are using user and machine based authentication (to accomodate RDP sessions) with health checks (AV installed and Firewall enabled on all network profiles). User authentication policies are above Machine authentication policies in NPS so that when a user logs in, it superceedes the machine's authentication and switches VLANs based on the user's AD group membership. If a user or machine fails authentication, or fails the health check, they are quarantined on our 666 VLAN (We call it the Leper Colony!).Everything pretty much works...except one small thing...PROBLEMWhen a computer first boots up (maybe other times, I dont know), before presenting a user with a login screen, it gets...
    This topic first appeared in the Spiceworks Community

    Hi, you need machine authentication as well. Otherwise Windows will not be able to verify the user's identity and cannot log the user in. Windows authentication of the user takes place before the switchport authenticates for the user. Machine authentication allows the computer to authenticate and get access to the network before the user logs in. Thus the user authentication CAN take place because the DC's are only available after machine authentication succeeded.

  • Wired authentication 802.1X

    Hi, I need to authenticate 802.1X in wired connection. Actualy my Lion work fine because have automaticaly converted the 802.1X profile, but I cant create new. In snow leopard in System Preferences/Network/Ethernet select Advanced, click in 802.1X tab i cant configure profile. So I can configure profile for my 802.1X authentication ??
    THANKS!!!!

    Hi,
    According to your description, my understanding is that you want to deploy 802.1x wired authentication via PEAP, MD5 and need instructions about this.
    Some articles and just for your reference:
    802.1X Authenticated Wired Access Overview
    https://technet.microsoft.com/en-us/library/hh831831.aspx
    802.1X Authenticated Wired Access Design Guide
    https://technet.microsoft.com/library/dd378864(WS.10).aspx
    IEEE 802.1X Wired Authentication
    https://technet.microsoft.com/en-us/magazine/2008.02.cableguy.aspx
    Best Regards,
    Eve Wang
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Systemd with wpa_supplicant 802.1X wired and dhcpcd - Need help

    Hi,
    At work we use 802.1X wired authentication on the network to get access. If successfully authenticated then I get 10.x.x.x network address from DHCP,
    and if not successfully authenticated, I get a 172.x.x.x address from DHCP.
    Now I've configured wpa_supplicant with certificates in its configuration file so that one is working fine.
    What I have problems with is the startup, this is what I need in order:
    * I need wpa_supplicant to start up
    * wpa_supplicant needs to authenticate completely
    * now dhcpcd may run and I should get 10.x.x.x address.
    I've tried two (b*ttfugly) ways of solving this under systemd:
    wpa_auth.service
    [Unit]
    Description=WPA 802.1X
    Requires=sys-subsystem-net-devices-eth0.device
    After=sys-subsystem-net-devices-eth0.device
    [Service]
    Type=simple
    ExecStart=/usr/sbin//wpa_supplicant -ieth0 -Dwired -c/etc/wpa_supplicant/wpa_supplicant.conf
    [Install]
    Alias=multi-user.target.wants/wpa_auth.service
    And in [email protected] I've added:
    After=wpa_auth.service
    However this won't work since wpa_supplicant isn't done authenticating when dhcpcd starts up.
    I've also tried using -B option to wpa_supplicant and forking in wpa_auth.service like this:
    Type=forking
    ExecStart=/usr/sbin//wpa_supplicant -B -ieth0 -Dwired -c/etc/wpa_supplicant/wpa_supplicant.conf
    Now if I'm lucky this works, but it's still a race condition.
    So: Next things I've tried is to make the wpa_auth.service start up a script (Type=forking) that executes wpa_supplicant, and adds a sleep 1, this gives wpa_supplicant 1 second to authenticate, but its still a shitty and unsafe solution.
    Last solution I tried was using the above solution but replaced sleep with wpa_cli -a script that according to man page executes the script when it recieves an event. So right now the chain looks like this:
    In chronological order:
    - wpa_auth.service (systemd)
    Type=forking
    - script
    - wpa_supplicant
    - wpa_cli -a script2 (will block until recieving an CONNECTED/DISCONNECTED event from wpa_supplicant, then run script2)
    - script2
    -pkill wpa_cli
    - exit 0
    done - dhcpcd may start
    I just want to find a way to start dhcpcd after wpa_supplicant has authenticated so I get a correct IP address.
    How do I do this in a correct way? Can I use dbus somehow to make wpa_supplicant signal that it is done authenticating?
    Thanks
    Last edited by dimman (2012-11-23 15:56:01)

    From the sample wpa_supplicant.conf:
    # scan_ssid:
    # 0 = do not scan this SSID with specific Probe Request frames (default)
    # 1 = scan with SSID-specific Probe Request frames (this can be used to
    # find APs that do not accept broadcast SSID or use multiple SSIDs;
    # this will add latency to scanning, so enable this only when needed)
    So... looks like that likely isn't the solution. Of course, this is all just speculation now, until I can resolve the hardware issues or get a new laptop.

  • 802.1x Wireless versus Wired authentication ?

    Hi,
    I'm learning Wireless NPS configuration. Tings are confusing for me and I have couple of questions. The article below seems to be a good article for understanding Wireless authentication complex features, but it is a little bit conusing for me : http://technet.microsoft.com/en-us/magazine/2007.11.cableguy.aspx.
    My questions :
    1) What is the difference between 802.1x Wired and Wireless domain authentication processes ?
    2) Could someone help me get a basic understanding of Wireless Single Sign On on a domain authentication ?
    3) Could someone give me get a basic understanding of bootstrap profile on a domain authentication ?
    I have read couple of books and articles. Unfortunately ; none of them gave me a clear understanding on the subject.

    No, CA wasn't changed with R2.
    Are you able to see the User's certificate in the Keychain app under the login keychain & My Certificates? Can you see the CA's certificate under the X509Anchors?
    In the login keychain, when looking at the Users certificate, does it show as valid?

  • WRT54G2 V1 wired authentication with 802.1X

    Hello, does this device support WIRED authentication with 802.1X and MD5-crypt? If not, whether such a possibility in the next firmware version? Thanks for  your reply.

    Well i am not sure if that will work or not. May be you can give a try and check if its working or not.

  • IAS and CTA 802.1x wired client?

    Hi,
    We have IAS working with 802.1X authentication. All is good except when we enable dynamic VLAN assignment we come across the Winlogon issue as per MS KB article 935638.
    We do however have available the CTA 802.1X wired client. From what I have read though it requires ACS due to use of EAP-FAST. Is this correct or is there some way I can get CTA 802.1X wired client working with MS IAS RADIUS?
    Thank you

    You will have to use ACS for authenticating using EAP-FAST for CTA 802.1x wired clients. It is not possible to get CTA 802.1X wired client working with MS IAS RADIUS.

  • 802.1x & windows Authentication

    Hi There, Any body has implemented 802.1x port authentication with ACS & windows AD. which authentication is supported in this kind of setup ms-chap or MD5 or PEAP (on the clients).
    and what are the challenges if windows user accounts password changed frequently..
    can any body explain adv & dis adv of 802.1x before I deploy it in network..

    There's a decent guide in the ACS 4.2 documentation on enabling machine access (chapter 12). Basically, you just enable it on the client and the ACS server, and POOF! On the client side, you should have a "Authenticate as computer..." option on your wireless networks tab. Wired is the same, unless you are running XP SP3, Vista, or Windows 7 where machine auth is enabled when you enable user auth.
    MAB with Guest VLAN *should* work, but I have not configured/tested it. Just be aware that MAF on the ACS side is just another form of auth where the user id and password is the MAC address of the client. For this reason, I recommend you put the MAC "users" in your ACS database, not in AD. Otherwise, you'll probably need to create an AD password group policy object for the user group holding your "mac address user accounts" so that they can have a password that matches their user name.
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/ACSug.pdf

  • 802.1X un-authenticated user and guest VLAN

    Is there an option for 802.1X wired network to put any un-authenticated user onto the guest VLAN instead of no access? Thanks.

    You can read more about "802.1X authentication failure VLAN" in the release notes for cat 6000 8.4 new features. It may not be in your hardware yet.
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/relnotes/ol_4498.htm

  • ISE 1.3 Why are Windows endpoints defaulting to 802.1x machine authentication in wireless profile and not User or User&Computer

    We are running ISE 1.3 tied to AD with WLC 7.6.130.0.  Our ISE has a GoDaddy (none wildcard) certificate loaded for https and EAP.  We are just running PEAP.  We have a mix of IOS, Android, and Windows 7/8 devices.  IOS and Android devices can self create a wireless profile and after entering credentials can connect without issue.  Our Windows 7/8 devices, when auto creating a wireless profile are selecting 802.1x machine authentication instead of User authentication or the best option which is machine or user authentication.  This is problematic as we do allow for machine authentication but have an authorization rule limiting machine auth to domain controller and ISE connectivity only.  This is to allow domain Windows 7/8 devices to have domain connectivity prior to user sign-in but force user auth to get true network connectivity.  The problem is why are the Windows devices not auto setting to user authentication (as I think they did when we ran ISE1.2), or the best option which is to allow both types of authentication?  I have limited authentication protocols to just EAP CHAP and moved the machine auth profile to the bottom of the list.  Neither have helped.  I also notice that the Windows 7/8 endpoints have to say allow connectivity several times even though we are using a global and should be trusted certificate authority (probably a separate issue).
    Thank you for any help or ideas,

    When connecting a windows device to the ISE enabled SSID when there is not a saved wireless profile on that machine, it will connect and auto create the profile.  In that profile, 802.1x computer authentication option is chosen by windows.  That has to be changed to computer or user for the machine to function correctly on the network.
    On 1.2, this behavior was different.  The Windows device would auto select user authentication by default.  At other customer sites, windows devices auto select user authentication.  This of course needs  to be changed to user or computer in order to support machine auth, but at least the default behavior of user authentication would allow machines to get on the network and functional easily to begin with.

  • Connecting to an 802.1X wired network

    Does the AirPort support connecting to a 802.1X wired network?

    Try turning odd autofill since that sometimes results in entering incorrect information.

  • How to get rid of 802.1x 'Default Authentication'?

    Hi All,
    Everytime I close my MBP's lid, put it to sleep, or simply turn it on...  My wifi is no longer connected.
    this all started ever since I decided to 'Turn Off Wifi' the very first time since I got my MBP this year 2011, in June.
    Whenever I do any of the above (put MBP to sleep etc) then get back to working.. My Safari says I'm not connected to the internet.
    And I see my Wifi signal "blinking" and trying to connect. So I go to my Network preferences and see this:
    There's that '802.1X: Default Authenticating' that appears below my wireless network's name..
    After which i have to Disconnect from twice - 1 time, before it tries to "authenticate" again.. and then a 2nd time.. and then it stops completely,
    Then i have to proceed to click and choose my network again and re-enter my password just to get the Airport/Wifi working again..
    Someone please give me a solution to get my Wifi to automatically connect whenever I switch on my MBP - and to get rid of this annoying 802.1X which does nothing and just continues to try and "authenticate" with no result.
    It would be very very much appreciated! Thank You!
    PS. I did read somewhere online about 802.11g newer wirelss network cards and how they may have issues with an 802.1x network etc..
    Don't really understand it though. Please explain if you could. Cheers 

    Realized that OSX Lion as re-prioritized my Wi-Fi to the bottom of the list.
    What I had to do was place it in first priority again in Network settings.
    Quite a disappointment from OSX Lion since in OS Snow Leopard that was the default setting - and certainly a hassle for newbie Mac users like myself who may be clueless when faced with these "issues"
    Also attached above is the picture that for some strange reason disappeared in the original post..

  • 802.1x Port Authentication via RADIUS

    I am investigating implementing 802.1x port authentication on our network.
    I have a test LAN with a Catalyst 2950 switch and 2 Win XP workstations, (I know its pretty basic, but should be enough for testing purposes). One of these XP PCs is running a Win32 RADIUS server and the other has been configured for 802.1x authentication with MD5-Challenge. Both switch ports are configured for the default vlan and can ping each other.
    I have configured the switch with the following commands
    aaa new-model
    aaa authentication dot1x default group radius
    dot1x system-auth-control
    radius-server host x.x.x.x key test
    and the port to be authorised has been configured with
    dot1x port-control auto
    As far as I can tell this is all I need to configure on the switch, please correct me if I am wrong.
    When I plug the PC into the port I get the request to enter login details, which I do, the RADIUS server sees the request but rejects it, because 'the password wasn’t available'. Here is the output from the request, but there isnt any password field and I know there should be as the RADIUS server comes with a test utility and the output from that is similar to below, but the password field is included. I have removed IP/MAC addresses.
    Client address [x.x.x.x]
    NAS address [x.x.x.x]
    UniqueID=3
    Realm = def
    User = Administrator
    Code = Access request
    ID = 26
    Length = 169
    Authenticator = 0xCCD65F510764D2B2635563104D0C2601
    NAS-IP-Address = x.x.x.x
    NAS-Port = 50024
    NAS-Port-Type = Ethernet
    User-Name = Administrator
    Called-Station-Id = 00-11-00-11-00-11
    Calling-Station-Id = 11-00-11-00-11-00
    Service-Type = Framed
    Framed-MTU = 1500
    State = 0x3170020000FCB47C00
    EAP-Message = 0x0201002304106424F60D765905F614983F30504A87BA41646D696E6973747261746F72
    Message-Authenticator = 0xA119F2FD6E7384F093A5EE1BF4F761EC
    Client address [x.x.x.x]
    NAS address [x.x.x.x]
    UniqueID=4
    Realm = def
    User = Administrator
    Code = Access reject
    ID = 26
    Length = 0
    Authenticator = 0xCCD65F510764D2B2635563104D0C2601
    EAP-Message = 0x04010004
    Message-Authenticator = 0x00000000000000000000000000000000
    On the 2950 I have turned on debugging with 'debug dot1x all' and part of the output is below:
    *Mar 2 01:58:38: dot1x-ev:Username is Administrator
    *Mar 2 01:58:38: dot1x-ev:MAC Address is 0011.0011.0011
    *Mar 2 01:58:38: dot1x-ev:RemAddr is 00-11-00-11-00-11/00-11-00-11-00-11
    *Mar 2 01:58:38: dot1x-ev:going to send to backend on SP, length = 26
    *Mar 2 01:58:38: dot1x-ev:Received VLAN is No Vlan
    *Mar 2 01:58:38: dot1x-ev:Enqueued the response to BackEnd
    *Mar 2 01:58:38: dot1x-ev:Sent to Bend
    *Mar 2 01:58:38: dot1x-ev:Received QUEUE EVENT in response to AAA Request
    *Mar 2 01:58:38: dot1x-ev:Dot1x matching request-response found
    *Mar 2 01:58:38: dot1x-ev:Length of recv eap packet from radius = 26
    *Mar 2 01:58:38: dot1x-ev:Received VLAN Id -1
    Again there doesn’t appear to be a password, shouldn't I see one?
    Ultimately we will be using a Unix RADIUS server but for testing purposes I have just configured an eval version of Clearbox's RADIUS server. I've tried others as I thought the problem maybe the software, but I get similar problems regardless. If anyone can recommend better Win32 software, please do so.
    I'm struggling to figure out where the problem is, the XP machine, the switch or the RADIUS server. Any advice would be appreciated as it's getting quite frustrating.

    These are dot1x event debugs, so you wouldn't see this with that debug. The closest thing to seeing it would be to debug radius on the switch, and the password would be contained in RADIUS Attribute[79]. The switch uses this attribute to replay the EAP message (unmodified) to a RADIUS server. You might see it, but it's encrytped, so it might not buy you much. I'm sure you can imagine from a security point of view why the switch won't/shouldn't have this much visibility into this ;-).
    I would recommend either:
    a) Double-checking your RADIUS setup and logs to find out why the user failed. (double-check the RADIUS key configured on the switch too .. it must match).
    b) Downloading a third-party supplicant from Meetinghouse or Funk to use as a control.
    Eval copies are available on their websites.
    Hope this helps,

Maybe you are looking for