802.1x with AD support via ACS 4

Hello ,
I have been trying to configure 802.1x Authentication on a test switch . Authentication will be provided by the ACS server . This worked when I had the client setup for EAP-MD5 and had local user accounts on the ACS server . However this is impractical if we were to deploy this on a large scale. How can i configure 802.1X authentication to occur via the ACS with the ACS looking at the AD database . The trouble is AD does not support EAP-MD5. It supports PEAP but the problem I am having is "EAP-TLS or PEAP authentication failed during SSL handshake "
Has anyone here setup 802.1x with AD integration via ACS 4.0 . Please help.
Thanks.
Karthik

Hi Karthik,
The SSL handshake will fail in our experience for any of the following reasons:
- The supplicant cannot access the private key corresponding to it's certificate - check that the system a/c has pemissions over the private key found in c:\documents and settings\all users\application data\microsoft\crypto\rsa\machine keys
- The ACS sever does not trust the Root Certificate for the PKI that issued the supplicants certificate - Is the Supplicants Root CA present in the ACS Certificate Trust List?
- CRL checking is enabled and the CRL has expired or is inaccessible
If you up the logging levels to full and examine the csauth log closely you should get more detail as to the reason
Hope that helps
Andy

Similar Messages

[WLAN] Use 802.1x with PEAP without Certificates?

Hello there,
is it possible to use 802.1x with PEAP authentication via MS-CHAPv2 without cheking for the servers certificate? I can't find an option to disable it

On whitch device? You can set the autorithy certifacte to none or choose one from the list.
‡Thank you for hitting the Blue/Green Star button‡
N8-00 RM 596 V:111.030.0609; E71-1(05) RM 346 V: 500.21.009

I have tried with my ipad air and a friends ipad to mirror the contents to a samsung smart tv via appletv and cannot either to work.I have spent over 2 hours today on live chat with apple support with no resolution.Any ideas please?

i cannot mirror from ipad or ipad air to a samsung smart tv via appletv.Any ideas please?

I have tried with an Ipad Air and Ipad using Op System 8.0.2 to mirror their contents to the screen of my Samsung Flat Screen Flat TV via the latest make of Appletv.I have spent over 2 hours going through all settings etc with Apple Customer Service Live Chat.They cannot find or replicate the problem and says it is all working fine.My TV screen displays, when i go into mirroring, "ready for connection - on your device launch Allshare Cast".Nothing happens although i have agreed with Apple Support that all settings are on and are correct.Can anyone help please, as Apple Support cannot?

802.1x with ACS and Windows AD

Hi
Im trying to setup 802.1x with ACS 5.2 but am struggling as its very differnet to ACS 4.2.
I have setup the ACS to be the domain and think i have setup up the External Idnetity Store, however when i try to authenticate a pc using authentication Medthod 'PEAP (EAP-MSCHAPv2), i get a failure reason '22056 Subject not found in the applicable identity store'
Marco

Hi Marco,
i guess you've missed a mapping configuration in the Access Policy Section.
Create a Access Service name it AS-802.1x select User Select Service Type and select Network Access. Select the Policy Structure Identity and Authorization. Select PEAP as allowed Protocol. Click Finish
You'll see the new service click Identity.
Select the identity source you've created then save.
Click on authorization
Select a default authorization rule permit access and save.
Create a Service Access Rule name it 802.1x
Select Protocol Radius as Condition and as Compound Condition select RADIUS-IETF:Service-Type match Framed then select the service you created before.
then you can try again.
regards
alex

802.1X with Guest vlan support IOS version ???

I don't know, Whitch IOS version support 802.1X with Guest vlan to Catalyst 2950 and 3550 switch
please reply to my question.

Tkank for your help.
Also, Cisco web is explained , except for Catalyst 2950 Standard Image (SI) in IOS 12.1(22)EA3
but I can't understand, My site is using catalyst 2950 SI to 802.1X and guest vlan in IOS image 12.1(22)EA3
ex) TW_14F_A_C2950_32.8#sh ver
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA3, RELEASE SOFTWARE (fc1)
Running Standard Image
24 FastEthernet/IEEE 802.3 interface(s)
Model number: WS-C2950-24
please, reply for my question

Does N9 support 802.1x with LEAP and have Vietname...

Hi all,
I'm from Vietnam and using a N9 phone. I have some question:
1. Does N9 support 802.1x with LEAP like E-series? When are you launching?
2. Does N9 support Vietnamese language/keyboard/typing? When are you launching?
Please inform me soon
Thanks.

and how about Lumia serires?

I've been trying to contact apple support via email for two days now with no responses from them. What's going on?

For the past two days I've been trying to contact iTunes support via email. I've emailed them in the past and they've always got back to me the same day. Now it's been two days. I'm quite disappointed that I didn't get a response yet. I'm not really sure what to do. I even tried emailing them yesterday as well with still no luck. I really feel neglected as a customer.

You mean other than the fact that it was a weekend? I don't know how much staff Apple has working on weekends, but it's likely to be less than during normal business hours. I'd suggest that you first check any antispam filters that may be in operation on your email account, and if they're not trapping messages from Apple you wait until tomorrow (Tuesday) and if you still haven't received a response try contacting iTunes Support again.
Regards.

Can Macbook pro 2012 with GT650M support 3d vision via bootcamp

can Macbook pro 2012 with GT650M support 3dvision via bootcamp
For sure GT650 is 3d vision supported, but anyone ever made test that you
can watch 3d movie via windows under bootcamp on new macbook pro
Thanks..

After updating NVidia driver newer than 267.76,
I got black screen after Windows Logo shown during reboot.
After countless annoying tests,
I installed the newest NVidia 285.79 driver without problem finally.
My original prefered display configuration:
link the primary monitor with HDMI port
I already followed the GeForce Driver Installation Guide, step by step,
http://forums.nvidia.com/index.php?showtopic=169555
but there's still black screen after reboot.
THEN, I TRIED TO USE mini-DISPLAY PORT INSTEAD AND REBOOT AGAIN,
video signal was connected to my DELL 2707W(only DVI port)
by MiniDP to HDMI adapter/HDMI-DVI cable.
The display is NORMAL NOW !!
Root Cause assumption:
Maybe the driver newer than 267.76 always regard miniDP as primary signal output port,
even if you set the HDMI port as primary.
I think this is a serious bug, but no solution after mote than 30 driver updating.
The following configuration worked on my Mac mini 2010 system:
mini─miniDP to HDMI adapter─
HDMI cable to HDMI splitter─┬HDMI-DVI cable─Dell 2707
                                              └HDMI cable─ 3D projector
but I found that the configuration can't play 3D video...
So I changed the configuration to:
Mac─miniDP to HDMI adapter─HDMI-DVI cable─Dell 2707
      └HDMI cable─ 3D projector
For your reference.

802.1x with alcatel phone with cisco acs 5.0

Hi All, can any one has done the implementation of 802.1x with alcatel phone where pc will be behind the phone and cisco switch ports are configured as trunk. Trunk native vlan is data vlan for pc and trunk carrying voice vlan.
when trunk mode is enabled I can not configure 802.1x on trunk interface. does any one help me to get rid of this situation..
Thanks

Hi,
Did you find any solution?. Did you tried with the command switchport voice vlan?.
Regards,
Mauricio

Wireless 802.1x with Window 7

I have a WLC 6.0, ACS 3.3 and the SSID is setup to use 802.1x with Peap Authentication. The clients are using Windows 7 to connect to wireless. To get the clients connected they have to go into there network properties if the wireless card, configure the client to use PEAP, uncheck validate server certificate, and also uncheck use computer name to login into windows. This works fine and the user to able to connect to to wireless after dong all these steps and then entering in there Windows Username and Password. The customer is saying that this is to many steps for the end user and they just want the user to to click on the SSID and connect. If wireless could also be setup to use there windows username and password would be a bonus. I'm basically looking for a solution that is simple but is also secure as well. I know that's an oxymoron. Is there anything I could do to make the wireless process simpler. Either by going with a different security authentication or by doing something different on the clients computers. Thanks for any help and suggestions.

This is a script that we use on our campus (University of Leeds), that self configures an 802.1x connection and when a user connects to an 802.1x connection merely asks them for their username and password, which then remained cached.
The .exe you create takes away all the techy bits that do 'confuse' some users, even if they are provided with well written documentation.
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
https://sourceforge.net/projects/su1x/
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
http://lsayregj.swan.ac.uk/su1x/SU1X_User_Guide-v104.pdf
Features include:
- Automation of configuration of a PEAP wireless connection on XP(SP3),Vita and Win 7
- Can set EAP credentials without additional user interaction (avoids tooltip bubble)
- Installation of a certificate (silent)
- Checks for WPA2 compatibility and falls back to a WPA profile
- Third party supplicant check -SSID removal and priority setting
- Support tab: (checks: adapter, wzc service, profile presence, IP)
- Outputs check results to user with tooltip and/or to file
- Printer tab to add/remove networked printer
This tool is very cleverly written by Gareth Ayres at Swansea University

871 802.1x with vlan assignment aka dynamic vlan

you can do vlan assignment on 871W wireless using the local radius server but unfort only LEAP which is N.G.
I have been pounding on wired 802.1x PEAP (which works) trying to get vlan re-assignment. Have tried with IAS which I am using to do vlan reassignment with the WLC so I have the idea of how it works with IAS. With 871, no go. Have also tried ACS for radius with same results: can't escape the switchport's vlan. With debug radius local you can see the tunnel attributes for reassignment plainly but with debug radius with IAS or ACS, nada.
Using 12.4(6)T advanced IP.
I have just seen that 12.4(4)CX2 has "802.1x with vlan reassignment" but the download is MIA. Wonder what's up with that?
Has anybody got this to work? Any info much appreciated
Greg Turner

SSH isn't available on the SI version of the 2950 as you require the Crypto features and these are not available for the SI (the documentation is a little vague here but trust me I have upgraded one and it doesn't like it...). The documentation says 'Switches that support only the SI cannot run the cryptographic image.'
802.1x with VLAN assignment is available only in the latest IOS - or at least since 12.1(22).
SNMPv3 is supported.
HTH
Andy

Scanning VERY slow with HP C4380 via WiFi

Hi there,
Since leopard (now 10.6.3) scanning is really terribly slow with my C4380 via WiFi, it actually takes about an hour (NO JOKE) to scan a page on 600dpi. WHAT THE HECK IS WRONG.
Can't find any solution anywhere..., drives me mad, help me out pls!
Daniel

Go into your computer and see what the Wireless Network Settings such as Security Type (WPA, WPA2, WEP etc), Data Encryption (AES, PSK, TKIP etc) and what mode is the router using 802.11 d, g or n. PlayBook prefers WPA or WPA2, AES Encryption, Mode g. It does not support Mode n with TKIP. Also try a reboot of your router.
On your PB tap the wifi icon, tap connect manually, enter the same Security type setting as in the router, select dual band, check auto obtain IP Address, check Allow Inter Access Point Handover and enter the network key. Reboot the PB .Try these suggestings and report back.

Catalyst Express 500 802.1q with non-Cisco Phones

This weekend we spent hours trying to get 802.1q tagging to work on a VLAN with ShoreTel phones. The user interface on this switch seems to only allow "Cisco-Voice" VLAN, without any specifics. This didn't work. The specs on this switch say that the .1q is supported, but we couldn't figure it out. The more expensive switches were easier to configure for Voip QoS.
Can anyone advise me on the tricks to getting this to work with the lower end Catalyst Express 500? Or does this switch only support 802.1q with Cisco phones?

Cisco IP Phone uses CDP to let the ip phone know what vlan it's suppose to be (via voice-vlan). shore tel would definitely not use CDP since CDP is cisco proprietory, so it's voice vlan must be defined on it, I rememer Avaya being the same way. So, having said that, just make sure that the Shore tel Ip phone are in the right vlan. what does not work anyway? shore Tel IP Phone will not come up? Will not get it's configuration from it's software PBX? Use the smartport configuration on CE500.
Please rate all posts.

HT3702 Today I bought app call starsports app and now I can open app and email to starsports they say not for Canada I ask my refund but they ask me to go with iTunes support team...please can you refund my money back in my account

Today I bought app call starsports app and now I can open app and email to starsports they say not for Canada I ask my refund but they ask me to go with iTunes support team...please can you refund my money back in my account

We are fellow users here on these user-to-user forums, you're not talking to iTunes Support nor Apple.
Purchases are considered final, but you can try the 'report a problem' link to contact iTunes Support and see if they will refund or credit you : http://reportaproblem.apple.com
If the 'report a problem' link doesn't work then you can try contacting iTunes Support via this page : http://www.apple.com/support/itunes/contact/ - click on Contact iTunes Store Support on the right-hand side of the page, then Purchases, Billing & Redemption

Is there any way to contact support via email as I cannot receive phone call at the moment . Thanks

I have forgotten my security questions and cannot purchase apps. My rescue email was entered with an error .me instead of .mw so I can't reset my account. Is there a way to contact support via email ? as I can't receive a call.
Thanks

http://www.apple.com/support/contact/
would be the place to start

802.1x with AD support via ACS 4

Similar Messages

Maybe you are looking for