Airport 802.1x w/ TLS Authentication Certificate Problem

Trying to set up an Airport connection to my company's Wireless network.
I've gone into the Internet Connect application and tried to create a new 802.1x connection.
I named the connection, choose Airport as the port, provided my username and password, filled in the SSID, and tried to choose TLS as the authentication but got the following error:
"TLS can't be enabled because your keychain does not contain any suitable certifications..."
I had previously added the certificate the IT department had generated and is successfully using it with their Window's clients.
I can see the key in my keychain but cannot access it when trying to add TLS authentication.
They are using Microsoft Certificate Server to generate the certs.
Is there anything special I need to do in my keychain or with the cert to have it available for use with TLS.

I've set this up at home using Windows 2003 IAS & EAP-TLS. It took a little playing around to get it right, but here are the instructions I wrote for myself:
Mac;
http://certificateauthorityserver/certsrv
Download a CA Certificate, certificate chain, or CRL
Click Download CA Certificate
Double click certnew.cer and install it to the System keychain
Go back
Request a Certificate
User Certificate
2048, Submit
Install (downloads)
On Windows machine, view private store. Select export with shared key. Export p12 certificate. Import on Mac.
Go to Internet Connect configuration. Choose 802.1X and then TLS. Use the certificate assigned to the user.

Similar Messages

  • Wired 802.1x EAP-TLS Server Certificate Problem

    I have setup wired 802.1x authentication using EAP-TLS with ACS 3.3 and backend link to Active Directory. Root CA certificates are installed on the ACS and Client PC. Machine certificates and user certificates are also installed on Client PC. A Server certificate is installed on the ACS. All has been configured as detailed on the Cisco Web Site (numerous documents).
    If I set the client to authenticate the Servers certificate I get a failure. The clients log (Cisco Secure Services Client) states:
    11:48:53.088 Validating the server.
    11:48:53.088 Server list is empty, trusted server can not be validated.
    11:48:53.088 Server list is empty, trusted server can not be validated.
    11:48:53.088 The server certificate is invalid, the common name ACS-One.rotherham.gov.uk does not match.
    11:48:54.776 Port state transition to AC_PORT_STATE_UNAUTHENTICATED(AC_PORT_STATUS_ERR_SERVER_TLS_CERTIFICATE_REJECTED)
    11:48:54.776 The authentication process has failed.
    If I look at the Auth log on ACS (set to full logging) it states:
    AUTH 08/27/2008 14:09:04 I 0701 1492 AuthenProcessResponse: process response for 'paul.kyte@domain' against Windows NT/2000
    AUTH 08/27/2008 14:09:04 E 0350 1492 EAP: TLS: ProcessResponse: SSL handshake failed, status = 3 (SSL alert fatal:bad certificate)
    If I configure the client to not check the servers certificate it all works ok.
    Can anyone tell me why my server certificate is getting rejected?
    Thanks,
    Paul

    If Cisco Secure ACS runs on a member server and any user is to be authenticated using EAP-TLS, you must complete additional configuration in Active Directory of the domain containing Cisco Secure ACS. The username that you configured to run all Cisco Secure ACS services must also have permission to read user properties in Active Directory, else EAP-TLS authentication fails.

  • 802.1X EAP-TLS User Certificate Errors

    I'm trying to implement 802.1x using EAP-TLS to authenticate our wireless users/clients (Windows 7 computers).  I did a fair amount of research on how to implement this solution and everything seems to work fine when authentication mode is set to: Computer
    Authentication.  However, when authentication mode is set to "User or Computer" or just "User" it fails.  I get a "certificate is required to connect" pop up and it's unable to connect.
    No errors on the NPS side but I enabled logging on the client (netsh ras set tracing * ENABLED) and this is what I can see.  It seems as if there is a problem with the client certificate:
    [236] 06-04 09:26:35:704: EAP-TLS using All-purpose cert
    [236] 06-04 09:26:35:720:  Self Signed Certificates will not be selected.
    [236] 06-04 09:26:35:720: EAP-TLS will accept the  All-purpose cert
    [236] 06-04 09:26:35:720: EapTlsInitialize2: PEAP using All-purpose cert
    [236] 06-04 09:26:35:720: PEAP will accept the  All-purpose cert
    [236] 06-04 09:26:35:720: EapTlsInvokeIdentityUI
    [236] 06-04 09:26:35:720: GetCertInfo flags: 0x40082
    [236] 06-04 09:26:35:720: FCheckUsage: All-Purpose: 1
    [236] 06-04 09:26:35:720: DwGetEKUUsage
    [236] 06-04 09:26:35:720: Number of EKUs on the cert are 3
    [236] 06-04 09:26:35:720: FCheckSCardCertAndCanOpenSilentContext
    [236] 06-04 09:26:35:720: DwGetEKUUsage
    [236] 06-04 09:26:35:720: Number of EKUs on the cert are 3
    [236] 06-04 09:26:35:720: FCheckUsage: All-Purpose: 1
    [236] 06-04 09:26:35:720: Acquiring Context for Container Name: le-8021xUsers-84adbdd0-a706-4c71-b74a-61a1bd702839, ProvName: Microsoft Software Key Storage Provider, ProvType 0x0
    [236] 06-04 09:26:35:720: CryptAcquireContext failed. This CSP cannot be opened in silent mode.  skipping cert.Err: 0x80090014
    [236] 06-04 09:26:35:720: FCheckUsage: All-Purpose: 1
    [236] 06-04 09:26:35:720: DwGetEKUUsage
    [236] 06-04 09:26:35:720: Number of EKUs on the cert are 1
    [236] 06-04 09:26:35:720: No Certs were found in the Certificate Store.  (A cert was needed for the following purpose: UserAuth)  Aborting search for certificates.
    Also, in the event viewer I get the following:
    Wireless 802.1x authentication failed.
    Network Adapter: Dell Wireless 1510 Wireless-N WLAN Mini-Card
    Interface GUID: {64191d46-0ea6-4251-86bb-7d6de5701025}
    Local MAC Address: C4:17:FE:48:F2:79
    Network SSID: *****
    BSS Type: Infrastructure
    Peer MAC Address: 00:12:17:01:F7:2F
    Identity: NULL
    User: presentation
    Domain: ****
    Reason: Explicit Eap failure received
    Error: 0x80420014
    EAP Reason: 0x80420100
    EAP Root cause String: Network authentication failed\nThe user certificate required for the network can't be found on this computer.
    I created user and computer certificates by duplicating the "User" and "Computer" templates in AD CS.  I modified the "Subject Name" to "Build from Active Directory information".  "Subject Name Format" is set to "Fully Distinguished Name" and "User
    Principal Name (UPN) is checked.  All other boxes are cleared.  I verified that certificates for both user, computer , and root CA are all correctly auto enrolled.  I also verified that the user certificate
    exists in the "Personal" user certificate store on the client.
    There is clearly something wrong with the user certificate but what? I'm at wits ends as I have tried everything.  Please help!

    Hey,
    I am precisely in the same situation now. I have  a win7 client with server2008R2(having AD, and DNS) with NPS running. I have certificate templates and auto enrollment configured. My Win7 machine is able to authenticate using its certificate but
    when I use the user certificate it doesn't work. Both  user/computer certificates are coming from the AD root CA enterprise. NPS has the right certificate. I have verified on client user/local machine , both have their respective certificates in their
    personal stores.
    I have tried all possible combination and even tried changing the key provider but no use.[6472] 12-10 13:39:04:327: Number of EKUs on the cert are 1
    [6472] 12-10 13:39:04:327: FCheckSCardCertAndCanOpenSilentContext
    [6472] 12-10 13:39:04:327: DwGetEKUUsage
    [6472] 12-10 13:39:04:327: Number of EKUs on the cert are 1
    [6472] 12-10 13:39:04:327: FCheckUsage: All-Purpose: 1
    [6472] 12-10 13:39:04:327: Acquiring Context for Container Name: le-LM-USER-4aa6cf55-b6b7-491e-ad5b-735e44eaf3c7, ProvName: Microsoft Software Key Storage Provider, ProvType 0x0
    [6472] 12-10 13:39:04:327: CryptAcquireContext failed. This CSP cannot be opened in silent mode.  skipping cert.Err: 0x80090014
    [6472] 12-10 13:39:04:327: No Certs were found in the Certificate Store.  (A cert was needed for the following purpose: UserAuth)  Aborting search for certificates.
    [6472] 12-10 13:39:04:327: EAP-TLS using All-purpose cert
    [6472] 12-10 13:39:04:327:  Self Signed Certificates will not be selected.
    [6472] 12-10 13:39:04:327: EAP-TLS will accept the  All-purpose cert
    I am stuck at it for last few days with no real cause known as yet.!
    Any help will be thoroughly appreciated!!!

  • 802.1X Port Based Authentication - IP Phone- MDA - Port Security Violation

    I have configured 802.1X authentication on selected ports of a Cisco Catalyst 2960S with Micorsoft NPS Radius authentication on a test LAN. I have tested the authentication with a windows XP laptop, a windows 7 laptop with 802.1X, eap-tls authentication and a Mitel 5330 IP Phone using EAP-MD5 aithentication. All the above devices work with with the MS NPS server. However in MDA mode when the  802.1x compliant  windows 7 laptop is connected to the already authenticated Mitel IP Phone, the port experiences a security violation and the goes into error sdisable mode.
    Feb  4 19:16:16.571: %AUTHMGR-5-START: Starting 'dot1x' for client (24b6.fdfa.749b) on Interface Gi1/0/1 AuditSessionID AC10A0FE0000002F000D3CED
    Feb  4 19:16:16.645: %DOT1X-5-SUCCESS: Authentication successful for client (24b6.fdfa.749b) on Interface Gi1/0/1 AuditSessionID AC10A0FE0000002F000D3CED
    Feb  4 19:16:16.645: %PM-4-ERR_DISABLE: security-violation error detected on Gi1/0/1, putting Gi1/0/1 in err-disable state
    Feb  4 19:16:17.651: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down
    Feb  4 19:16:18.658: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down
    If the port config  is changed to "authentication host-mode multi-auth", and the laptop is connected to the phone the port does not experience the security violation but the 802.1x authentication for the laptop fails.
    The ports GI1/0./1 & Gi1/02 are configured thus:
    interface GigabitEthernet1/0/1
    switchport mode access
    switchport voice vlan 20
    authentication event fail action authorize vlan 4
    authentication event no-response action authorize vlan 4
    authentication event server alive action reinitialize
    authentication host-mode multi-domain
    authentication order dot1x mab
    authentication priority dot1x mab
    authentication port-control auto
    mab
    mls qos trust cos
    dot1x pae authenticator
    spanning-tree portfast
    sh ver
    Switch Ports Model              SW Version            SW Image
    *    1 52    WS-C2960S-48FPS-L  15.2(1)E1             C2960S-UNIVERSALK9-M
    Full config attached. Assistance will be grately appreciated.
    Donfrico

    I am currently trying to get 802.1x port authentication working on a Cat3550 against Win2003 IAS but the IAS log shows a invalid message-authenticator error. The 3550 just shows failed. When I authenticate against Cisco ACS (by simply changing the radius-server) it works perfectly.
    However, I am successfully using IAS to authenticate WPA users on AP1210s so RADIUS appears to be OK working OK.
    Are there special attributes that need to be configured on the switch or IAS?

  • 802.1X Port Based Authentication Security Violation

    I have configured 802.1X authentication on selected ports of a Cisco Catalyst 2960S with Micorsoft NPS Radius authentication on a test LAN. I have tested the authentication with a windows XP laptop, a windows 7 laptop with 802.1X, eap-tls authentication and a Mitel 5330 IP Phone using EAP-MD5 aithentication. All the above devices work with with the MS NPS server. However in MDA mode when the  802.1x compliant  windows 7 laptop is connected to the already authenticated Mitel IP Phone, the port experiences a security violation and the goes into error sdisable mode.
    Feb  4 19:16:16.571: %AUTHMGR-5-START: Starting 'dot1x' for client (24b6.fdfa.749b) on Interface Gi1/0/1 AuditSessionID AC10A0FE0000002F000D3CED
    Feb  4 19:16:16.645: %DOT1X-5-SUCCESS: Authentication successful for client (24b6.fdfa.749b) on Interface Gi1/0/1 AuditSessionID AC10A0FE0000002F000D3CED
    Feb  4 19:16:16.645: %PM-4-ERR_DISABLE: security-violation error detected on Gi1/0/1, putting Gi1/0/1 in err-disable state
    Feb  4 19:16:17.651: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down
    Feb  4 19:16:18.658: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down
    If the port config  is changed to "authentication host-mode multi-auth", and the laptop is connected to the phone the port does not experience the security violation but the 802.1x authentication for the laptop fails.
    The ports GI1/0./1 & Gi1/02 are configured thus:
    interface GigabitEthernet1/0/1
    switchport mode access
    switchport voice vlan 20
    authentication event fail action authorize vlan 4
    authentication event no-response action authorize vlan 4
    authentication event server alive action reinitialize
    authentication host-mode multi-domain
    authentication order dot1x mab
    authentication priority dot1x mab
    authentication port-control auto
    mab
    mls qos trust cos
    dot1x pae authenticator
    spanning-tree portfast
    sh ver
    Switch Ports Model              SW Version            SW Image
    *    1 52    WS-C2960S-48FPS-L  15.2(1)E1             C2960S-UNIVERSALK9-M
    Full config attached. Assistance will be grately appreciated.
    Donfrico

    I believe , you need to configure re-authentication on this switch port:
    ! Enable re-authentication
    authentication periodic
    ! Enable re-authentication via RADIUS Session-Timeout
    authentication timer reauthenticate server

  • 802.1x eap-tls machine + user authentication (wired)

    Hi everybody,
    right now we try to authenticate the machines and users which are plugged to our switches over 802.1X eap-tls. Works just fine with windows.
    You plug a windows laptop to a switchport and machine authenticates over eap-tls with computer certificate. Now the user logsin and our RADIUS (Cisco ACS) authenticates the user as well, with the user certificate. After eap-tls user-authentication the RADIUS checks if the workstation on which the user is currently logged in is authenticated as well. If yes = success, if no the switchport will not allow any traffic.
    Now we have to implement the same befaviour on our MacBooks Pro. Here the problems start. First of all I installed user and computer certificates issued by our CA (Win 2008 R2). So far so good. Now I have no idea how to implement the same chain of authentication. I was reading countless blogs, discussions, documentations etc. about how to create .mobileconfig profiles. Right now im able to authenticate the machine, and _only_ if I login. As soon as I logout eap-tls stops to work. It seems that loginwindow does not know how to authenticate.
    1) how do I tell Mavericks to authenticate with computer certificate while no user is loged in ? already tried profiles with
    <key>SetupModes</key>
    <array>
        <string>System</string>
        <string>Loginwindow</string>
    </array>
    <key>PayloadScope</key>
        <string>System</string>
    but it does not work
    2) How do I tell Mavericks to reauthenticate with user certificate when user logs in ?
    Thanks

    Unfortunatelly this documents do not describe how to do what I want.
    I already have an working 802.1x. But the mac only authenticates when the user is loged in. I have to say that even this does not work like it should. If Im loged in sometimes i need to click on "Connect" under networksettings and sometimes it connects just automatically. Thats really strange.
    I set the eapolclient to debugging mode and see following in /var/log/system.log when I logout.
    Feb 20 18:39:09 MacBook-Pro.local eapolclient[734]: [eaptls_plugin.c:189] eaptls_start(): failed to find client cert/identity, paramErr (-50)
    Feb 20 18:39:09 MacBook-Pro.local eapolclient[734]: en0 EAP-TLS: authentication failed with status 1001
    Feb 20 18:39:22 MacBook-Pro.local eapolclient[734]: [eaptls_plugin.c:189] eaptls_start(): failed to find client cert/identity, paramErr (-50)
    Feb 20 18:39:22 MacBook-Pro.local eapolclient[734]: en0 EAP-TLS: authentication failed with status 1001
    this are only debugging messages I get. Looks to me like eapolclient is not able to find a certificate (?)
    The certificates are in my System keychain.
    Unfortunatelly apple also changed the loging behaviour of eapolclient, I dont see any eapolclient.*.log under /var/log
    Any ideas ?

  • ISE 802.1x EAP-TLS machine and smart card authentication

    I suspect I know the answer to this, but thought that I would throw it out there anway...
    With Cisco ISE 1.2 is it possible to enable 802.1x machine AND user smart card  authentication simultaneously for wired/wireless clients (specifically  Windows 7/8, but Linux or OSX would also be good).  I can find plenty of  information regarding 802.1x machine authentication (EAP-TLS) and user  password authentication (PEAP), but none about dual EAP-TLS  authentication using certificates for machines and users at the same time.  I think I can figure out how to configure such a policy in ISE, but options seem to be lacking on the client end.  For example, the Windows 7 supplicant seems only able to present either a machine or user smart card certificate, not one then the other.  Plus, I am not sure how the client would know which certificate to present, or if the type can be specified from the authenticator.

    Hope this video link will help you
    http://www.labminutes.com/sec0045_ise_1_1_wired_dot1x_machine_auth_eap-tls

  • Problem with Windows 7 802.1x prompted for authentication multiple times

    I have setup a WLAN for users to bring in their own devices (devices are not on the domain).  It is setup for WPA2-Enterprise/AES and it doesn't require certificates.  We authenticate with a Cisco Secure Access Server 5.1.44 (setup with Active Directory).
    I have configure dthe Windows 7 wireless client:
    WPA-Enterprise/AES
    PEAP - removed "Validate server certificate"
    EAPMSCHAPv2 properties disabled "Automatically use my Windows login name and password
    Advanced settings 802.1x - ticked for "user authentication"
    My problem is when I connect to the WLAN, I'm prompted for authentication multiple times (x2).  On the second login prompt everything logs in OK.  No errors are received after the first login attempt.
    Thanks

    This doesn't have anything to do with eap settings?
    Are the current defaults the recommended settings:
    EAP-Identity-Request Timeout (seconds)........... 30
    EAP-Identity-Request Max Retries................. 2
    EAP Key-Index for Dynamic WEP.................... 0
    EAP Max-Login Ignore Identity Response........... enable
    EAP-Request Timeout (seconds).................... 30
    EAP-Request Max Retries.......................... 2
    EAPOL-Key Timeout (milliseconds)................. 1000
    EAPOL-Key Max Retries............................ 2
    EAP-Broadcast Key Interval....................... 3600
    I have seen this multiple times on varying drivers and systems. The first time you login until it is cached.
    Thanks,
    Andrew

  • Alternatives to MS workstation authentication certificates for 802.1x?

    I found out recently the hard way that the Certificate Authority bundled with Windows Server 2008 won't load the 'workstation authentication' certificate template.  (You need 2008 Enterprise/Datacentre or 2008 R2, or any edition of 2008 R2).
    Does anyone know of alternative ways of authenticating a device using 802.1x?
    thanks,
    David.

    Hi Kirbus,
    we open a TAC and we were advised for now to do the following changes:
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:10.0pt;
    font-family:"Times New Roman","serif";}
    1.       please make sure to disable Aironet extensions (if present)  , on the WLAN advanced configuration
    2.       disable management frame protection (MFP) signature generation (if present) , MFP also on the WLAN advanced configuration
    3.       on the WLC general configuration , can you please disable aggressive load balancing
    4.       on the security tab on the WLC , please wireless protection policies > disable client exclusion policies
    5.       on the AP network configuration please disable short preamble the original standard was long preambles
    6.       Wireless -> disable auto-RRM channel & power assignment & try "on demand"
    7.       apply these modification on the WLC CLI
    Config advanced eap identity-request-timeout 20
    Config advanced eap identity-request-retries 10
    Config advanced eap request-timeout 20
    Config advanced eap request-retries 10
    Save config, and see if you still face the problem.
    We are still monitoring the solution, but until now we didn't face the problem again.
    Let me now how it goes for you.
    Thank you.
    Best regards,

  • There is a problem with this connection's security certificate The remote computer cannot be authenticated due to problems with its security certificate. Security certificate problems might indicate an attempt to fool you or intercept any data you send

    Hi,
    I have this Windows 2008 R2 on which I installed remoteapp some years ago.
    Now the certificate expired and I get the message
    "There is a problem with this connection's security certificate
    The remote computer cannot be authenticated due to problems with its security certificate.
    Security certificate problems might indicate an attempt to fool you or intercept any data you send to the remote computer."
    How should I renew the certificate? I already went to certification store and tried to renew certificate with same key but then it says "the request contains nor certificate template information".
    Please advise.
    J.
    J.
    Jan Hoedt

    Does the computer account have Enroll permission to the certificate template?
    From the Server running your CA, run mmc, click File then Add/Remove Snap-in...
    Add Certificate Templates and click OK.
    Find the certificate template, then right click and select properties.  On my CA its call ed RemoteDesktopComputers but might be called something different depending on what what template your certificate is based on.
    On the security tab, click Oblect types, check Computers then OK. Enter the Computername and click OK.  Then give your computer account Enroll permisssion.
    HTH,
    JB

  • AirPort Extreme (802.11n) dual band is reporting problems?

    Hi.
    I can not find an answer for my error-problem:
    AirPort Extreme (802.11n) dual band is reporting problems!
    I have an optimum on line cable modem connected to my AirPort Extreme (802.11n) dual band.
    Ethernet cables connect it 1. into my new Nehalem Mac Pro, 2. into my back-up Quicksilver PowerMac. I also have 2nd gen. iPod touch works on WiFi.
    This set-up has been working well but now I daily get the above error. Sometimes it says also: You have different locations set-up and it asks me to go through the set-up procedure. May be I did the initial set-up incorrect. I don't quite understand "locations" and it's purpose.
    Also the Airport runs very hot so I put a small fan in front of it. A few times I had to disconnect the cable mains to reset and get back my service. Please help.
    W.W.

    Walter Wedler wrote:
    AirPort Extreme (802.11n) dual band is reporting problems!
    I have an optimum on line cable modem connected to my AirPort Extreme (802.11n) dual band.
    Ethernet cables connect it 1. into my new Nehalem Mac Pro, 2. into my back-up Quicksilver PowerMac. I also have 2nd gen. iPod touch works on WiFi.
    This set-up has been working well but now I daily get the above error. Sometimes it says also: You have different locations set-up and it asks me to go through the set-up procedure. May be I did the initial set-up incorrect. I don't quite understand "locations" and it's purpose.
    Can you tell what's telling you about those locations? An Apple AirPort unit can maintain different "configurations" so that it could be used in different locations without a complete reconfiguration. However, I don't believe they're ever referred to as "locations". On the other hand, a Mac can have multiple "locations" defined in the Network panel of System Preferences. Those can be useful if the Mac is used in different places with different arrangements.
    If your AirPort Extreme is having problems the status light on the front will probably be amber. If you launch AirPort Utility and double-click on the AirPort Extreme item on the left, you should be able to see more details about the problem.

  • Cisco ISE for 802.1x (EAP-TLS)

    I work for a banking organization and security is an area that needs to be improved continuously. I am planning on implementing Cisco ISE for 802.1x together with a Microsoft PKI for certificate issuing and signing.
    I am currently trying to implement this in our test environment and I have managed to do a few basic bootstrapping tasks. I need someone to push me into the right direction as to how I can achieve what i am seeking.
    I will use Cisco 2900 series switches on the access layer and a few HP switches as well which supports 802.1x.
    I want to configure the ISE to process authentication requests using 802.1x EAP-TLS (Certificate Based). All the workstations on the domain needs to authenticate itself using the certificates issued to it by the Certificate Issuing Authority.
    I have already managed to get the PKI working and have rolled out the certificates on all the workstations on the test environment. I can't seem to configure the Authentication portion on the ISE.
    I request if someone can guide me or direct me to materials that can help achieve the above requirements. The guides available on the Cisco website are  overwhelming and I can't seem to figure out how I am supposed to configure the authentication portion.
    My email: [email protected]
    Cheers,
    Krishil Reddy

    Hello Mubashir,
    Many timers can be modified as  needed in a deployment. Unless you are experiencing a specific problem  where adjusting the timer may correct unwanted behavior, it is  recommended to leave all timers at their default values except for the  802.1X transmit timer (tx-period).
    The tx-period timer defaults to a value of 30 seconds.  Leaving this value at 30 seconds provides a default wait of 90 seconds  (3 x tx-period) before a switchport will begin the next method of  authentication, and begin the MAB process for non-authenticating  devices.
    Based on numerous deployments, the best-practice  recommendation is to set the tx-period value to 10 seconds to provide  the optimal time for MAB devices. Setting the value below 10 seconds may  result in the port moving to MAC authentication bypass too quickly.
    Configure the tx-period timer.
    C3750X(config-if-range)#dot1x timeout tx-period 10

  • Eap tls authentication fails if bluetooth device connected

    Hi All, I'm new to Macs but was tasked with getting a MacBook Air connected to our AD integrated, 802.1x wifi network. After a lot of trial and error with certificates I finally got this working but now have a rather bizarre problem. With the MBA on it's own it will connect to the wifi network, sucessfully authenticate and work perfectly well. However, if my Apple bluetooth mouse or keyboard are connected to the MBA the EAP-TLS authentication fails. A packet capture of the connection process shows that at the same point every time the process take a while then a packet shows as "Unknown Error Ignored", then loops thorugh the process. Turning off the keybpard and mouse at this point and the MBA will connect. Once connected I can then connect the keyboard and mouse and continue to stay connected for a while before, I assume, the AP forces a re-auth and the connection drops again.
    Has anyone come across this elsewhere?
    Thanks

    I have a Macbook Pro Retina 15" from 2012 and it has the same issue. Running 10.8.4. I have spent probably 5-6 hours trying to troubleshoot cert's network settings, did a complete fresh install (then restored from timemachine when that did not work) with no luck this solution worked but obviously is not a real solution as it should not confilct in this way. Great job on finding a workaround! I will be contacting apple about this ASAP under my applecare.

  • 802.1x EAP-TLS for wired users with ACS 5.5

    Hi All,
    We are configuring a new setup for wired users authentication with 802.1x(EAP-TLS). ACS 5.5 we are using as authentication server.
    We have added the root CA(internal) certificate and certifcate for ACS signed by CA. Now We want to check the authentication is working or not . I hope both root CA and identity certifcate also we need to install in the laptops. But I am not sure how to download the certifcates for client machine manually from CA.
    Kindly suggest on how to get certificates for clients both manually as well as automatically?
    Thanks,
    Vijay

    Hi Vijay,
       for the Wired 802.1x (EAP-TLS) you need to have following certificates:
    On ACS--- Root CA, Intermediate CA, Server Certificate
    On Client-- Root CA, Intermediate CA, User certificate(In case of user authentication) OR Machine certificae(In case of Machine authentication)
     I am not sure which third party certificate are you using, If its in house Microsoft or any other certificate server then you need download the client certificate from the server itself. 
    In case of Microsoft, There will be a template for user certificate. You can select it and create user certificate
    This one is an old document, But has steps to configure Machine certificate for the user, You can see the steps to download user certificate if its Microsoft server:
    http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-server-windows/43722-acs-eap.html#wc-2
    In case You are using the third party certificate serevr , Then you need to check with them on how to download the user certificate
    Cheers
    Minakshi(rate the helpful post)

  • 802.1x EAP-TLS with Cisco IP-Phone on MS NPS

    Hi,
    does anybody get 802.1x - EAP-TLS with IP-Phones ( e.g. 7962G ) on Microsoft NPS up and running?
    With ACS it is not a problem at all.
    thx
    Sebastian

    Hi all !
    Have you solved this problem (LSC certificate )? I am facing the same problem and I did not find the solution yet.
    This is the last e-mail that Microsoft TAC has sent to the customer:
    ====================================================================================
    As per the discussion, we need to engage Vendor on the case to find out why the CRL Distribution Point (CDP) and AIA paths are missing from the certificate. Ideally CDP contains that Revocation List of the certificates and AIA is used for building the certificate chain.
    "Please find below some more information about the same from Microsoft TechNet Article :
    CRL Distribution Points : This extension contains one or more URLs where the issuing CA’s base certificate revocation list (CRL) is published. If revocation checking is enabled, an application will use the URL to retrieve an updated version of the CRL. URLs can use HTTP, LDAP or File.
    Authority Information Access : This extension contains one or more URLs where the issuing CA’s certificate is published. An application uses the URL when building a certificate chain to retrieve the CA certificate if it does not exist in the application’s certificate cache."
    =====================================================================================
    Tks for your help !!!!!!!
    Luis

Maybe you are looking for