Dot1x guest-vlan issues with windows XP

Hi,
I have dot1x setup on a 3560. I basically have 3 vlans configured.
All ports are in vlan "guest (vlan 10)" by default. The authenticated "AUTH" vlan is pushed by the radius server after successful authentication. And finally I have a guest/auth-fail vlan for non-dot1x capable machines.
Everything works fine except that when I connect windows XP machine which is not on the domain then I am not assigned to a guest vlan. The port stays in unauthorized state and a "show interface" output shows that the port is up but line protocol is down.
It works sometimes but other times it doesnt.
Is there a trick to it. Also I read an article on ciscos website which was specific to XP and dot1x i.e. the switches waits ~ 180 seconds and you need to plug the cable in/out of the switch to make it to work...I havent tried this yet but anybody has any better ideas then this technique.
I have the standard config:
int fa0/1
dot1x port-control auto
dot1x guest-vlan 10
dot1x auth-fail vlan 10
I am thinking of tweaking the "quite period" and the switch-to-client retransmission timeout values.
Note: Like I mentioned earlier. After successful authentication corporate clients are put in the correct vlan. Its just the "guest" vlan piece which is not working.
Thoughts? pointers? Comments?

OK, first WRT the documentation reference:
Not entirely accurate. If a host fails to respond to the authenticator, the port remains in the connecting state for [tx-period (max-reauth-req + 1)] seconds. A login window even appearing on an XP machine is dependent on the configuration (usually only occurs with MD5). Not sure about the unplugging cables stuff at all ;-). This certainly shouldn't be in there though, since that's not really a workaround for anything. It is correct in saying that 1X-capable hosts should not be placed in the Guest-VLAN. It's also correct in explaining the quiet period during the HELD state after a failed authentication attempt. However, the rest is completely dependent on the Microsoft supplicant. The Microsoft supplicant gives up on 1X entirely after it fails 3 times in a row. No other supplicants do this AFAIK. Since it gives up on 1X, then that explains why the port would be "stuck" in a connecting state. Not sure if this is just trivia or what though in context to the reference.
WRT your configuration:
If you're interested in having 1X timeout any quicker than it does now (see formula above) then the only timers/values you need to bother with are tx-period and/or max-reauth-req. supp-timeout is for non-EAP control packets. The quiet-period is how long the port is in a HELD state when it fails authentication.
Does this help?

Similar Messages

Dot1X guest vlan authentication issue..Real Challenge!!

Hi Guys!
I would really appreciate if some one could help me find lead on this issue...
My coporate and Quarantine users dosn't get correct VLAN as soon as i enable Guest VLAN feature..all of them go to guest VLAN...
Scenario 1
interface GigabitEthernet3/0/42
switchport mode access
authentication port-control auto
dot1x pae authenticator
dot1x timeout quiet-period 5
dot1x timeout tx-period 5
spanning-tree portfast
Test Workstation behavior
802.1X (Corporate) = VLAN 1
802.1X (Quarantine)= VLAN 20
Non-802.1X (Guest) = UnAouthorized
Conclusion
802.1x authentication is working without the guest VLAN feature
Scenario 2
interface GigabitEthernet3/0/42
switchport mode access
authentication event no-response action authorize vlan 30
authentication port-control auto
dot1x pae authenticator
dot1x timeout quiet-period 5
dot1x timeout tx-period 5
spanning-tree portfast
Test Workstation behavior
802.1X (Corporate) = VLAN 30 GuestVlan
802.1X (Quarantine)= VLAN 30 GuestVlan
Non-802.1X = VLAN 30 GuestVlan
Conclusion
802.1X doesn't work after enabling Guest VLAN feature (no-response)
Some important notes...
1) IOS version = c3750-ipbase-mz.122-50.SE.bin the only IOS which supports 10gig modules...
so i can not test with any other IOS
2) We had older 3750 100Mpbs switches with same config (we copied the config from old switch to new Switch) and the only command which got change automatically due to IOS change is....
dot1x guest-vlan 30 (Old IOS syntax) = authentication event no-response action authorize vlan 30 (New IOS syntax)
so even if you put old command syntax it will get change to new one...
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750e_3560e/software/release/12.2_50_se/configuration/guide/sw8021x.html#wp1176660
Guys please help me.........

Just to update you here.......after running some debugs on Swicth i found that....(Scenario-2)
When we connect 8021X enabled PCs (Coporate users) and Boot them...they initially behave like Non-8021X client while booting and during that time switch puts them in guest vlan but when workstation comes to a state (login prompt)where they start communicating like 8021X client.....switch just fails to put them in appropriate VLANs.. may be due to some time out issues.........I feel like i am very close to get the solution but just wondering which timers need to change or may be i am wrong if there is something else need to be put in...........any way i just shared my things with you....
Same Workstations are working fine with old swicthes without any problem...it is windows XP SP3

Dot1x guest VLAN on 2960G

Hi,
I have a 2960 sw configured for dot1x authentication, the problem is the Guest VLAN and Restricted VLAN didnot work. The switch port was stuck in authenticating status.
The server is Juniper IC4500.
Switch is 2960G, IOS 15.0(1)SE2
the configuration:
aaa new-model
aaa authentication login default local
aaa authentication dot1x default group radius
aaa authorization exec default local
aaa authorization network default group radius
dot1x system-auth-control
dot1x test timeout 30
dot1x guest-vlan supplicant
dot1x critical eapol
interface FastEthernet0/32
switchport access vlan 28
switchport mode access
authentication event fail action authorize vlan 41
authentication event server dead action authorize vlan 41
authentication event server dead action authorize voice
authentication event no-response action authorize vlan 41
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab
authentication port-control auto
authentication timer reauthenticate 300
authentication violation protect
mab eap
dot1x pae authenticator
dot1x timeout quiet-period 5
dot1x max-req 1
dot1x max-reauth-req 1
dot1x max-start 1
spanning-tree portfast
Anyone with experience on this pls help.
Thanks,
hoanghiep

forgot to mention that multi-auth do not support actions on either no-response or fail authentication events. So you need to set host-mode to MDA or single host.
Ref:
http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/sw8021x.html#wp1454875

Compatibilityy issue with windows XP and windows 8.1 for adobe photoshop elements 4.0

Compatibility issue with windows XP and windows 8.1 for adobe photoshop elements 4.0?comcom

You are going to have to contact Adobe on this one. We are other users.
Sounds like it's not even an Apple question? Not sure.
But the Adobe program changed, nothing changed in iTunes, right?

Major Issues with Windows XP and Sound Blaster Audig

As mentioned in the post title, I'm using a Sound Blaster Audigy 4 card (recently purchased) and am having issues with Windows XP apparently because of it. When the card is physically installed, but the drivers are not, there are no problems. However, when the drivers are installed, Windows XP's "explorer.exe" crashes on boot, locking up the start menu and any other open windows. Now, I can manually end the explorer.exe application and then reboot it, and things will work... however, I cannot imagine that that is the intended functionality of this card. Additionally, I suspect the card in the failure of a game (Eve Online) but I would assume the issues are related. I've already narrowed the issue down to the Sound Blaster drivers. I've tried booting with the SB drivers but without the video card drivers, and the problem recurred. Every time I boot with the SB drivers installed, it fails. Without them, things seem to run normally. If it helps, I'm using an Intel Core 2 Duo E6400 processor, with GB of DDR800 RAM. I've installed Windows Service Pack 2 and all the other updates. The video card is a Geforce 7950 GT, with the latest NVidia Forceware (93.7) drivers. I've had this problem with both the Audigy drivers on the CD that came with the card and the newest ones downloaded from this website. My motherboard is a Gigabyte GA-965P-DS3, which includes onboard sound hardware, but I have disabled it at the BIOS level. I can provide dxdiag information or anything like that if necessary. Does anyone have any advice, suggestions, or have you encountered a similar problem?Message Edited by DerekKatz on 2-04-200603:2 AM

Thanks for the helpful reply Dan
I ran the file, CTZAPXX.exe, like suggested, and it ran without a problem. It installed the files and even required me to reboot my computer!!
However, after a computer restart, I am still in the same boat. Codecs are installed, but the location of the device is "unknown". In Device manager, there are no unknown devices; it shows the codecs in the sound tab, but no actual hardware; as if my sound card does not exist.
I use my computer for music, and my buddy needs me tomorrow night to play some music stored on my computer. I really do appreciate the help I am offered. I do not mean to sound impatient, but I really need this device fixed, or I will have to have him buy me a sound card....

Weird issue with Windows Server 2008 R2 Print Server

I have an issue with Windows 2008 R2 (VMWare Hosted) running Windows Print Server.
Prior to a small network change, the print server was working well, hosting about 80 different networked printers from various vendors.
We made a change (that we ended up rolling back) to the Client's DHCP Scope OPT 006 (DNS Servers). The DNS servers never quite worked right and broke AD authentication to different servers, and was just a mess.
After rolling back we are not able to keep the printers online. If we ping them from the print server, the printer(s) never wake up, when a print job is submitted. If we ping them from one of the access switches, they work fine (until they fall back asleep),
to prevent this, if we start a ping on the server AFTER waking them up from the Switch Ping, they stay online and no problems.
If we stop the ping, they fall back asleep at some point, and again, won't wake up without intervention/switch side ping.
Has anyone experienced anything like this? Any tips on how I could possibly resolve it?
Thanks in advance.

Hi,
According to your description, the issue seems to be that the printers can't keep online. Sounds like a power managerment issue. Why these printers fall into sleep? Have you consulted this issue with the manufacturer of these printers? Do these printers
fall into sleep if them lose the contact with printer server? Have you tried to reset the printers?
>>We made a change (that we ended up rolling back) to the Client's DHCP Scope OPT 006 (DNS Servers).
DNS client will cache the recently queried records. If the DNS server has replied with a wrong records, communication issues will occur. To clear the DNS cache on a Windows device, please run the command below:
ipconfig /flushdns
Best Regards.
Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Itunes issues with Windows having to do with Apple's patent

I had a thought and am not sure if it's right. I was wondering if myissues with Apple Itunes store on Windows 7 has anything to do with the Patent laws and all with Apple and samsung and all that.

I had the same issues with Windows 8 Consumer Preview. I installed on a fresh system and still had issues.
I experienced extreme lag, with pretty much everything, and iTunes freezing once I attempted to change the currently playing song.
I had a mess with compatibility mode and found out that running it in with Compatibility mode enabled for Windows XP (Service Pack 3) and as an administrator fixed it. It works now, however, there is a popup message that comes up on launch telling you to change the compatibility settings, but pressing "OK" makes it go away.
How?
Open Windows Explorer, and navigate to: "C:\Program Files\iTunes" (For 32bit) or "C:\Program Files (x86)\iTunes" (For 64bit), unless you changed it.
Right-click on "iTunes.exe", select "Properties" from the context menu, and click the "Compatibility" tab.
Under "Compatibility mode" check off "Run this program in compatibility mode for:" and select "Windows XP (Service Pack 3)" from the drop down menu.
Further down under "Privilege level" check off "Run this program as an administrator".
Click "Apply" and "OK".
Should fix any issues, I have my default iTunes Media Folder Location within an external hard drive so unplugging all of my USB's wasn't an option.
Hope I helped!

Itunes issues with windows 8... laggy?

anyone one else having abit a of laggy issue with playing music on windows 8?
i just upgraded to windows 8 con. preview, and its great and fast.
i use to have windows 7 and itunes never skipped a beat.
i have a sony viao with an upgraded ram and ssd hdd.
and its pretty fast.
so i dont think its my computer and windows 8 seems to be fine.
anyone else having this issue? but it only happens now and then.......
NOTE:
i have my music all copied to my sdd hdd aswell
and thats all thats really on there as i have ext. hdd's.
i have a average size library in itunes with around about 50gb of music.

I had the same issues with Windows 8 Consumer Preview. I installed on a fresh system and still had issues.
I experienced extreme lag, with pretty much everything, and iTunes freezing once I attempted to change the currently playing song.
I had a mess with compatibility mode and found out that running it in with Compatibility mode enabled for Windows XP (Service Pack 3) and as an administrator fixed it. It works now, however, there is a popup message that comes up on launch telling you to change the compatibility settings, but pressing "OK" makes it go away.
How?
Open Windows Explorer, and navigate to: "C:\Program Files\iTunes" (For 32bit) or "C:\Program Files (x86)\iTunes" (For 64bit), unless you changed it.
Right-click on "iTunes.exe", select "Properties" from the context menu, and click the "Compatibility" tab.
Under "Compatibility mode" check off "Run this program in compatibility mode for:" and select "Windows XP (Service Pack 3)" from the drop down menu.
Further down under "Privilege level" check off "Run this program as an administrator".
Click "Apply" and "OK".
Should fix any issues, I have my default iTunes Media Folder Location within an external hard drive so unplugging all of my USB's wasn't an option.
Hope I helped!

Qualcomm Mobile Broadband Gobi2000 compatibility issue with Windows 8 and above

I am facing Qualcomm Mobile Broadband Gobi2000 competibility issue with Windows. Previously, after installing windows 8, I faced a problem of random shut down. But, after running registry and malware scan, it's now almost settled . But, my Broadband modem randomly stops working , and Windows Action Centre points it out as "USB Modem Qualcomm Mobile Broadband Gobi2000 is not competible with current version of Windows". It further suggest to contact HP for resolving the issue.

I have called HP-Support and the answer was:
«Thank you for contacting HP Active Chat Support.
This is in continuation to our response with regards to your chat ID: 63381567
As for the case logged in for compatibility issues after upgrading to windows 8.1, kindly try the steps below and see if that helps.
Start the computer.
Press the F10 key to enter the BIOS setup.
Select Restore Defaults .
Under Load Defaults , select Yes .
Choose Save Changes and Exit .
Under Save Changes and Exit , choose Yes .
If Microsoft Windows does not recognize the external USB WWAN modem module, try the steps below:
The Telephony Service has been disabled. Follow these steps to enable the Telephony Service:
Open Control Panel .
Expand View by: and select Large Icons .
Click Administrative Tools .
Double-click Services .
Double-click Telephony .
Under the General tab, expand Startup Type , then select Automatic .
Click Apply , click Start , then click OK .
Restart the system.
If the issue still remains the same, kindly contact Microsoft or we would request you to be patient while we have more drivers available on the HP website.»
The issue was not resolved.
So I'm waiting for the release of the new driver...

Is there a known issue with windows 8 supporting itunes?

each time I update itunes I lose my itunes store connection and therefore can't update apps etc. Is this a known issue with windows 8 users?

Yes. Some are complaining.
Search iTunes.exe. RIght Click, Properties, Compatibility, Click Run this program as Adminitrator. OK.
See if this helps

Where is the forum for Windows Update issues with Windows 10 TP 9926

Trying to find a fix to the Windows Update issue with Windows 10 TP 9926 build and can't find the correct forum to post this question?
This will impact receiving the new build upgrades and will impact test strategy for the new supported OS in our desktop application.

Might try them over here.
http://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_update?sort=lastreplydate&dir=desc&tab=Threads&status=&mod=&modAge=&advFil=&postedAfter=&postedBefore=&threadType=All&tm=1427037339534
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

URL issue with Windows 7 Internet Explorer 11 and SAP NW PI 7.

Hello SAP community,
I am facing a strange issue with Windows 7 - Internet Explorer 11 and SAP NW java services (I hope I am in the correct discussion) ...
When I try to open URL http://sapserver.hosters-name:port it is working so far with Windows 7 and Internet Explorer 11.
But when I click than on NWA (example), I am getting "http 500 server error".
I don't have the issue, when I start-up a VMware Workstation with Windows XP and Internet Explorer 8.
But now the strange part: In our network DNS (Domain Name Service), we can also open the URL by http://sapserver.our-dns:port.
Than it is working without problems with Windows 7 and Internet Explorer.
I would agree to state the comment - it is just a Windows 7/Internet Explorer 11 issue, if it wouldn't work for both URLs (http://sapserver.hosters-name:port = problem URL; http://sapserver.our-dsn:port = working).
We are using a SAP NW PI 7.x system. Some URLs for PI are using http://sapserver.hosters-name:port/java service.
Do you have any hints what is cause the issue - I suspect some with Internet Explorer and Firefox (because with Google Chrome at least the URL for NWA is opened, beside the issue, Google Chrome can't display NWA content)?
Thanks for your help.
Best regards
Carlos

Hi all,
I think I found the solution.
The reason seems to be, the domain name for http://sapserver.our-dns:port, "our-dns" was already added to the compatibility view settings of Microsoft Internet Explorer.
That seemed to be the reason, why it was working with http://sapserver.our-dns:port.
When I now added for http://sapserver.hosters-name:port the domain "hosters-name" to the compatibility view settings it is now working.
Internet Explorer Options => Settings for compatibility view => Add domain
Best regards
Carlos

When will there be an itunes update that resolves the compatibility issues with windows 8

When will there be an itunes update that resolves the compatibility issues with windows 8

I hadn't heard there are issues. Can you tell me what the issues you have run into are? I just downloaded it yesterday on my new laptop and I am having issues syncing today...

SSLVPN connectivity issue with Windows 7 x64 All browsers.

I think that I have tried everything to get this working but whatever I seem to do I cannot connect to my SSLVPN using Windows 7 x64. The 32bit version is fine. I have installed the Microsoft C++ Redistributable 2010 and 2005 for both x86 and x64. I have tried clearing the cache in the Browser. I have installed Chrome and Firefox , I even started my laptop using the 'Disable Driver Signature Enforcement' from Advanced Boot options but nothing is working.
Does anyone have anything else to try. This is a bit of a showstopper for us because not do we have this issue with Windows but we have Mac users as well and that is also an issue.
Cisco really needs to fix this issue fast...
Please help.
Thanks
Mark Sheehan

Try using both the 32-bit and 64-bit versions of Internet Explorer. Sometimes one of the two will work.

Ipod sync issues with Windows 7

I just purchased a new computer with the Windows 7 operating softeware and now I cannot sync my Ipod Touch (3rd generation) but I do not experience this issue with my old computer with Windows Vista. When I need to update my Ipod I have to connect it to my old computer. Help. I do not want to pay Apple for support when I see countless post about this issue.

Diane Wordsmith wrote:
Are you set to manually manage on both computers? If not, an auto sync on one of them will erase the iPod and place that computer's library on it.
No that wouldn't be it. The manual vs. Auto sync setting is stored on the iPod, not on iTunes. So if you take a manually managed iPod and plug it into an iTunes it has never connected to before, the new iTunes will still recognize the iPod as manually managed and not do anything bad to it (in theory).
Patrick

Dot1x guest-vlan issues with windows XP

Similar Messages

Maybe you are looking for