EAP-TLS with ISE 1.1.2 and WLC 7.0.228

Hi,
I'm on process of implement Cisco ISE with Wireless LAN Controller. According to my post, I would like to know that if Supplicant Provisioning and EAP-TLS does support on this type of firmware code.
WLC running on 7.0.228 since most of production APs are 1230
ISE running on the latest version.
I have to use EAP-TLS and Supplicant Provisioning on these platforms.
Is this possible to do about this ?
Thanks,
Pongsatorn Maneesud

Please check the below compatibility matrix  link for Cisco ISE along with a link for client provisioning which might  be helpful:
http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_61_byod_provisioning.pdf
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_client_prov.html

Similar Messages

  • EAP-TLS with ISE

    I have been reading the Cisco ISE for BYOD and trying to create an Authentication Policy for EAP-TLS. When I build the new policy and add a new condition, then go to Network Access, EAPAuthentication is not an option. So I went to policy element and created a new Authentication, Compond condition and added it to the library. When I try to add it to my Authentication Policy it doesnt allow me to chose it and says only relevant conditions are selectable. Am I missing a step somewhere?
    Any help is greatly appreciated and thanks in advance!

    Thanks that's what I needed thanks. I was closing out of my current policy and inserting a new above the default. Now I need to get my certs working with my phone and ISE. Currently, we are using packetfence and Mobil iron which issues the certs during registration - still working with security team to see how this is done. When I look at the certs on my phone I can see the root certs, but when I create a SSID and chose a cert the root isnt an option. Any ideas how I can connect using a new ssid with the root certs on my phone?

  • Windows EAP-TLS with machine cert only?

    Hey all. Seems like this should be an easy question, but after doing some reading, I'm still a little confused.
    Can I authenticate a windows computer against ISE using EAP-TLS with a computer-only certificate and stay authorized when the user logs in? Or will it always try to authorize the user when they log in and break the connection if that fails?
    Thanks for any clues.

    Hello Leroy-
    EAP Chaining (Official name:EAP-TEAP [RFC-7170]) is a method that allows a supplicant to perform both machine and user authentication. In ISE, EAP-Chaining is enabled under the "EAP-FAST" protocol. For more info check out the the following links
    Cisco TrustSec Guide:
    http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_80_eapchaining_deployment.pdf
    RFC:
    https://tools.ietf.org/html/draft-ietf-emu-eap-tunnel-method-01
    Thank you for rating helpful posts!

  • EAP-TLS with WLC 5508, Microsoft NPS and custom EKU OID´s

    We are trying to implement EAP-TLS with client certificates that have a custom EKU OID to distinguish the WLAN clients. The Microsoft Press Book
    Windows Server 2008 PKI and Certificate Security gives an example on how to configure a policy in NPS that matches specific EKU OID´s. At the moment we have two policies that have an allowed-certificate-oid configured that matches the OID´s in our certificates, but our setup is not working as expected. Authentications will only be successful, if the client authenticates with the certificate that is matched by the first policy rule.
    For example:
    Policy 1: allowed-certificate-OID --> corporate
    Policy 2: allowed-certificate-OID --> private
    Client authenticates with EKU corporate --> success
    Client authenticates with EKU private --> reject
    My expectation was, that if Policy 1 will not match the NPS goes over to Policy 2 and tries to authenticate the client.
    Has anyone a simmilar setup or can help to figure out what is going wrong?
    We have a WLC 5508 with Software Version                 7.4.100.0 and a NPS on a Windows Server 2008 R2
    regards
    Fabian

    The policy rejects and the NPS goes to the next policy, only if the user does not belong to the configured group.
    This means I need to have one AD group per application policy, but that will not solve my problem. A user could belong to more than one group, depending on how many devices he/she has. It will work with one group only for each user, because the first policy that matches a AD group, the user belongs to, could have a OID that is not in the certificate. This would cause a recejct with reason code 73:
    The purposes that are configured in the Application Policies extensions, also called Enhanced Key Usage (EKU) extensions, section of the user or computer certificate are not valid or are missing. The user or computer certificate must be configured with the Client Authentication purpose in Application Policies extensions. The object identifier for Client Authentication is 1.3.6.1.5.5.7.3.2.
    The certificate does include this OID but not the custom EKU.

  • EAP-TLS with WLC 5.2.178 Improve Performance and Roams?

    Good Morning...
    I've been working on moving our clients over to EAP-TLS with Machine Auth for sometime. I had moved the IT Department over a couple of months ago as a test with no issues reported and have tested on a few of our Medical Carts (CoWs) as well with no issues reported. However, upon deploying to a larger population of Carts (Specifically using Atheros 5006x 7.x Driver {No Client}) I've been getting some client drop complaints. If I look at the client history I do see a lot of "Client Associations" or Roams that occure anywhere from ever 2minutes, to every 10minutes to every 5 hours. These carts do move around ALOT as they are pushed from one Patient Room to another so I'm guessing the drops are occuring during a re-authentication phase as the device roams. Looking at the device you might not be able to tell it's dropping but the software we use (Meditech) is very connection sensitive in doing a simple ping you may see a couple of dropped packets until the client is fully connected again. So I'm guessing the roaming is the issue. What can we do to fight this or make it more effecient? It was mentioned to me by a colleague (who doesn't know where he saw it) that he thought it was possible to configure the WLC's to not reauthenticate on the roam? I'm guessing something must be able to be tweaked if the 7921's and 25's support EAP-TLS as this type of latency would never work. By the way I'm using an ACS 4.2 as my authentication platform mapped back to AD.

    You will always reauth with a roam. That is part of the 802.11 spec. How you reauth will depend on the type of security you have setup. If you are using WPA2/AES or CCKM the reauths can be done with a PMK instead of needing to go through the entire reauthentication process. Try running "debug client " for a client having the issue and see if it gives you an idea of where the authentication is failing.

  • 802.1x EAP-TLS with Cisco IP-Phone on MS NPS

    Hi,
    does anybody get 802.1x - EAP-TLS with IP-Phones ( e.g. 7962G ) on Microsoft NPS up and running?
    With ACS it is not a problem at all.
    thx
    Sebastian

    Hi all !
    Have you solved this problem (LSC certificate )? I am facing the same problem and I did not find the solution yet.
    This is the last e-mail that Microsoft TAC has sent to the customer:
    ====================================================================================
    As per the discussion, we need to engage Vendor on the case to find out why the CRL Distribution Point (CDP) and AIA paths are missing from the certificate. Ideally CDP contains that Revocation List of the certificates and AIA is used for building the certificate chain.
    "Please find below some more information about the same from Microsoft TechNet Article :
    CRL Distribution Points : This extension contains one or more URLs where the issuing CA’s base certificate revocation list (CRL) is published. If revocation checking is enabled, an application will use the URL to retrieve an updated version of the CRL. URLs can use HTTP, LDAP or File.
    Authority Information Access : This extension contains one or more URLs where the issuing CA’s certificate is published. An application uses the URL when building a certificate chain to retrieve the CA certificate if it does not exist in the application’s certificate cache."
    =====================================================================================
    Tks for your help !!!!!!!
    Luis

  • EAP-TLS with IAS

    Hi, has anyone got some good documentation on setting up EAP-TLS with windows 2003 Active Directory/CA, IAS and Cisco AP1200.
    Cisco ACS 3.3 does not support NTLMv2 so I have to use IAS.
    Any suggestions?

    Hi,
    I give you a good documentation explaining how to implement EAP-TLS with IAS (But it is not a AP1200)
    Regards,
    Davy

  • ACS 4.2 and EAP-TLS with AD and prefix problem

    Hi there
    we have the following situation:
    - 2 x ACS (1 x ACS SE 4.2 and 1 x ACS 4.2) for domain A
    - 2 x ACS (1 x ACS SE 4.2 and 1 x ACS 4.2) for domain B
    First of all, is it a problem to have an ACS SE and an ACS working together for one domain, I don't think so? When we had only one domain and both ACS SE were responsible for domain A, it worked.
    Now after the changes, machine authentication with EAP-TLS doesn't work anymore. In the logs it always says that the "External DB user is unknown" for a (machine) username like host/abc.domain.ch
    This is the normal output of the Remote Agent, it finds the host but then nothing happens:
    CSWinAgent 11/30/2009 16:32:13 A 0140 3672 0x0 Client connecting from x.x.x.x:2443
    CSWinAgent 11/30/2009 16:32:14 A 0507 3512 0x0 RPC: NT_DSAuthoriseUser received
    CSWinAgent 11/30/2009 16:32:14 A 0474 3512 0x0 NTLIB:       Creating Domain cache
    CSWinAgent 11/30/2009 16:32:14 A 0549 3512 0x0 NTLIB: Loading Domain Cache
    CSWinAgent 11/30/2009 16:32:14 A 0646 3512 0x0 NTLIB: No Trusted Domains Found
    CSWinAgent 11/30/2009 16:32:14 A 0735 3512 0x0 NTLIB: Domain cache loaded
    CSWinAgent 11/30/2009 16:32:14 A 2355 3512 0x0 NTLIB: User 'host/abc.domain.ch' was found [DOMAIN]
    CSWinAgent 11/30/2009 16:32:14 A 0584 3512 0x0 RPC: NT_DSAuthoriseUser reply sent
    So I made a test from an ASA to see if the host/ is a problem (before any changes were made it wasn't a problem):
    test aaa authentication RADIUS host 10.3.1.9 username host/abc.domain.ch (the ASA transforms the host/ input to the correct Windows schema with the $):
    CSWinAgent 11/30/2009 15:39:23 A 0140 3672 0x0 Client connecting from x.x.x.x:1509
    CSWinAgent 11/30/2009 15:39:23 A 0390 3728 0x0 RPC: NT_MSCHAPAuthenticateUser received
    CSWinAgent 11/30/2009 15:39:23 A 0474 3728 0x0 NTLIB:       Creating Domain cache
    CSWinAgent 11/30/2009 15:39:23 A 0549 3728 0x0 NTLIB: Loading Domain Cache
    CSWinAgent 11/30/2009 15:39:23 A 0646 3728 0x0 NTLIB: No Trusted Domains Found
    CSWinAgent 11/30/2009 15:39:23 A 0735 3728 0x0 NTLIB: Domain cache loaded
    CSWinAgent 11/30/2009 15:39:23 A 1762 3728 0x0 NTLIB: Got WorkStation CISCO
    CSWinAgent 11/30/2009 15:39:23 A 1763 3728 0x0 NTLIB: Attempting Windows authentication for user ABC$
    CSWinAgent 11/30/2009 15:39:23 A 1815 3728 0x0 NTLIB: Windows authentication FAILED (error 1326L)
    CSWinAgent 11/30/2009 15:39:23 A 0373 3728 0x0 NTLIB: Reattempting authentication at domain DOMAIN
    CSWinAgent 11/30/2009 15:39:23 A 0549 3728 0x0 NTLIB: Loading Domain Cache
    CSWinAgent 11/30/2009 15:39:23 A 1762 3728 0x0 NTLIB: Got WorkStation CISCO
    CSWinAgent 11/30/2009 15:39:23 A 1763 3728 0x0 NTLIB: Attempting Windows authentication for user ABC$
    CSWinAgent 11/30/2009 15:39:23 A 1815 3728 0x0 NTLIB: Windows authentication FAILED (error 1326L)
    CSWinAgent 11/30/2009 15:39:23 A 0456 3728 0x0 RPC: NT_MSCHAPAuthenticateUser reply sent
    It's clear that the test was not successful because of the wrong "machine password" but it's a different output as before. I saw that in ACS 4.1 you could change the prefix of /host to nothing, but in 4.2 this is not possible anymore.
    Could this be the problem or does someone see any other problem?
    Best Regards
    Dominic

    Hi Colin
    thanks for your answer, we had the this setting correct. I was able to solve the problem yesterday, we had some faults in the AD mapping.
    I didn't know that when I select more AD groups for one ACS group in one step, that the user / host has to be in every of these AD groups (AND conjunction).
    Now I only added one AD group for my ACS group and it works. The error message "AD user restriction" was not very helpful for finding this fault ;-)
    Regards
    Dominic

  • IPhone and EAP-TLS with ACS & 5508

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin:0in;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    I have a large customer that is moving into a new building and adding some
    new wireless.
    They are using a 5508 with 1142's and an ACS server.
    They will have the following SSID's
    SSID01 -> WPA-EAP-TLS
    SSID02 -> WPA2-EAP-TLS (future use)
    SSID03 -> Guest Access (internet access only)
    They currently use this design across the enterprise which has worked well.
    The problem is to get certificates pushed down to the client for the EAP-TLS
    they always connect the machine once by wire and log on to the domain so a
    GPO pushes the cert to the machine.
    This creates a problem that I don't know how to solve as they want to use
    iPhones on the new deployment.
    Does anyone have any ideas on how to get a cert down to the iPhones for use
    with the SSID's?
    Thanks in advance for any assistance.

    I don't think we can push certs from windows server to iphones . Probably set up a webpage say a accessible from a different ssid  from which clients can download and install cert. ?

  • EAP-TLS with Radius Server configuration (1130AG)

    Hi All,
    Im currently tryign to get eap-tls user certificate based wireless authentication working. The mismatch of guides im trying to follow has me ocming up trumps with success so far, so heres hoping you guys can right me wrongs and put me on the right path again.
    My steps for radius:- (i think this part ive actually got ok)
    http://technet.microsoft.com/en-us/library/dd283091(v=ws.10).aspx
    Steps for the wirless profile on a win 7 client:- this has me confused all over the place
    http://technet.microsoft.com/en-us/library/dd759246.aspx
    My 1130 Config:-
    [code]
    Current configuration : 3805 bytes
    ! Last configuration change at 11:57:56 UTC Fri Jan 25 2013 by apd
    ! NVRAM config last updated at 14:43:51 UTC Fri Jan 25 2013 by apd
    version 12.4
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname WAP1
    aaa new-model
    aaa group server radius RAD_EAP
    server 10.1.1.29 auth-port 1812 acct-port 1813
    aaa authentication login default local
    aaa authentication login EAP_LOGIN group RAD_EAP
    aaa authorization exec default local
    aaa authorization network default local
    aaa session-id common
    ip domain name ************
    dot11 syslog
    dot11 ssid TEST
       authentication open eap EAP_LOGIN
       authentication network-eap EAP_LOGIN
       guest-mode
    crypto pki trustpoint TP-self-signed-1829403336
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1829403336
    revocation-check none
    rsakeypair TP-self-signed-1829403336
      quit
    username ***************
    ip ssh version 2
    bridge irb
    interface Dot11Radio0
    no ip address
    no ip route-cache
    ssid TEST
    station-role root
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface Dot11Radio1
    no ip address
    no ip route-cache
    ssid TEST
    no dfs band block
    channel dfs
    station-role root
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface FastEthernet0
    no ip address
    no ip route-cache
    duplex auto
    speed auto
    bridge-group 1
    no bridge-group 1 source-learning
    bridge-group 1 spanning-disabled
    interface BVI1
    ip address 10.1.2.245 255.255.255.0
    ip helper-address 10.1.1.27
    no ip route-cache
    no ip http server
    ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    radius-server host 10.1.1.29 auth-port 1812 acct-port 1813 key **************
    radius-server key ************
    bridge 1 route ip
    line con 0
    logging synchronous
    transport preferred ssh
    line vty 0 4
    logging synchronous
    transport input ssh
    sntp server 130.88.212.143
    end
    [/code]
    and my current debug
    [code]
    Jan 25 12:00:56.703: dot11_auth_send_msg:  sending data to requestor status 1
    Jan 25 12:00:56.703: dot11_auth_send_msg: Sending EAPOL to requestor
    Jan 25 12:00:56.703: dot1x-registry:registry:dot1x_ether_macaddr called
    Jan 25 12:00:56.703: dot11_auth_dot1x_send_id_req_to_client: Client 74de.2b81.56c4 timer started for 30 seconds
    WAP1#
    Jan 25 12:01:26.698: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,TIMEOUT) for 74de.2b81.56c4
    Jan 25 12:01:26.698: dot11_auth_dot1x_send_client_fail: Authentication failed for 74de.2b81.56c4
    Jan 25 12:01:26.698: dot11_auth_send_msg:  sending data to requestor status 0
    Jan 25 12:01:26.698: dot11_auth_send_msg: client FAILED to authenticate 74de.2b81.56c4, node_type 64 for application 0x1
    Jan 25 12:01:26.699: dot11_auth_delete_client_entry: 74de.2b81.56c4 is deleted for application 0x1
    Jan
    WAP1#25 12:01:26.699: %DOT11-7-AUTH_FAILED: Station 74de.2b81.56c4 Authentication failed
    Jan 25 12:01:26.699: dot11_aaa_upd_accounting: Updating attributes for user: 74de.2b81.56c4
    Jan 25 12:01:26.699: dot11_aaa_upd_accounting: Updating attributes for user: 74de.2b81.56c4
    Jan 25 12:01:26.699: dot11_auth_client_abort: Received abort request for client 74de.2b81.56c4
    Jan 25 12:01:26.699: dot11_auth_client_abort: No client entry to abort: 74de.2b81.56c4 for application 0x1
    Jan 25 12:01:27.580: AAA/BIND(000000
    WAP1#12): Bind i/f
    Jan 25 12:01:27.580: dot11_auth_add_client_entry: Create new client 74de.2b81.56c4 for application 0x1
    Jan 25 12:01:27.580: dot11_auth_initialize_client: 74de.2b81.56c4 is added to the client list for application 0x1
    Jan 25 12:01:27.581: dot11_auth_add_client_entry: req->auth_type 0
    Jan 25 12:01:27.581: dot11_auth_add_client_entry: auth_methods_inprocess: 2
    Jan 25 12:01:27.581: dot11_auth_add_client_entry: eap list name: EAP_LOGIN
    Jan 25 12:01:27.581: dot11_run_auth_methods: Start aut
    WAP1#h method EAP or LEAP
    Jan 25 12:01:27.581: dot11_auth_dot1x_start: in the dot11_auth_dot1x_start
    Jan 25 12:01:27.581: dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 74de.2b81.56c4
    Jan 25 12:01:27.581: EAPOL pak dump tx
    Jan 25 12:01:27.581: EAPOL Version: 0x1  type: 0x0  length: 0x002B
    Jan 25 12:01:27.581: EAP code: 0x1  id: 0x1  length: 0x002B type: 0x1
    01801670:                   0100002B 0101002B          ...+...+
    01801680: 01006E65 74776F72 6B69643D 54455354  ..networkid=TEST
    WAP1#
    01801690: 2C6E6173 69643D41 50445741 50312C70  ,nasid=WAP1,p
    018016A0: 6F727469 643D30                      ortid=0
    Jan 25 12:01:27.582: dot11_auth_send_msg:  sending data to requestor status 1
    Jan 25 12:01:27.582: dot11_auth_send_msg: Sending EAPOL to requestor
    Jan 25 12:01:27.582: dot1x-registry:registry:dot1x_ether_macaddr called
    Jan 25 12:01:27.583: dot11_auth_dot1x_send_id_req_to_client: Client 74de.2b81.56c4 timer started for 30 seconds
    WAP1#
    [/code]
    Can anyone point me in the right direction with this?
    i also dont like it that you can attempt to join the network first before failing
    can i have user cert based + psk? and then apply it all by GPO
    Thanks for any help

    ok ive ammdened the wireless profile as suggested
    i already have the root ca and a user certificate installed with matching usernames
    I had already added the radius device to the NPS server and matched the keys to the AP
    now heres the debug im getting, when i check the NPS server, still doesnt look like its getting any requests at all :|
    Jan 29 11:53:13.501: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,TIMEOUT) for 74de.2b81.56c4
    Jan 29 11:53:13.501: dot11_auth_dot1x_send_client_fail: Authentication failed for 74de.2b81.56c4
    Jan 29 11:53:13.501: dot11_auth_send_msg:  sending data to requestor status 0
    Jan 29 11:53:13.501: dot11_auth_send_msg: client FAILED to authenticate 74de.2b81.56c4, node_type 64 for application 0x1
    Jan 29 11:53:13.501: dot11_auth_delete_client_entry: 74de.2b81.56c4 is deleted for application 0x1
    Jan
    WAP1#29 11:53:13.501: dot11_mgr_disp_callback: Received message from Local Authenticator
    Jan 29 11:53:13.501: dot11_mgr_disp_callback: Received FAIL from Local Authenticator
    Jan 29 11:53:13.501: dot11_mgr_sm_run_machine: Executing Action(BRIDGE,AUTHENTICATOR_FAIL) for 74de.2b81.56c4
    Jan 29 11:53:13.502: dot11_mgr_sm_send_client_fail: Authentication failed for 74de.2b81.56c4
    Jan 29 11:53:13.502: %DOT11-7-AUTH_FAILED: Station 74de.2b81.56c4 Authentication failed
    Jan 29 11:53:13.502: dot11_mgr_disp_auth_abort
    WAP1#: Sending abort request for client 74de.2b81.56c4 to local Authenticator
    Jan 29 11:53:13.502: dot11_auth_client_abort: Received abort request for client 74de.2b81.56c4
    Jan 29 11:53:13.502: dot11_auth_client_abort: No client entry to abort: 74de.2b81.56c4 for application 0x1
    Jan 29 11:53:14.619: AAA/BIND(00000019): Bind i/f
    Jan 29 11:53:14.619: dot11_mgr_disp_auth_request: Send auth request for client 74de.2b81.56c4 to local Authenticator
    Jan 29 11:53:14.619: dot11_auth_add_client_entry: Create new c
    WAP1#lient 74de.2b81.56c4 for application 0x1
    Jan 29 11:53:14.620: dot11_auth_initialize_client: 74de.2b81.56c4 is added to the client list for application 0x1
    Jan 29 11:53:14.620: dot11_auth_add_client_entry: req->auth_type 0
    Jan 29 11:53:14.620: dot11_auth_add_client_entry: auth_methods_inprocess: 2
    Jan 29 11:53:14.620: dot11_auth_add_client_entry: eap list name: EAP_LOGIN
    Jan 29 11:53:14.620: dot11_run_auth_methods: Start auth method EAP or LEAP
    Jan 29 11:53:14.620: dot11_auth_dot1x_start: in the dot11
    WAP1#_auth_dot1x_start
    Jan 29 11:53:14.620: dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 74de.2b81.56c4
    Jan 29 11:53:14.620: EAPOL pak dump tx
    Jan 29 11:53:14.621: EAPOL Version: 0x1  type: 0x0  length: 0x002B
    Jan 29 11:53:14.621: EAP code: 0x1  id: 0x1  length: 0x002B type: 0x1
    01808560: 0100002B 0101002B 01006E65 74776F72  ...+...+..networ
    01808570: 6B69643D 54455354 2C6E6173 69643D41  kid=TEST,nasid=A
    01808580: 50445741 50312C70 6F727469 643D30    WAP1,portid=0
    Jan 29 11:53
    WAP1#:14.621: dot11_auth_send_msg:  sending data to requestor status 1
    Jan 29 11:53:14.621: dot11_auth_send_msg: Sending EAPOL to requestor
    Jan 29 11:53:14.622: dot11_mgr_disp_callback: Received message from Local Authenticator
    Jan 29 11:53:14.622: dot11_mgr_disp_callback: Received DOT11_AAA_EAP from Local Authenticator
    Jan 29 11:53:14.622: dot11_mgr_sm_run_machine: Executing Action(BRIDGE,AUTHENTICATOR_REPLY) for 74de.2b81.56c4
    Jan 29 11:53:14.622: dot11_mgr_sm_send_response_to_client: Forwarding Authenti
    WAP1#cator message to client 74de.2b81.56c4
    Jan 29 11:53:14.622: EAPOL pak dump tx
    Jan 29 11:53:14.622: EAPOL Version: 0x1  type: 0x0  length: 0x002B
    Jan 29 11:53:14.622: EAP code: 0x1  id: 0x1  length: 0x002B type: 0x1
    01808690:                   0100002B 0101002B          ...+...+
    018086A0: 01006E65 74776F72 6B69643D 54455354  ..networkid=TEST
    018086B0: 2C6E6173 69643D41 50445741 50312C70  ,nasid=WAP1,p
    018086C0: 6F727469 643D30                      ortid=0
    Jan 29 11:53:14.623: dot1x-regi

  • EAP-TLS with windows machine

    I had configured everything for certificate authentication EAP-TLS in Windows 2003 AD with enterprise CA. After logging a machine to domain I receive a certificate for computer, then setup XP SP3 to reauthenticate perion 120 sec (by Microsoft KB). I try two different machines with XP to use EAP-TLS authentication, but reason is not toward success.
    I use "authentication open" on switch therefore machines could communicate with whole network. Nothing appars in Failed Attempts.csv of Passed Attempts.csv (of couse).
    Just list of RDS.log appears some activity ended with
    NAS: 172.24.34.62:27910:25 Cleaning lookup entry. AND reapeted
    If I change an authentication type to PEAP, and I had not it configured on ACS, than failed attempt log issue is arrised: EAP_PEAP Type not configured.
    Is it necessary to use http://support.microsoft.com/kb/957931 on windows XP to success machine authentication?
    Please let attentions to Attachments and let me know
    what could be a problem of my unsuccessness of use EAP-TLS.
    configuration of interface which I use for testing:
    interface GigabitEthernet0/42
    description Test 802.1X klient - Filip
    switchport access vlan 34
    switchport mode access
    switchport voice vlan 31
    authentication host-mode multi-domain
    authentication open
    authentication port-control auto
    authentication periodic
    authentication violation protect
    dot1x pae authenticator
    dot1x timeout tx-period 10
    spanning-tree portfast
    end

    Hi Filip,
    Just noticed your post...
    In order to use EAP-TLS you should ensure that you have the complete certs chain. I've noticed that EAP-TLS and service pack 3 has some compatibility issue so please try authenticating with a windows XP sp2 machine.
    Microsoft has done some changes in SP 3 for wired 802.1x
    Changes to the 802.1X-based wired network connection settings in Windows XP
    Service Pack 3
    http://support.microsoft.com/kb/949984/
    In Windows XP Service Pack 2 (SP2), both the wired and wireless connections are handled by the Wireless Zero Config (WZCSVC) service. Additionally, this service is always running. In Windows XP SP3, this WZCSVC functionality is divided into the following separate services as part of Network Access Protection (NAP) integration:
    * The WZCSVC service
    * The Wired AutoConfig service (DOT3SVC)
    As we are using wired authentication, I would suggest you to check whether wired autoconfig service is running or not.You can check by going to Manually start the Wired AutoConfig service
    If you are an end-user who has already installed Windows XP SP3, follow
    these steps:
    1. Click Start, and then click Run.
    2. In the Open box, type services.msc, and then press ENTER.
    3. Locate the Wired AutoConfig service, right-click it, and then click
    Start
    Since, we are not getting any hits on the ACS for EAP-TLS, it's clearly indicates that supplicant is not sending access-request...
    CERTIFICATE REQUIREMENT IN EAP-TLS:
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a008009256b.shtml#wp39121
    ACS CONFIGURATION:
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a008009256b.shtml#wp39247
    MICROSOFT XP CLIENT CONFIGURATION:
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a008009256b.shtml#wp39392
    As far as peap is concerned where we are getting EAP_TYPE not configured. Here you need to enable peap-mschapv2 under the on the ACS >system configuration > global authentication setup and check the PEAP and EAP-TLS.
    Also make sure that your logging is set to full > Go to system configuration > services control > check the radio button for FULL > click on Restart.
    Also, let me know the full ACS version and platform.
    HTH
    JK
    Do rate helpful posts-

  • EAP-TLS wi-fi net for PC and iPhone

    Hi, everyone! I'm rather confused and hoped that someone could help me to make the situation clear.
    We wan't to establish a wi-fi net with WPA-2 Enterprise and EAP-TLS for computers  and mobile devices (iPhones, Nokia Symbian, Android devices).
    The connection is organised in such way: client---AP 1240---ACS 4.2---AD(server 2003)
    I have 2 testing computers with wi-fi adapters: one is connected to the  domain (has a wire connection), another has a local account, and an  iPhone. I customized the settings on these computers,iphone, AP and ACS. 
    We have our own CA, 2-tier PKI infrastructure. I have installed the ACS and client's certificates on all the devices (by the way, they are 2048 bit size of).
    I manage to connect from a computer included in the domain but the second PC and iPhone refuse to connect,respectively:
    "EAP-TLS or PEAP authentication failed during SSL handshake".
    "EAP-TLS or PEAP authentication failed due to unknown CA certificate during SSL handshake"
    Also I saw in logs that "Machine authentication is not permitted" so the domain PC authenticates through user account and is mapped to a special group.
    So I think the reason is that only domain  devices are allowed to join the net. How can I change this thing?
    Another variant is that I issue the certificates first to wired domain computers and then export  them to non-connected to domain devices so they have inappropriate credentials.
    Please, if you have any thoughts about the reason of the problem, share them. I would appreciate any help.

    The ATV is strictly a wifi client, it doesn't function as a router or access point. You can connect it to your router either by wifi or Ethernet cable. Your pc doesn't need a wifi card to work with an ATV as long as they're both on the same network.

  • EAP Chaining with Cisco ACS 5.x and the Cisco Anyconnect NAM Client

    Hi Guys,
    Whilst I’m well aware of the limitations of the built in the windows Wireless 802.1x supplicant. Is there a way, using the NAM client to authenticate both a computer and a user simultaneously, when used for authentication to wireless networks?
    As has been posted many times before on this forum, this isn’t possible due to windows not authenticating with the 'computer account' whilst the user is logged in, but with the NAM client it seems possible to do both user and computer authentication based on the options it gives you with EAP-Fast and 'EAP Chaining'.
    Can anyone validate this is possible? I have the design guide for exactly this for Cisco ISE but i need it to work on ACS (5.x).
    Thanks in advance.
    SteveH

    Bobby, I ran into the same issue with the "15015 Could not find ID Store" issue.  It turned out to be an issue with communication between the ACS and AD.  It looked like AD was connected successfully, but until I rebooted ACS, I kept getting the same error.  It was like it couldn't see the AD security groups even though it could scan the AD tree successfully.
    So, try rebooting ACS if you haven't already and see if that resolves the error.

  • EAP-TLS with machine certificate

    Hello all,
    I'm looking for a solution to authenticate both machine and wireless users. I've been finding out solutions like EAP-TLS using the machine certificate to stablished the tunnel and authenticating user credentials (LDAP store) over this tunnel. Now i want to know if is possible to use this configuration using an ACS Radius servers and what SOs are supported to do this without external supplicants (Windows XP, Windows 7, Windows 8, iOs, Android...).
    Thanks a lot.
    Best regards.

    Hi Alfonso, 
    Certificate Retrieval for EAP-TLS Authentication
    ACS 5.4 supports certificate retrieval for user or machine authentication that uses EAP-TLS protocol. The user or machine record on AD includes a certificate attribute of binary data type. This can contain one or more certificates. ACS refers to this attribute as userCertificate and does not allow you to configure any other name for this attribute. 
    ACS retrieves this certificate for verifying the identity of the user or machine. The certificate authentication profile determines the field (SAN, CN, SSN, SAN-Email, SAN-DNS, or SAN-other name) to be used for retrieving the certificates. 
    After ACS retrieves the certificate, it performs a binary comparison of this certificate with the client certificate. When multiple certificates are received, ACS compares the certificates to check if one of them match. When a match is found, ACS grants the user or machine access to the network. 
    Configuring CA Certificates
    When a client uses the EAP-TLS protocol to authenticate itself against the ACS server, it sends a client certificate that identifies itself to the server. To verify the identity and correctness of the client certificate, the server must have a preinstalled certificate from the Certificate Authority (CA) that has digitally signed the client certificate. 
    If ACS does not trust the client's CA certificate, then you must install in ACS the entire chain of successively signed CA certificates, all the way to the top-level CA certificate that ACS trusts. CA certificates are also known as trust certificates. 
    You use the CA options to install digital certificates to support EAP-TLS authentication. ACS uses the X.509 v3 digital certificate standard. ACS also supports manual certificate acquisition and provides the means for managing a certificate trust list (CTL) and certificate revocation lists (CRLs). 
    Digital certificates do not require the sharing of secrets or stored database credentials. They can be scaled and trusted over large deployments. If managed properly, they can serve as a method of authentication that is stronger and more secure than shared secret systems. 
    Mutual trust requires that ACS have an installed certificate that can be verified by end-user clients. This server certificate may be issued from a CA or, if you choose, may be a self-signed certificate
    Also check the below link,  
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/users_id_stores.html#wp1170404

  • 802.1x EAP-TLS with NPS/W2008 - Authentication result 'timeout'

    Hello
    [Env on my lab investigation]
    supplicant - W7 with cert
    authenticator - Catalyst 2960 with IOS 15.0(1)SE2 /newest/
    authentication server 2x - W2008/NPS like a RADIUS server
    [Config some part of authenticator]
    interface FastEthernet0/1
    switchport access vlan 34
    switchport mode access
    authentication event fail retry 1 action authorize vlan 47
    authentication event server dead action authorize vlan 35
    authentication event no-response action authorize vlan 47
    authentication event server alive action reinitialize
    authentication port-control auto
    dot1x pae authenticator
    dot1x timeout quiet-period 15
    dot1x timeout tx-period 15
    spanning-tree portfast
    [Symptoms]
    After reboot authenticator the supplican connected to FE0/1 finally put into the Guest VLAN 47 and before that I saw on the authenticators console Authentication result 'timeout', but when the switch is up and running the the same port authenticator FE0/1 the same supplicant W7 with cert now I connect to authenticator finally supplicant put into static VLAN 34.
    [Summary]
    The problem is the end station that are still connected to the supplicant port /use a EAP-TLS/ after the reboot supplicant! All of them will be put into the Guest VLAN instead of static VLAN 34!
    [The question]
    What is wrong and how to configure/tune and what authenticator or authentication server to prevent after the reboot to observe a authentication timeouts?
    Of course the supplicant after 20 minutes /next EAPOL start farmet put into VLAN 34 .
    [Logs]
    During this I observed the wireshark supplicant and authenticator console and NPS wireshark, below:
    1. supplicant and authenticator orderflow at wireshar:
    - supplicant EAPOL Start
    - authenticator EAP Request Identity
    - supplicat  Response Identity, 3 times
    - supplicant EAPOL Start
    - authenticator EAP Failure
    - authenticator EAP Request Identity x2
    - supplicat  Response Identity x2
    and again, more detail about flow from whireshar chart at the end
    2. authenticator console saw like this:
    *Mar  1 00:02:51.563: %DOT1X-5-FAIL: Authentication failed for client (5c26.0a12.cf80) on Interface Fa0/1 AuditSessionID 0A0E2E96000000030000EAF2
    *Mar  1 00:02:51.563: %AUTHMGR-7-RESULT: Authentication result 'timeout' from 'dot1x' for client (5c26.0a12.cf80) on Interface Fa0/1 AuditSessionID 0A0E2E96000000030000EAF2
    *Mar  1 00:02:51.563: %DOT1X-5-RESULT_OVERRIDE: Authentication result overridden for client (5c26.0a12.cf80) on Interface Fa0/1 AuditSessionID 0A0E2E96000000030000EAF2
    krasw8021x>
    *Mar  1 00:03:52.876: %DOT1X-5-FAIL: Authentication failed for client (5c26.0a12.cf80) on Interface Fa0/1 AuditSessionID 0A0E2E96000000030000EAF2
    *Mar  1 00:03:52.876: %AUTHMGR-7-RESULT: Authentication result 'timeout' from 'dot1x' for client (5c26.0a12.cf80) on Interface Fa0/1 AuditSessionID 0A0E2E96000000030000EAF2
    *Mar  1 00:03:52.876: %DOT1X-5-RESULT_OVERRIDE: Authentication result overridden for client (5c26.0a12.cf80) on Interface Fa0/1 AuditSessionID 0A0E2E96000000030000EAF2
    and finaly
    *Mar  1 00:05:00.286: %AUTHMGR-5-VLANASSIGN: VLAN 47 assigned to Interface Fa0/1 AuditSessionID 0A0E2E96000000040003C914
    *Mar  1 00:05:01.167: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (Unknown MAC) on Interface Fa0/1 AuditSessionID 0A0E2E96000000040003C914
    *Mar  1 00:05:01.302: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
    3. Authentication server:
    - NPS doesn'e recived any RADIUS Access-Request/Response.
    [supplicant EAPOL flow chart, source wireshark]
    |Time     | Cisco_f9:98:81                        | Dell_12:cf:80                         |
    |         |                   | Nearest           |                  
    |0,041    |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |0,045    |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |0,051    |                   |         Start     |                   |EAPOL: Start
    |         |                   |(0)      <------------------  (0)      |
    |0,065    |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |0,075    |                   |         Response, Identity            |EAP: Response, Identity [RFC3748]
    |         |                   |(0)      <------------------  (0)      |
    |0,075    |                   |         Response, Identity            |EAP: Response, Identity [RFC3748]
    |         |                   |(0)      <------------------  (0)      |
    |18,063   |                   |         Start     |                   |EAPOL: Start
    |         |                   |(0)      <------------------  (0)      |
    |18,065   |         Failure   |                   |                   |EAP: Failure
    |         |(0)      ------------------>  (0)      |                   |
    |18,268   |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |18,303   |                   |         Response, Identity            |EAP: Response, Identity [RFC3748]
    |         |                   |(0)      <------------------  (0)      |
    |18,307   |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |18,307   |                   |         Response, Identity            |EAP: Response, Identity [RFC3748]
    |         |                   |(0)      <------------------  (0)      |
    |37,073   |         Request, EAP-TLS [R           |                   |EAP: Request, EAP-TLS [RFC5216] [Aboba]
    |         |(0)      ------------------>  (0)      |                   |
    |67,941   |         Request, EAP-TLS [R           |                   |EAP: Request, EAP-TLS [RFC5216] [Aboba]
    |         |(0)      ------------------>  (0)      |                   |
    |98,805   |         Request, EAP-TLS [R           |                   |EAP: Request, EAP-TLS [RFC5216] [Aboba]
    |         |(0)      ------------------>  (0)      |                   |
    |129,684  |         Failure   |                   |                   |EAP: Failure
    |         |(0)      ------------------>  (0)      |                   |
    |144,697  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |160,125  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |175,561  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |190,996  |         Failure   |                   |                   |EAP: Failure
    |         |(0)      ------------------>  (0)      |                   |
    |206,002  |         Failure   |                   |                   |EAP: Failure
    |         |(0)      ------------------>  (0)      |                   |
    |206,204  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |212,103  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |227,535  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    |242,970  |         Request, Identity [           |                   |EAP: Request, Identity [RFC3748]
    |         |(0)      ------------------>  (0)      |                   |
    /regards Piter 

    Hi,
    Did you ever try to configure re-authentication?
    Is the client is up and running if you connect it to the switch?
    Sent from Cisco Technical Support iPad App

Maybe you are looking for