Enterprise Wireless 802.1x WEP EAP-PEAP Support with ACS Certificate

Hi,
Do BB10 support this type of connection?. 
Thanks.

Hi,
Do BB10 support this type of connection?. 
Thanks.

Similar Messages

  • PEAP support with WDS

    Hi,
    I understand that the WDS can provide fast roaming by caching the authenticated user credentials when using LEAP. But what if I use PEAP with certificates for both server and client authentication? I suppose the WDS won't be able to cache the certificates. Then, how doesn't it work? Or is PEAP supported by WDS? Thanks.

    WDS is a centralized method of security that can be used with any EAP method for the authentication of your clients. Refer
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c951f.shtml#backinfo

  • EAP-TTLS support in ACS v4?

    Hi,
    Does anyone know if there are any support for EAP-TTLS in the upcoming release 4 of ACS? We have invested heavilly in ACS but now we really need EAP-TTLS support (both auth and proxing).
    Cheers
    Anders Nilsson
    UMDAC

    Hi,
    EAP-TTLS along with PEAP is one of the prefered EAP:s used for EduRoam (www.eduroam.org) which is gaining more and more acceptance around the educational community. I'm really suprized that Cisco isn't up to date on whats going on around the many Universities. I estimate the only in Europe there will be more than 1000 universities using Radius servers and proxies. Australia is online and soon the US will join in. Here in Sweden (SUNET) we are now locking at but ACS product but if EAP-TTLS and Radius Proxing of all the protocols (PEAP, EAP-TLS, EAP-TTLS) are not supported we will have to look elseware (Freeraduis or Radiator). :(
    We here in Sweden strongly suggest that Cisco implements EAP-TTLS and better Raduis Proxy functionallity. (Version 4.1 maybe? ;) )
    Best Regards
    Anders Nilsson
    UMDAC

  • EAP-TLS authentication with ACS 5.2

    Hi all,
    I have question on EAP-TLS with ACS 5.2.
    If I would like to implement the EAP-TLS with Microsoft CA, how will the machine and user authentication take place?
    Understand that the cert are required on both client and server end, but is this certificate ties to the machine or ties to individual user?
    If ties to user, and I have a shared PC which login by few users, is that mean every user account will have their own certificates?
    And every individual user will have to manually get the cert from CA? is there any other method as my environment has more than 3000 PCs.
    And also if it ties to user, all user can get their cert from CA with their AD login name and password, if they bring in their own device and try to get the cert from CA, they will be able to successfully install the cert into their device right?
    Hope you guys can help on this. THanks.

    Yes, you can configure:
    machine authentication only
    user authentication only
    Machine and user authentication.
    Machine or user authentication
    So machine authentication only is quite common scenarion. Correct, as long as machine is a part of a domain, you will be authenticated via machine authentication.
    PEAP-based machine authentication uses PEAP (EAP-MS-CHAPv2) and the password for the computer established automatically when it was added to the Microsoft Windows domain. The computer sends its name as the username and the format is:
    host/computer.domain
    If the machine is a valid machine in the domain then during the boot process, once the HAL is loaded, the system begins loading device drivers to support the various hardware devices configured on the client in question. After loading the device drivers, the network interface is initialized. At this point, machine start getting ip address and once it done, the user may have access to most of the network.
    Regards,
    Jatin

  • PEAP Happening with out certificate

    How could peap authentication be successful with out server certificate on the client i mean its not installed or autoenrolled on the client which is an windows xp with sp2.
    I am using ACS appliance which runs 4.0 and has a self-signed certificate in it.
    i am believing no one could login to the network with out the certificate in the client either physically installed or auto enrolled but i couls able to login with out certificate.how could this be possible.

    For PEAP, the certificate is there for the client to validate that it is connecting to the right server; it is not there to support validating the client TO the server.
    Verifying the validity of the server prevents / reduces the chance that someone is executing something like a "Man-in-the-Middle" attack.
    If you are trying to verify the client to the server (server validates the client), then you need something like EAP-FAST or EAP-TLS ... EAP-TLS wold require a certificate on the client.
    Choosing an auth/auth scheme will depend on who/what you are trying to protect, and where you judge the higher risk is most likely to occur.
    In this case, the cert required by PEAP is there to protect the client against connecting to a malicious user who is acting as the authentic portal into a networking system (i.e., to steal credentials or information).
    Good Luck
    Scott

  • 802.1x and Windows Domain Controller with ACS

    Wow, I am having a tough time getting my ACS and the Domain controller to work with 802.1x PEAP. Can somebody explane to me how to set up the domain controller (Active directry) to get a PEAP cert? Some other questions. If I am using PEAP and 802.1x how does my computer get a cert. from the CA if the port is disabled by 802.1x? And How do I set up my domain controller to work with ACS to authenticate users. I have been beating my self to death to figure this out. Any help would be ausome. I am really stuck on trying to make this work.
    Thanks a ton in advance
    Justin

    I as a Cisco customer would like to see answers to our questions based on some real world experience or something you've noticed in a lab environment.
    By simply posting links is not very helpful. The reason most of us come to this site and post our questions, is because we already went to the Cisco website and found the explanation to be vague. In the future, please post answers to our question, intead of referring us to a link.
    Thank you,
    John...

  • Connecting iPads to an Enterprise Wireless 802.1x (EAP-TLS) Network Using Windows Server 2003 IAS

    Hi there,
    I am asked to deploy iPads on an 802.1x EAP-TLS WiFi network. The customer has a Windows Server 2003 IAS server providing RADIUS. There also is a Windows based CA infrastructure in place. This solution is in production and is already being used by other wireless devices. Could someone please highlight the configuration steps for the iPad deployment? The customer whishes to automate the initial deployment and the renewal of the certificates. I have a basic understanding of 802.1x, RADIUS, Certificates etc. in a Windows infrastructure but I am new to enterprise deployment of iPads. There is no MDM tool in place by the way...
    I did find a Microsoft article which I think describes what needs to be done: http://blogs.technet.com/b/pki/archive/2012/02/27/ndes-and-ipads.aspx. This article basically states the following steps:
    1. Create a placeholder computer account in Active Directory Domain Services (AD DS)
    2. Configure a Service Principal Name (SPN) for the new computer object.
    3. Enroll a computer certificate passing the FQDN of the placeholder computer object as a Subject Name, using Web Enrollment Pages or Certificates MMC snap-in directly from the computer (Skip step 4 if you are using the Certificates MMC snap-in)
    4. Export the certificate created for the non-domain joined machine and install it.
    5. Associate the newly created certificate to the placeholder AD DS domain computer account manually created through Name Mappings
    The article then elaborates on specific steps needed for the iPad because it treats all certificates as user certificates. Can someone confirm this behavior??
    Regards,
    Jeffrey

    Use VPP.  Select an MDM.  Read the google doc below.
    IT Resources -- ios & OS X -- This is a fantastic web page.  I like the education site over the business site.
    View documentation, video tutorials, and web pages to help IT professionals develop and deploy education solutions.
    http://www.apple.com/education/resources/information-technology.html
       business site is:
       http://www.apple.com/lae/ipad/business/resources/
    Excellent guide. See announcment post -- https://discussions.apple.com/thread/4256735?tstart=0
    https://docs.google.com/document/d/1SMBgyzONxcx6_FswgkW9XYLpA4oCt_2y1uw9ceMZ9F4/ edit?pli=1
    good tips for initial deployment:
    https://discussions.apple.com/message/18942350#18942350
    https://discussions.apple.com/thread/3804209?tstart=0

  • How to connect to AP with WPA2, EAP-PEAP, MSCHAPv2...

    I am trying to connect to the company network, but it always shows "PEAP authentication failed".
    There are only instructions for iPhone and PC.
    security : WPA2-Enterprise
    authority certificate : None
    Security Type : PEAP
    Inner Link Security : EAP-MSCHAPv2
    additionally MAC address filtering.
    The access point I set is as follows:
    network status: public
    wLAN network mode: infrastructure
    security: WPA/WPA2
    WPA2 only mode: off
    EAP plug-in setting: EAP-PEAP enable only
    personal certificate: not defined
    authority certificate: not defined
    user name: user-defined   BLANK
    realm in use: user-defined   BLANK
    allow PEAPv0
    MSCHAPv2
    user name: username
    password: mypassword
    We have domain, but there are no command about domain in iPhone guide. 
    Is there anything wrong of my setting?

    WPA2-Enterprise is not supported on your device.
    ‡Thank you for hitting the Blue/Green Star button‡
    N8-00 RM 596 V:111.030.0609; E71-1(05) RM 346 V: 500.21.009

  • Nokia Belle - EAP-PEAP authentication without Cert...

    Its time for my half yearly bickering about the still non-support for EAP-PEAP authentication without server Certificates on Symbian Phone.
    Here is my last thread begging for help from Nokia when Anna was released.
    /t5/Software-Updates/EAP-PEAP-Authentication-without-Certificate-Is-it-fixed-in/td-p/1072133
    My question remain the same.Does the new Nokia Belle support EAP-PEAP authentication without the requirement that a server certificate be present.
    I have been living a life of ridicule and becomes an object of jokes and punchlines in office when it comes to the Phone that I carry. Lot of people now don't even know that there is company called Nokia. And when I tell them about it that say "Are you the guy carrying the phone that does not connect to our corporate network?".
    If you read that earlier thread you know that none of the exotic workaround that some have been able to do, does not work with my office as our network administration has not installed any server certificate whatsoever on the access point.
    I am fed of hearing from Nokia techs that this is supposed to be the secure and right way of doing things. When every other device, every smartphone, tablet, laptop supports this way of connecting to a EAP-PEAP access point why does Nokia has to keep this stance?
    Nokia has kept everything open on the Nokia N8, it has everything that a anyone can ask for in a smartphone, so why is Nokia so adamant on this small matter of not requiring a server certificate?
    Now that the WP7 line of Lumia devices are in the market can someone tell me if the problem exists on those phones too. I wont be surprised if this restriction is still there.
    With Nokia going downhill so fast it does not help with this kind of attitude towards diehard Nokia followers.
    Can someone from Nokia tech say once and for all if I can ever expect this thing to be fixed?
    raman

    ramany wrote:
    What should be an appropriate title for this thread. There was an older thread for the same that i started six months back when Anna was released. So i this expecting something to happen with Belle.
    If nothing happens I will probably start a new one when future updates to Symbian in Clara. Donna, Emma, Florina, Georgia, Hanna, Isabelle, Jenna, Kate, Linda, Marie, Nancy, Olivia, Patty, Quinn, Rita, Sabina, Terry, Uma, Vega, Wyome, Xandra, Yetta and Zoe are released.
    I hope Symbian (Nokia) lasts that long, but the support of this comes in Belle.
    I see no jokes yet...common guys.isn't anyone subjected to jokes because of this.
    At least give me some so i can feed more to the one going around.
    Well, I believe the example of EAP-TTLS + PAP authentication isn't 'without certificates'... it does use certificates, but EAP-TTLS + PAP just doesn't happen to be a supported authentication method with recent Symbian phones.
    I'm not any sort of wireless authentication guru, but there's probably a better, more precise description of the authentication support (probably a few methods) that's currently missing in Symbian.
    And a couple more details for some wireless authentication methods... I believe Windows users typically have to grab a third-party 'securew2' utility to support some of the more robust (read better, more secure) authentication methods for some networks.
    I think one of the more valid arguments for EAP-TTLS + PAP in general, is that I believe it may be part of the 'Eduroam' standard, although MSCHAPv2 may also be substituted for PAP, IIRC... but again, I'm not a wireless authentication guru.
    In any case, if well-known, widely-implemented (or soon to be implemented, for good reason) authentication methods aren't supported in Symbian, it just makes Symbian just looks a bit ridiculous and irrelevant.
    Your previous thread was quite good, and it may make sense to keep bumping that thread for updates periodically. I noticed that someone mentioned an MSCHAPv2 scenario in that thread, but again... that's not actually helpful for resolving EAP-TTLS + PAP support, and I think that there's probably a concise way to describe the current 'missing authentication methods support' in Symbian.
    It continues to baffle me how Nokia seems to have such a quiet, secretive presence on these forums, when I think it would make much more sense to publicly acknowledge relevant threads/discussions, and make a statement about planned fixes, updates, etc... rather than just have people wonder if/when Nokia is paying any attention to the discussions here.

  • ACS 4.1 PEAP using public signed certificate (verisign)

    Hi,
    Could you give me some advice about the PEAP implementation with ACS server. I undestand that self-signed certificate should work well but I have this thoughts. The self signed certificate is valid for 1 year and after this period a new self-signed certificate has to be created. What should be the impact on the wireless users at this point? What I undestand is that the new certificate should be also imported to the clients so they can validate the server certificate. If that is correct (not sure though) this will bring huge amount of work when the certificate is expired and having hurderds of wireless clients.
    Is it possible (and what are the requirements of the certificate itself) to install any publicly signed certificate like Verisign's one to the ACS for the PEAP process? Will that ease the workload when the certificate has to be renewed? I  assume that any windows machine for example, has by default trusted root certificates - Verisign in its store and no further interaction should be needed on the client side.
    kind regards
    Boris

    hi there ..
    First we need to understand why a cert is importnat. A cert is used to create a tunnel that allows the wireless client to send their logon in a secure fashion. So if you could image a tunnel over wireless/wired between your client and the radius server.
    The idea of trusting the cert is SPECIFIC to the wireless client . You can choose to TRUST the cert or NOT. Totally client independent. Why this is important, suppose for a moment that someone comes into your place of business and broadcast from their AP your SSID. Your clients could attach to this AP. And suppose the run FREERADIUS on a small box. From this radius server this person sends a BOGUS cert. If you client isnt trusting the correct cert or not trusting ANY, your client will accept the bogus cert, build a TLS tunnel, and send their logon.
    Can you get a signed cert. Yes, most folks do as it eases deployment. Or if you have a PKI you can push your own cert.
    Also, note you can have your client really analyze the cert and only trust specific certs and cert common namesl exmaple ACS01-ABC.
    I hope this helps ..
    Please support the rating system if you find any of this helpful!

  • EAP-TLS and ISE 1.1 with AD certificates

    Hello,
    I am trying to configure EAP-TLS authentication with AD certificates.
    All ISE servers are joined to AD
    I have the root certificate from the CA to Activie Directory installed on the ISE servers
    I created the certificate authentication profile using the root certificate
    I have PEAP\EAP-TLS enabled as my allowed protocol
    I am getting the following error for authentication:
    "11507  Extracted EAP-Response/Identity
    12500  Prepared EAP-Request proposing EAP-TLS with challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12301  Extracted EAP-Response/NAK requesting to use PEAP instead
    12300  Prepared EAP-Request proposing PEAP with challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12302  Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated
    12318  Successfully negotiated PEAP version 0
    12800  Extracted first TLS record; TLS handshake started
    12805  Extracted TLS ClientHello message
    12814  Prepared TLS Alert message
    12817  TLS handshake failed
    12309  PEAP handshake failed"
    I have self-signed certificates on the ISE servers – do they need to be signed by the same CA as the client?
    Any other issues I am missing?
    Thanks,
    Michael Wynston
    Senior Solutions Architect
    CCIE# 5449
    Email: [email protected]
    Phone: (212)401-5059
    Cell: (908)413-5813
    AOL IM: cw2kman
    E-Plus
    http://www.eplus.com

    Please review the below link which might be helpful :
    http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_60_byod_certificates.pdf
    http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_man_id_stores.pdf

  • IOS version that support 2048 bits certificate

    Hello,
    I need to update a 2504  Wireless Controller to a version that supports 2048 bits certificates.
    I´m checking release notes for release 7.4.110.0 and I don´t see any information about a limitation in certification size (2048 bytes in my case).
    Do you know any restriction about the certificate size in this or another version?
    Thanks and Regards.
    Iván.

    2048 bit is supported on the WLC. I use it for WebAuth and 3rd party certificates as these vendors only issue 2048 these days.
    Sent from Cisco Technical Support iPhone App

  • WPA2-Enterprise + EAP (PEAP) and 802.1x to authenticate to RADIUS server NPS

    I need to connect my iPhone and my iPad to the corporate wireless network using WPA2-Enterprise and 802.1x to authenticate against a RADIUS server with my corporate user. What is the procedure to configure the clients? Certificates is not necessary on the client. Radius server is a NPS of Microsoft and the WLC is a 5508 of Cisco.
    thanks !!!

    WPA and WPA2 are all actually interim protocols that are used until the standardization of IEEE 802.11i standard. Wi-fi appliance decided that ratification and standardization of 802.11i standards will take more time. So, they came up with WPA.
    Now, WPA2 is advanced version of WPA. WPA2 uses AES as encryption algorithm. Whereas, WPA use TKIP as encryption mode which in turn uses RC4 encryption algorithm.
    WPA and WPA2 are actually are of 2 types respectively.
    WPA/WPA2-PSK - This is mainly for small offices. This uses Pre-Shared Key for authentication.
    WPA/WPA2 -Enterprise - This uses a RADIUS Server for authentication. This is an extension to 802.1x authentication. But this uses stronger encryption scheme(WPA uses RC4 and WPA2 uses AES).
    Any authentication mechanism that involves a separation authentication server for authentication like ACS server is called 802.1x authentication.
    EAP stands for Extensible Authentication Protocol. It refers to the type or method of 802.1x Authentication by the RADIUS/Tacacs server. A RADIUS server can authenticate a wireless client with various EAP methods.
    LEAP is one type of EAP. It uses username and password for authenticating wireless clients. LEAP is cisco proprietory.
    There are also EAP types which uses other user credentials like Certificates, SIM etc for authentcation.
    The following document might clarify your doubts.
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_q_and_a_item09186a00805e8297.shtml

  • [SOLVED] Wireless 802.1x PEAP Windows 7 and Windows 2012 NPS and CA

    Hello,
    We are in progress of migrating our RADIUS (Windows 2003 R2) and Certificate (Windows 2003 R2) servers to 2012 (R2). This went fine, no problems. After that we have changed
    our Wireless controller a Cisco 5508. We have change our certificate from a 1024bits to a 2048bits certificate.
    We tested the other certificate functions and that went fine too.
    But we experience a problem with wireless 802.1x in combination with Windows 7 machines. We have Windows 8 and 8.1 machines that do not experience this problem and wireless 802.1x?
    We recreated the wireless policy but also no success.
    We have seen this problem before, with a customer who had a Windows 2008 R2 certificate server and Windows XP machines with wireless 802.1x . Exact the same problem. After
    decommissioning the Windows 2008 R2 certificate server and changed it to a Windows 2003 R2 certificate server, there where no problems any more.
    It looks like that older versions of Windows do not work with newer certificate servers?
    Do we miss something? Can someone confirm this.
    We already looked for these forum posts, but with no success
    http://social.technet.microsoft.com/Forums/windows/en-US/796d447f-518c-4ccb-81ff-921ee561d742/win2k8r2-peapnps-with-cisco-wireless-controller-problem?forum=winserverNIS
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/76644dcc-911d-451e-b7f1-39269db43ac7/nps-event-6273-reason-code-16
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/d543fe75-0cf9-49e7-bbfa-dd0df219cfe5/the-radius-request-did-not-match-any-configured-connection-request-policy-crp
    Network Policy Server denied access to a user.
    Contact the Network Policy Server administrator for more information.
    User:
    Security ID:                            
    domainname\NB80W7$
    Account Name:          
    host/NB80W7.domainname.local
    Account Domain:                               
    domainname
    Fully Qualified Account Name: domainname\NB80W7$
    Client Machine:
    Security ID:                            
    NULL SID
    Account Name:                                  
    Fully Qualified Account Name: -
    OS-Version:                            
    Called Station Identifier:                    
    08-d0-9f-ec-96-60:domain
    Calling Station Identifier:                   
    a0-88-b4-35-2e-08
    NAS:
    NAS IPv4 Address:                 
    192.168.2.6
    NAS IPv6 Address:                 
    NAS Identifier:                       
    WLC5500
    NAS Port-Type:                                  
    Wireless - IEEE 802.11
    NAS Port:                               
    1
    RADIUS Client:
    Client Friendly Name:             
    WLC5500
    Client IP Address:                              
    192.168.2.6
    Authentication Details:
    Connection Request Policy Name:     
    WLC5500
    Network Policy Name:            
    Authentication Provider:                    
    Windows
    Authentication Server:                       
    DC01.domainname.local
    Authentication Type:              
    EAP
    EAP Type:                               
    Account Session Identifier:               
    Logging Results:                                
    Accounting information was written to the local log file.
    Reason Code:                        
    48
    Reason:                                             
    The connection request did not match any configured network policy.
    Network Policy Server denied access to a user.
    Contact the Network Policy Server administrator for more information.
    User:
    Security ID:                            
    domainname\Username
    Account Name:                                  
    domainname\Username
    Account Domain:                               
    domainname
    Fully Qualified Account Name: domainname.local/ICT Specialisten/Username
    Client Machine:
    Security ID:                            
    NULL SID
    Account Name:                                  
    Fully Qualified Account Name: -
    OS-Version:                            
    Called Station Identifier:                    
    08-d0-9f-ec-96-60:domain
    Calling Station Identifier:                   
    a0-88-b4-35-2e-08
    NAS:
    NAS IPv4 Address:                 
    192.168.2.6
    NAS IPv6 Address:                 
    NAS Identifier:                       
    WLC5500
    NAS Port-Type:                                  
    Wireless - IEEE 802.11
    NAS Port:                               
    1
    RADIUS Client:
    Client Friendly Name:             
    WLC5500
    Client IP Address:                              
    192.168.2.6
    Authentication Details:
    Connection Request Policy Name:     
    WLC5500
    Network Policy Name:            
    WLC5500
    Authentication Provider:                    
    Windows
    Authentication Server:                       
    DC01.domainname.local
    Authentication Type:              
    PEAP
    EAP Type:                               
    Account Session Identifier:               
    Logging Results:                                
    Accounting information was written to the local log file.
    Reason Code:                        
    16
    Reason:                                             
    Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

    Hi,
    Please confirm the Win7 clients has renew the certificate and deleted the old certificate. And confirm you are not using the default server certificate template.
    More information:
    Renew a Certificate
    http://technet.microsoft.com/en-us/library/cc730605.aspx
    NPS Server Certificate: Configure the Template and Autoenrollment
    http://msdn.microsoft.com/en-us/library/cc754198.aspx
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • 802.1x EAP-PEAP over Ethernet need help !!!

    I am trying to get wired 802.1x EAP-PEAP to work and after spending about 8 hours
    troubleshooting this, I am not sure what else to do.  Need help.  Here
    is the scenario:
    - Cisco Catalyst 3350 switch running IOS versionc3550-ipservicesk9-mz.122-44.SE6.bin,
    - Steelbelted/JUniper Radius Server version 6.1.6 on a windows 2003 server
    with IP address of 129.174.2.7.  This device is connected to the same switch above.
    Firewall is OFF on the server, allow ALL,
    - Windows 2003 Enterprise Server supplicant with the latest Service pack and patches.  Again,
    Firewall is OFF on the server, allow ALL.  Juniper has verified the configuration settings
    on the Supplicant machine.  The supplicant has a static IP address of 129.174.2.15, same subnet
    as the radius server, I just want enable EAP-PEAP so that user is forced to authenticate before
    the port is activate to be "hot".
    - Juniper TAC has verified the configuration on the Steelbelted radius for eap-peap
    and that everything is looking fine,
    I have verified that the switch can communicate fine with the radius server.
    - Configuration on the switch for 802.1x:
    aaa new-model
    aaa authentication dot1x default group radius
    radius-server host 129.174.2.7 auth-port 1812 acct-port 1813 key 123456
    interface FastEthernet0/39
      description windows 2003 Supplicant
      switchport access vlan 401
      switchport mode access
      dot1x port-control auto
      no spanning-tree portfast (does not matter if this is enable or disable)
    lab-sw-1#
    .May 20 07:52:47.334: dot1x-packet:Received an EAP request packet from EAP for mac 0000.0000.0000
    .May 20 07:52:47.338: dot1x-packet:dot1x_mgr_send_eapol :EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1  data:
    .May 20 07:52:47.338: EAPOL pak dump Tx
    .May 20 07:52:47.338: EAPOL Version: 0x2  type: 0x0  length: 0x0005
    .May 20 07:52:47.338: EAP code: 0x1  id: 0x2  length: 0x0005 type: 0x1
    .May 20 07:52:47.338: dot1x-packet:dot1x_txReq: EAPOL packet sent out for the default authenticator
    lab-sw-1#
    lab-sw-1#sh dot1x interface f0/39
    Dot1x Info for FastEthernet0/39
    PAE                       = AUTHENTICATOR
    PortControl               = AUTO
    ControlDirection          = Both
    HostMode                  = SINGLE_HOST
    Violation Mode            = PROTECT
    ReAuthentication          = Disabled
    QuietPeriod               = 60
    ServerTimeout             = 30
    SuppTimeout               = 30
    ReAuthPeriod              = 3600 (Locally configured)
    ReAuthMax                 = 2
    MaxReq                    = 2
    TxPeriod                  = 30
    RateLimitPeriod           = 0
    lab-sw-1#
    I am at a complete lost here.  don't know what else to do.  Someone with expertise in this realm please
    help me how to make this work.
    Many thanks in advance,

    #1:  dot1x system-auth-control is already in the switch configuration
    #2:  Not sure if you're already aware, the minute I entered "dot1x port-control auto", the command "dot1x pae authenticator" automatically appears on the interface configuration
    The case is being worked on by Cisco TAC.  One of the issues is the windows 2003 server supplicant refuses to work.  Windows XP supplicant uses machine-authentication instead of user-authentication.  Cisco TAC is looking into this issue.

Maybe you are looking for