IOS 15.0.(1)SE2 802.1X configuration ignores VSA ?
Hi all,
i configured dot1x on a 3750X with version 15.0.(1)SE2 but have a problem with MDA:
My phone is authenticating successfully but is placed in the DATA domain instead of voice:
show authentication interface gi3/0/9
Client list:
Interface MAC Address Method Domain Status Session ID
Gi3/0/9 0080.9fab.d2f2 dot1x DATA Authz Success 000000000000361C1BA5BAF5
though the switch receives an VSA from the radius server (output from debug radius authentication):
Mar 9 18:10:28.976: RADIUS: Received from id 1645/106 10.0.0.4:1645, Access-Accept, len 240
Mar 9 18:10:28.976: RADIUS: authenticator 6B 87 86 16 99 E7 A3 06 - 6B 98 63 12 16 C8 9C 48
Mar 9 18:10:28.985: RADIUS: EAP-Message [79] 6
Mar 9 18:10:28.985: RADIUS: 03 07 00 04
Mar 9 18:10:28.985: RADIUS: Class [25] 46
Mar 9 18:10:28.985: RADIUS: 47 1B 05 65 00 00 01 37 00 01 02 00 0A 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 01 CC F8 92 38 D7 D3 4D 00 00 00 00 00 02 68 07 [ Ge7(8Mh]
Mar 9 18:10:28.985: RADIUS: Vendor, Cisco [26] 34
Mar 9 18:10:28.985: RADIUS: Cisco AVpair [1] 28 "device-traffic-class=voice"
Mar 9 18:10:28.985: RADIUS: Vendor, Microsoft [26] 58
Mar 9 18:10:28.985: RADIUS: MS-MPPE-Send-Key [16] 52 *
Mar 9 18:10:28.985: RADIUS: Vendor, Microsoft [26] 58
Mar 9 18:10:28.985: RADIUS: MS-MPPE-Recv-Key [17] 52 *
Mar 9 18:10:28.985: RADIUS: Message-Authenticato[80] 18
Mar 9 18:10:28.985: RADIUS: 82 9D F1 DB 64 0D 65 85 D2 C8 09 C7 10 9B C3 84 [ de]
Mar 9 18:10:29.001: RADIUS(00003686): Received from id 1645/106
Mar 9 18:10:29.001: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes
Mar 9 18:10:29.010: %DOT1X-5-SUCCESS: Authentication successful for client (0080.9fab.d2f2) on Interface Gi3/0/9 AuditSessionID 00000000000036091B977720
Mar 9 18:10:29.010: %AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (0080.9fab.d2f2) on Interface Gi3/0/9 AuditSessionID 00000000000036091B977720
Mar 9 18:10:29.446: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0080.9fab.d2f2) on Interface Gi3/0/9 AuditSessionID 00000000000036091B977720
Mar 9 18:10:29.454: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/9, changed state to up
and "radius-server vsa send authentication" is set
The switchport is configured in the following way:
interface GigabitEthernet3/0/9
switchport access vlan 115
switchport mode access
switchport nonegotiate
switchport voice vlan 113
authentication control-direction in
authentication event fail action authorize vlan 101
authentication event server dead action authorize vlan 100
authentication host-mode multi-domain
authentication order dot1x mab
authentication port-control auto
authentication violation replace
mls qos trust dscp
dot1x pae authenticator
storm-control broadcast level 10.00
storm-control action shutdown
spanning-tree portfast
spanning-tree bpduguard enable
ip dhcp snooping limit rate 20
Radius Server is MS W2K8 NPS.
Am i missing something or is it a bug in 15.0? I remeber it worked on 12.5something
Many thanks in advance for any hints!
Hi,
i am authenticating with dot1x, mab might be used some day for devices not supporting 802.1X.
Authentication works fine, i just wonder why the phone is placed into the DATA domain though the Radius Server returns a VSA "device-traffic-class=voice".
SWITCH#show authentication sessions interface gi3/0/9
Interface: GigabitEthernet3/0/9
MAC Address: 0080.9fab.d2f2
IP Address: Unknown
User-Name: ipphone
Status: Authz Success
Domain: DATA
Oper host mode: multi-domain
Oper control dir: in
Authorized By: Authentication Server
Vlan Group: N/A
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0000000000003AC232ED1550
Acct Session ID: 0x00003B3D
Handle: 0xB0000BD7
Runnable methods list:
Method State
dot1x Authc Success
SWITCH#show dot1x all details
Sysauthcontrol Enabled
Dot1x Protocol Version 3
Dot1x Info for GigabitEthernet3/0/9
PAE = AUTHENTICATOR
PortControl = AUTO
ControlDirection = In
HostMode = MULTI_DOMAIN
QuietPeriod = 60
ServerTimeout = 0
SuppTimeout = 30
ReAuthMax = 2
MaxReq = 2
TxPeriod = 30
Dot1x Authenticator Client List
EAP Method = (13)
Supplicant = 0080.9fab.d2f2
Session ID = 0000000000003AC232ED1550
Auth SM State = AUTHENTICATED
Auth BEND SM State = IDLE
Similar Messages
-
Cisco IP 7841 802.1x Configuration
Hello Team,
I am working with a customer that requires 802.1x configured on their environment. Based on my research so far, I believe this is only way to make this work. Have any of you done this differently? Any feedback is greatly appreciated.
CUCM
Run the CTL Client to install the e-token so the CUCM Publisher can run the CAPF service
Export the Cisco_Root_CA cert and upload it to a Radius server (preferably Cisco ACS if possible) so the phones can authenticate with
Assign the cert to each phone that requires 802.1x authentication
LAN Switches
Stage the LAN switches without 802.1x so phones can retrieve the cert and complete the authentication before turning on 802.1x
Questions
Can phones be authenticated with its own MIC and the PCs with their own? Do phones and PCs have to run the same cert?
Is the MAB the only method to bypass the 802.1x phone authentication so only the PC can be authenticate via 802.1x without requiring the phone to do the 802.1x authentication?
Thanks in advance for your feedback,
GersonJaime,
Thanks for pointing me to the correct area. By the way, do you have experience enabling 802.1x in CUCM? If so, do you think I am going in the right direction? Could you also provide some feedback on my questions?
Thanks,
Gerson -
802.1x configuration for 3500 switch and 2800 switc
Can anyone point me to a document on how to do a 3500 switch 802.1x configuration as well as a 2800 switch? How do you define the server auth-port? Thanks
Even tough this link is for CAT6k, it has some very useful screen-shots that will help you to successfully implement dot1x:
http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a00801d11a4.shtml
Regards
Farrukh -
Create New 802.1x Configuration?
Hi all,
Is there a command in the terminal to create a New 802.1x Configuration? I want to bypass the Internet Connect app so that I can automate this.
Thanks,
MattHello Sergio,
You can read this document:
http://www.microsoft.com/downloads/details.aspx?FamilyID=05951071-6b20-4cef-9939-47c397ffd3dd&displaylang=en
This works im my case except VLAN assignment. :(
But I'm occupied with this only for one day, so if I will success in VLAN assigment I will inform you.
Mladen -
Hi all
>I want to deploy 802.1x on my network.
1- Switches 3560 series with IOS 12.2(35)SE1
2- ACS 4.1
3- Windows Vista for Clients
>My questions are:
1- Is 802.1x support windows vista
2- How the client will be authenticated. Is there any software will be installed on the clients machine or the ACS
will pop up a window for the authentication. Also Where can I put the vlan in the ACS to be dropped on the port after authentication.
3- If I have VMPS and the ports are configured as dynamic (not access ), how can I solve this problem.
4- If the ACS radius server down. how the authenication will go. It can take from the switch local database.
5- what is the use of this command .....dot1x pae authenticator....
I appreciate any help. Please, I need this to be clear ASAP.
Thanks and Best Regards
amadyVista supports MD5-Challenge, Protected EAP (PEAP), Smartcard or certificate,Secured password (EAP-MSCHAPv2). Click Add/ Edit from the user setup page. When scroll down the page you will have an option for IETF attribute choose the Vlan there. Wireless users will not be affected by Switch VMPS. PAE refers to Port Access Entity. Defines the role of an interface (as a supplicant, as an authenticator, or as an authenticator and supplicant). In this case it happens to be Authenticator which is access point.
-
Cisco IOS 12.2 (50) SE2 Netflow support
hi to everyboby,
I'm trying to understand if the IOS version "Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version 12.2(50)SE2, RELEASE SOFTWARE (fc2)" supports the netflow feature.
I'm trying to configure the cisco WS-C3750G-12S for sending netflow datagrams but I don't find the commands like "ip flow-export".
This cisco official document says that the commands for enabling netflow are not supported.
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_35_se/configuration/guide/swuncli.html#wp1060525
Is It true or I'm missing something?
Thank you very much!
giorgioNo, Netflow is not support on the Cat2K and Cat3K switches. See http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd80406232.html .
-
HP Deskjet 3050A J611 series wireless WPA 802.1x configuring steps
I am having HP Deskjet 3050A J611 series printer and in my office we are having wireless network and i want make this printer as a wireless but we are having WPA enterprise 802.1x wireless settings in our office.
So i need the configuring steps how to configure WPA enterprise 802.1x wireless settings.
Your Quick response is highly appreciated.
Thanks & Regards..
Ahmed Abdul AliHope you a having a great day,
I am reaching out to probe if you still experience this issue. If you are, Click Here This are basic steps perhaps you can find answer to your question here, If this does not help Update your post, I will do we best to find answer for you in the other hand if you are not experiencing this issue any longer you may disregard this post, although I will appreciate if you can take I little bit of your time and let me know.
Thanks
RobertoR
You can say THANKS by clicking the KUDOS STAR. If my suggestion resolves your issue Mark as a "SOLUTION" this way others can benefit Thanks in Advance! -
Post iOS 5.1 update stuck to the configuration screen
Hi
Since I update to iOS 5.1 directly from my iPhone, the phone is stuck at the Configuration screen. Each time I finish the localization, wifi, I end up on the "Thank you" screen showing that the iphone is fully configured. Then when I hit the "Start using the iPhone" my regular screen with all applications appears for less than a second then disappears and the iphone gets back to the configuration menu...!
I have restored several times with no improvement.
Do you have any idea how to fix that issue ?
ThanksDid you happen to have any parental restrictions enabled before you updated, maybe Siri? (Was mentioned on other forums)
Have you tried to restore your iPhone and set it up as a new device? -
802.11 configuration on Powerbook
Admittedly, I'm a novice user of Mac OS X.
I am configuring a Mac OS X laptop to connect wirelessly (802.11) to a Linksys access point. The wireless network has 128-bit WEP encryption enabled and the broadcast of the network is OFF.
If I go and configure the wireless network on the laptop, SSID and WEP key, it works. I can print to local network printers and I can get to the Internet. However, if I reboot, I need to go back in and reconfigure the network every time, including the WEP key which can be quite tedious.
Why are the settings I set not saved? How can I make sure when I reboot I don't have to go back and reconfigure my wireless network settings?
Thanks ahead of time for your assistance.Hi Kleintech, Welcome to the New Apple Discussions
I am new to this airport stuff also so I can't tell you how to save your configuration, but here is a link from the User tip Library.
There is a whole lot there about it, just look for Airport section.
http://discussions.apple.com/thread.jspa?threadID=296514&tstart=0
Good luck, let us know how it goes for you.
Enjoy.
regards, Eme -
Airport Extreme 802.11ac configuration issue
Hello all,
I'm hoping someone can help me configure my new Airport Extreme. I have a new Haswell Macbook Air and I thought they would just use 802.11ac automatically. My problem is the Macbook Air is showing as connected with 802.11n, so I can't benefit from faster TM backups for example.
I've updated the router and the computer to the latest firmware/software versions.
Any tips would be much appriciated!The MCS Index value is telling me that the connection between the MBA & the Extreme is only using two spatial streams. I would expect that the MBA can support three or even four streams connections with the new 802.11ac Extreme. Not sure why yours is not. At this point it is hard to tell if the issue is with the MBA or the Extreme ... or both.
For example, my 2012 MacBook Pro is currently connected to my 4th generation 802.11n AirPort Extreme with MCS value of 23. That would be a three stream connection and I am currently getting 450 Mbps for the Transmit Rate.
I would suggest, if possible, taking both to your local Apple Store to have them checked out. -
802.1x configuration for switch Ports
hi All,
I am looking for help on a specific trouble with a custome implementation on 802.1x.
Currently its set as below;
authentication control-direction both
authentication host-mode single-host
no authentication open
authentication priority dot1x mab
authentication port-control auto
no authentication periodic
authentication timer restart 0
authentication timer reauthenticate 3600
authentication timer inactivity 0
authentication violation shutdown
no authentication fallback
mab radius
dot1x pae authenticator
dot1x timeout quiet-period 60
dot1x timeout server-timeout 0
dot1x timeout tx-period 15
dot1x timeout supp-timeout 30
dot1x timeout ratelimit-period 0
dot1x max-req 2
dot1x max-reauth-req 2
trying to understand what parameter i need to change in order for Laptop/desktop coming from loosing access after going in to Sleepmode.
Any help is appreciated.You might want to activate periodic authentication. I have not tested it myself, but I believe this should help.
-
i have an iphone 3gs and i just update it so i can text pic .but durung the configuration i'm unable to activate my phone
That is usually a symptom that the phone has been hacked/jailbroken. Was it?
-
Trying to update my iPhone 4s from ios 8.0 to iOs 8.0.2. Is this my last iPhone? Have been wating for iPhone 6, but now?
Your questions is still not clear. If the phone is telling you to connect it to iTunes, it is probably in Recovery Mode. Follow these instructions. You must start by connecting it to a computer running iTunes.
If you can't update or restore your iPhone, iPad, or iPod touch -
Hi, I have the newest iMac 2013, MacBook Air 2013 and AirPort Extreme/TimeCapsule 3 TB, all 802.11ac compliant, but when I option-click on the network symbol in the menu bar on both computers, the PHY mode is displayed as being 802.11n. I have looked everywhere under System Preferences > Network, and throughout the AirPort Utility application 6.3.1 (running under OSX 10.8.5), but I cannot find any place where I may be able to select 802.11ac as the preferred network standard -- what am I missing/doing wrong here? Perhaps I should also mention that I have several other units connected to my network, all verified 802.11n compliant (1 x MacBook Pro 2012 + 1 x MacBook Pro 2009 + 3 x iPad2 + 1 x iPad3 + 2 x iPhone4 + 1 x AppleTV G3 (black) + 1 x TimeCapsule G2 (flat white) + 1 x AirPort Express + 1 x HP Color LaserJet 3700n), but that should have nothing to do with the 802.11ac communication capacity between the iMac, MacBook Air and TimeCapsule, right? Any advice that will set me straight would be much appreciated! :-)
/MarkWhen I am in range of the AE the MBA automatically selected the 5 GHz band and displayed the 802.11AC mode, speed 896 Mb. Of course when I move the MBA about two rooms distant it switches to 802.11n mode.
Yes, in practice most will find that 802.11ac will only be practical when the router and the network client are in the same room. 802.11n, on the 5 GHz band, has a bit farther range but I would still recommend using it with clients that will be in the same room. This is basically the limitation of using a higher radio band, not necessarily whether it is "ac" or "n." The higher the frequency the more difficult it is for the signal to penetrate objects, like walls. -
Anchor mobility configuration getting lost in wlc 5508 ios code 7.4.100.0
It is observed that in WLC 5508 , ios 7.4.100.0 , mobility anchor configuration on wlan is getting lost . we configure anchor ip address on guest wlan > mobility anchor > Switch IP Address (Anchor).
We have configured the template on NCS 2.0 to push the anchor mobility ip address on all WLC
Has anyone oberved this behavoiur. We have more than 100 WLC , and everyweek mobility anchor configuration is lost on some WLC having code 7.4.100.0.I am having this exact same problem. I am running 7.3 on 5508 WLC. My remote site LAP's are using Flex (HREAP). The initial access point that my laptop associates to connects with no problem, as soon as I wander out of range of the initial LAP and into the area of another access point, I lose data connectivity. The was validated like the original post as I start a constant ping on the LAN and watch as the ping latency increases and then ping replies stop. The only way to correct the problem is resetting of the wireless adapter on the laptop. Side note my DroidX has no problem wandering from AP to AP.
Laptop: Windows 7 32bit
I then returned to my home site and test where I have a secondary controller and the LAP's are configured for local mode, no problems roaming from access point to access point. Validated with constant ping test. The pings drop for a second and re-
continues as the laptop reconnects.
**Edit: I am going to try the removing the DHCP Addr. Assignment required option, and report that back to the TAC engineer.
Message was edited by: Michael Dunki-Jacobs
**Edit Solved:***
The problem is in deed solved by turning the "DHCP Address Required" but why?
Maybe you are looking for
-
Upgrade my IPAD from 8.1.3 to 8.2 via Itunes (from Windows Computer) First I backed up the IPAD via Itunes on my Windows laptop. Then I click upgrade IOS to 8.2 on Itunes. Later got a upgrade failure pop up window. Now IPAD is locked with a blank scr
-
Wireless printer losing connection hourly.
I currently have a Cisco 4400 wireless controller running 7.0.116. We use Cisco 1262, 1242 and 1210 Access Points. I am fairly new to all this. Our issue is that we have a wireless laser device that runs fine for about 1 hour and then loses connecti
-
Webdynpro application deployment
Hi Friends, I deploy and run my webdynpro application on Portal server. is tehre any way for ot deployment, as every time deployement takes 10 to 15 minutes to deploy the file.
-
Hi, got my MacBook Pro new in October (2010), I seem to only be getting a couple hours maximum of charge on it. I've set the computer so it won't waste much energy (e.g. making backlight dimmer) but it doesn't seem to help. Here's my battery info if
-
Get the each folder size in ASM
Hi, i have a ASM disk group name as DATA. which contains 30 folders. under 30 folders they are so many folder. if my present directory is DATA and i want to see the size of each folder and sub-folders also . what is command to see the size of each fo