Ipad 2 802.1X PEAP Authentication problem (With profile from IPCU)
Hi!
I'm in the processes of setting up a new wireless network for a costumer.
A little info about the hardware:
Cisco WLC 5508
Cisco AP 2602i
Cisco ISE - radius server
ipads gen 4 (iOS 6)
EAP-TLS (windows machines) and PEAP (Other stuff, ipads, andriod etc) as authentications methods
The radius server is using a server certificate from thier own PKI infrastructure therefor i need to push the root certificate of their CA to the clients in order to verify the authentication server. For this I use the iphone/ipad configuration utility.
I use the Use Per-connection password option
User that are allowed to connect are placed in a specific group in there AD.
The problem that I have is:
When a user thats not allowed to connect tries to authenticate to the network the ipad says stop and thats the way it supposed to be.
BUT after someone has faild to authenticate to the network and somebody else tries to connect the ipad only ask for a password and not a username.
I cant seem to get rid of this popup and therefor the ipad cant connect.
If I don't use the profile I can forget about the network and after that i can connect with a different user.
But then i can't verify the server-certificate and use the option per-connection password!
Please help!
Has someone else seen this type of bug.
//Simon
Hi, I am new with 802.1x, and was hoping that someone would help with these queries:
1. How is a certificate requested without being allowed on a network that is not authenticated with 802.1x. I had to first connect to an active network, retrieve a certificate with the proper username and password, and then physically connect to the port on the 2950 switch which was enabled to do 802.1x
2. My config is as below:
aaa new-model
aaa authentication dot1x default group radius
aaa authenication login default group radius
dot1x system-auth-control
interface f0/1
switchport mode access
dot1x port-control auto
end
I able to login using the radius server, so radius is working (on ports other than f1/0). However when connecting to f1/0, the port on the 2950 remains blocked.
3. The certificate is issued by the ca server, is viewable via Internet explorer,and is issued to the correct username which is on the active directory.
I even tried using local authenication with 802.1x, this did not work
4. If I have a certificate, will this automatically give me access to the 802.1x port?
5. I have windows 2000, and authenication is set to 'Smart Card or other certificate.
Am I missing anything?
Any advise will be greatly appreciated
Chris
Similar Messages
-
802.1x RADIUS authentication problem with Cat 2950 to CiscoSecure ACS 3.3
I wondered if anyone can help or shed any light on the following problem.
I am getting an authentication error when doing a RADIUS authentication to CiscoSecure ACS 3.3 running on a Windows 2003 server, the authentication request is coming from a Catalyst 2950 switch which is doing 802.1x for Windows XP clients. This problem only happens when the XP client connects to 2950 switches, Cat 3550s and 3560s work fine.
The Cat2950 is running 12.1.20 (EA1) which is more or less the latest IOS.
The error I get from ACS 3.3 is "Invalid message authenticator in EAP request" when the 2950 tries to authenticate an XP client for 802.1x to the ACS server using RADIUS.
Doing a RADIUS and 802.1x debug on the 2950 I see a message about 'Unknown EAP type', I am using PEAP on the XP client doing EAP-MS-CHAPv2 authentication, the same XP client authenticates fine with 3550 and 3560 switches problem only affects 2950s. Can anyone confirm the 2950 supports EAP-MS-CHAPv2?
I have checked and re-checked the shared secret and it definitely matches on 2950 and ACS.
One thing I noticed in the RADIUS debug is the 2950 sends 18 bytes for attribute 79 when the RFC defines attribute 79 should be 3 bytes or less, I don't know if this is related to the problem or is correct behaviour.Hi, I am new with 802.1x, and was hoping that someone would help with these queries:
1. How is a certificate requested without being allowed on a network that is not authenticated with 802.1x. I had to first connect to an active network, retrieve a certificate with the proper username and password, and then physically connect to the port on the 2950 switch which was enabled to do 802.1x
2. My config is as below:
aaa new-model
aaa authentication dot1x default group radius
aaa authenication login default group radius
dot1x system-auth-control
interface f0/1
switchport mode access
dot1x port-control auto
end
I able to login using the radius server, so radius is working (on ports other than f1/0). However when connecting to f1/0, the port on the 2950 remains blocked.
3. The certificate is issued by the ca server, is viewable via Internet explorer,and is issued to the correct username which is on the active directory.
I even tried using local authenication with 802.1x, this did not work
4. If I have a certificate, will this automatically give me access to the 802.1x port?
5. I have windows 2000, and authenication is set to 'Smart Card or other certificate.
Am I missing anything?
Any advise will be greatly appreciated
Chris -
802.1x peap mschap v2 with MAC Filter + IP Address Permanent
Hi my name is Ivan, i have an issue
I have one cisco wlc 5508 with ios 7.4.100 with a ssid is working with 802.1x peap mschap v2 with mac filter, and I need configure in the web page of the WLC Security > Mac Filter, a MAC and one IP Address permanent to the users.
I have a service dhcp into the wlc to this profile.
This configuration works fine for 3 or 4 days. At the fifth day , my users renew the ip address, and they can not surfing to internet, because in my firewall i have a policy to the users with exactly ip address, for example.
MAC Filter - IP Address A - UserA
My policy say:
PolicyUserA - Internet
Please, i can establish an filter mac associate to one ip address permanent to one user, when service dhcp in the cisco wlc is active?
I possible to do it?.
How can i do it?Hi Ivan,
You can not map the mac-ip address pairs on the WLC DHCP.
The WLC has a limited DHCP server functionalities. You better to use an external DHCP server with full functionalities and then you can configure the DHCP server to provide the same IP address everytime to each client in your network.
HTH
Amjad
Rating useful replies is more useful than saying "Thank you" -
With Yahoo Mail, and anotare account (Inacap Mail), I can only receive mails but I can't send emails. I don't know if this is a problem of the iPad or it is a problem with yahoo mail, because using Gmail and the email of my job I don' have this problem.
Google them to confirm the settings that you need for the outgoing server, then check the setting you entered on the pad. Pay real close attention to the outgoing server name, and port. You may need to change in on the pad.
-
I am sachin ,purchase iPad mini but I have problem with apple Id .because I don't have credit card for payment .i have debit card so pl help me
As far as I know debit cards aren't accepted as a valid payment method. There are instructions on this page for how to create an account without giving a credit card number : http://support.apple.com/kb/HT2534
Depending upon what country that you in you might be able to buy iTunes gift cards from Apple or other stores (supermarkets, electronics stores etc) and use those to buy items - but they aren't available in all countries, and they are country-specific (they can only be used in their country of issue -
What is the easiest way to access the router from an iPad? I have no problems accessing it from my laptop. Even though I am entering the address in the left address box, not the Google search box, it wants to do either a search, or add www to the beginning of the IP address.
I usually can eventually access the router, but it is way to much trouble. However, I use my iPad hundreds of times more often than my laptop.Are you typing http:// in front of the IP address of the router? e.g. http://192.168.0.1
Sometimes, and with some routers it doesn't seem to like it if you miss off the http:// -
Windows 8.1 Problem with games from windows store.
I've got a problem with games from windows store. The installation is going well without any problems, however when I try to open it it's loading and then it turns off. The same problem happens when I try to use Games for Windows. I've use a sfc scan and
it shows some errors but unfortunately it cannot fix them. Should I share the CBS log or find the solution somewhere else? I hope you help, best regards.Hi,
According to my experience, the problem like store game app open failed probably caused by hardware driver. such as Audio and Graphic driver. So, first of all, please try to reinstall these two driver to fix this problem for test.
In addition, for SFC scan failed problem, it can be caused by many reasons, I would suggest you use another command to fix your system for test.
Dism /Online /Cleanup-Image /ScanHealth
Also you can test SFC command in Windows 8.1 safe mode.
Thirdly, if problem persists, please check Event Viewer, generally speaking, it would record the app open failed events.
Roger Lu
TechNet Community Support -
I have problem with buying from iTunes Store
I have problem with buying from iTunes ??!!
I've put all of my info cards
What can i do ?!Are you trying to spam the forum with 6 the same posts?
Please give more details of your problem and answer the question below:
Is the app available in your country?
Are you using the App Store for your country? -
I have a problem with downloading from app store while last three days. An error does not allow me to take any app. The error number is 1009.
Thats the ugliest code I've seen in a while and may be hampering your abilities to debug it. No offense - you have to start somewhere - think of it as somewhat constructive criticism.
However, I cannot find any place where this is happening. Its happening on line 193.
Also, this only happens when you try to move certain pieces to certain squaresThat might be a clue. Try printing out the indexes before line 193 and see what happens. Maybe use a debugger to step through your code. -
I have a Iphone 4S and i update a new version 6.1, and i have a problem with wifi from i update this version. What is this problem? thanks Andres
Move or Copy the ENTIRE iTunes folder from the old computer or the backup of the old computer to the new computer.
-
K8t Neo2 problem with resume from standby after BIOS flash
Previously while using the 3.2 BIOS and a Winchester 3200+, Both Standby and hibernation worked perfectly almost without fail. Since I flashed the BIOS to 9.3 and installed an X2 4200+ I have had a problem with resume from standby. The machine starts up OK but the 2nd processor core (cpu1) is almost maxed out and stays that way. Task manager shows total cpu load as about 45-50% (all on cpu1) but shows no running process using any cpu load, just the usual System Idle process at about 99%. The only way to get it back down to normal again seems to be to reboot. By Contrast Hibernation works fine, with no increase in cpu load after resume. I have all the latest MS patch's installed (I think!) the AMD dual core driver and the MS and AMD dual core optimizers. Any ideas what is going on?
Noticed last night that S! standby seems to work OK. Also was experimenting with a fresh windows install on a spare hard drive (checking on another problem). The fresh windows install appeared to work with S4 hibernation, so it looks like that is the answer to that problem. However the problem with high cpu load on the second core after resume from S3 suspend to RAM standby was still present. This problem is so specific and so repeatable (it does it every time without fail), that I feel there must be some very well defined reason for it. Unfortunately I have no ideas what could be wrong. Have now tried Windows re-install, latest cpu drivers, AMD dual core optimizer, MS dual core optimizer, Cool'n'quite disabled/enabled, and various others and suspend to RAM still gives the same behaviour
-
We are running ISE 1.3 tied to AD with WLC 7.6.130.0. Our ISE has a GoDaddy (none wildcard) certificate loaded for https and EAP. We are just running PEAP. We have a mix of IOS, Android, and Windows 7/8 devices. IOS and Android devices can self create a wireless profile and after entering credentials can connect without issue. Our Windows 7/8 devices, when auto creating a wireless profile are selecting 802.1x machine authentication instead of User authentication or the best option which is machine or user authentication. This is problematic as we do allow for machine authentication but have an authorization rule limiting machine auth to domain controller and ISE connectivity only. This is to allow domain Windows 7/8 devices to have domain connectivity prior to user sign-in but force user auth to get true network connectivity. The problem is why are the Windows devices not auto setting to user authentication (as I think they did when we ran ISE1.2), or the best option which is to allow both types of authentication? I have limited authentication protocols to just EAP CHAP and moved the machine auth profile to the bottom of the list. Neither have helped. I also notice that the Windows 7/8 endpoints have to say allow connectivity several times even though we are using a global and should be trusted certificate authority (probably a separate issue).
Thank you for any help or ideas,When connecting a windows device to the ISE enabled SSID when there is not a saved wireless profile on that machine, it will connect and auto create the profile. In that profile, 802.1x computer authentication option is chosen by windows. That has to be changed to computer or user for the machine to function correctly on the network.
On 1.2, this behavior was different. The Windows device would auto select user authentication by default. At other customer sites, windows devices auto select user authentication. This of course needs to be changed to user or computer in order to support machine auth, but at least the default behavior of user authentication would allow machines to get on the network and functional easily to begin with. -
802.1x re authentication problem
Hello,
I have problem with 802.1x authentication on switch ports which are configured in "Multi Session" mode. In Single host mode and Multiple Host mode it works just fine.
The problem is following, when PC is first connected on switch port it authenticates successfully. After about 1-2 minutes windows 7 NIC notifies that its going to authenticate again, and after couple of minutes NIC status is changed to “Authentication Failed”. On ACS I only see first authentication request which is successful. If I unplug PC from port and plug it again. It authenticates successfully and then starts again with same problems.
I was doing packet sniffing on PC, and it seems that after pc first authentication completes successful, switch starting to sent EAP Identity/Request packets to host, for that host is sending EAP Identity/Response to switch, but switch don’t continues authentication process and starts again with new EAP Identity/Request packets.
On Windows 7 host Event viewer I see following log messages:
Reason: 0x70004
Reason Text: The network stopped answering authentication requests
Error Code: 0x0
The ACS version is 5.3. Authentication method is PEAP. Supplicant OS is Windows 7 I also trued with Windows XP, with same result. The Authentication switch is ESW 520 with latest firmware. I also trued with 2960/3560 switches and it works perfectly. On ESW 520 switch if port mode is other than “Multi Session" if works without any issue.
Do you have any Idea how can i fix this ?Hi ngtransge,
Thanks for rating the replies. You need to select "User Authentication". I am pasting some screenshots which might help you out. -
802.1X wireless network problems with Intel Mac
To login to the wireless network at my school I have to use an 802.1X connection authenticating with TTLS, TLS, EAP-FAST and PEAP protocols.
This works intermitently. Some days my MacBook logs on quickly with no problems at all but most days it has a self assigned IP address and I can't use the internet. My friend also uses a MacBook, which acts in the same way. Some days she manages to get on, some days I can get on and some days we are both on together. The problem is really irritating!! We get no support from the techs as we are the only Mac people in the school. The rest of the staff have PCs. The techs are just trying to use this issue to justify why letting people lease Macs is a problem and stop other staff from leasing them in the future.
I did find a solution at
http://discussions.apple.com/thread.jspa?threadID=425113&tstart=0
but this was written in 2006 and I wonderered if this was still valid.
Can anyone help? please???I am a tech at our school and we have the same problems. still trying to find a permanent solution!
If you turn airport off, then turn on again, (from system prefs > network) does it change from "self-assigned IP Address" to "Authenticated via PEAP)?
the macs are more and more popular at our school, so its becoming more and more of an issue.
cheers,
Harry -
ESW 520 802.1x re authentication problem
Hello
I have problem with ESW 520, on 802.1x authentication. The problem is when host authenticates successfully it works about couple of minutes, after it truest too authenticate again but it lags. On network interface it shows notification that if Failed authentication. On ACS I see only one authentication attempt which is successful. This problem is happening on Win7 and Win XP. If I unplug and plug cable it authenticates successfully, but then about couple of minutes it again lags. Switch sees port as authenticated. On Win7 event viewer I have following error:
Reason: 0x70004
Reason Text: The network stopped answering authentication requests
Error Code: 0x0
If I connect same hosts on Catalyst 2960 switch, they work successfully.Hi ngtransge
There are tree possible explanations about why the authentications fails.
A)the network interface is shut down after failed computer authentication. You can see this on the switch as line protocol down for that port.
To verify the client has a domain certificate:
1. Click Start and click Run.
2. Type mmc, and then press ENTER.
3. On the File menu, click Add/Remove Snap-in.
4. Click Certificates, click Add, select Computer account, and then click Next.
5. Verify that Local computer: (the computer this console is running on) is selected, click Finish, and then click OK.
6. In the console tree, double-click Certificates (Local Computer), double-click Personal, and then click Certificates.
On a domain joined client, you should see a certificate here with Intended Purposes of Client Authentication. Make sure this certificate is not expired. If it is expired, you will need to regain connection to your CA to request a new one.
B) You should check your switch's configuration, perhaps a port or some ports could be blocked by an access-list and interrupt the re authentication.
C) If this two solutions don't work, you have to try to change the authentication method (PEAP-MSCHAPv2 or PEAP-EAP-TLS)
Greetings, Johnnatn Rodriguez Miranda
Maybe you are looking for
-
I have 4 devices, itunes account with a yahoo email. I want to mainstream all on itunes and icloud for my "me" account !!! How do I go about doing this ??? iphone 4, ipad 2 , ipod touch itunes account is an yahoo address. I have and use a ME.COM acco
-
SCCM 2012 R2 how to configure SCUP for third party patches
we have CAS and primary site servers need to configure SCUP what need to be configure in CAS and what in primary.
-
Hello all, This driving me crazy - I have done it all - read through every forum and post - inculding all here. None of them resolves my issue... The details: Iphone - 4 - with IOS 5.0.1 (not the 4S) itunes version 10.5.2 64bit Laptop - running Windo
-
Image display problem in photoshop cs6
when i open any image in photoshop,its looks like washout but it looks fine in windows image viewer here is an example:
-
Email Photos as Attachments from Lightroom 5
Is it possible to email photos as attachments (jpg), not embededed within email? Mac users report when they receive the email, photo is only embedded, there is no attachment so they cannot download.