ISE 1.2 and EAP-MD5

Hi,
I have HP procurve switches that need to get authenticated with EAP-MD5 but I cant get it to work in ISE 1.2 with patch 2.
We have tried all combination for EAP-MD5 in allowed protocols but get the same message when trying to authenticate.
The ISE deployemnt do not run in FIPS-140 2 mode.
And when using the switch with NPS we get this to work, so switch configuration is ok.
Failure Reason: 12003 Failed to negotiate EAP because EAP-MD5 not allowed in the Allowed Protocols
Resolution: Ensure that the EAP-MD5 protocol is allowed by ISE in Allowed Protocols.
Root cause :The client's supplicant sent an EAP-Response/NAK packet rejecting the previously-proposed EAP-based protocol, and requesting to use EAP-MD5 instead. However, EAP-MD5 is not allowed in Allowed Protocols.
Any thoughts on this?
Cheers

Choose Policy > Policy Elements > Results >Authentication > Allowed Protocols
Select EAP-MD5—Check the Allow EAP-MD5 check box and check Detect EAP-MD5 as Host Lookup check box.
Save the Allowed Protocol service.
~BR
Jatin Katyal
**Do rate helpful posts**

Similar Messages

ISE MAB Host Lookup - PAP or EAP-MD5

In the docs, it says that MAB uses PAP/ASCII or EAP-MD5 to pass the MAC as username / password.
In the attached setup, MAB is talking place successfully for an iPhone, without having PAP or EAP-MD5 enabled as Allowed Protocols.
Is the "Host Lookup" under allowed protocols, provides for the MAC address to be passed in PAP / EAP-MD5 even if these two protocols are not enabled below under the Authentication Protocols section of the configuration?
How could we dictate to our switch to start using EAP-MD5 to pass the MAC? If you look at the attached authentication details output, it lists in the AV Pair a EAP-Key. Is that it?
Thank you.
Cath.

Hello Cath-
Question #1: Yes, I think you are correct. I believe that the "Host Lookup" is type of "protocol" used to process the MAB. If you look at the top of the authenticaiton session what do you under "Authentication Protocol?" My guess is that you see "Lookup" (see attached screen shot)
Question #2: You can force the switch to use EAP-MD5 by appending "EAP" to the "MAB" command under the individual ports:
     interface fa0/1
     mab eap
Things to conisider:
     1) If you make that change the default/built-in condition in ISE "Wired-MAB" will have to be changed since the
service-type radius attribute will change from "Call Check" to "Framed." Thus, your MAB devices can easily skip the MAB authenticaiton rule and be denied on the network
     2) Because the MAC address is sent in the clear text "Attribute 31" (Calling-Station-Id), MAB EAP does not offer any additional security by encrypting the MAC address in the password
     3) Because the service type for MAB EAP is the same as an IEEE 802.1X request, the RADIUS server will not be able to easily differentiate MAB EAP requests from IEEE 802.1X requests
Here is a good document that you can reference as well:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-663759.html
Hope this helps...
Thank you for rating!

Authentication with EAP-MD5/PEAP/FAST

Version: ISE 1.2p12
Hello,
I have trouble authenticating devices that use different protocols:
- Cisco IP Phones: EAP-MD5
- Windows machines: EAP-PEAP
- Cisco APs: EAP-FAST
1) I'm able to authenticate the IP Phones individually with a authentication rule:
IP PHONES If Wired_802.1X allowed protocols EAP-MD5
For EAP-MD5 I selected only EAP-MD5
Now if I use a generic rule
DEVICES If Wired_802.1X allowed protocols EAP-PEAP-FAST-MD5
with EAP-PEAP-FAST-MD5 having EAP-PEAP, EAP-FAST, EAP-MD5 selected, it doesn't work
ISE says that there's a protocol mismatch:
"Failure Reason: 12121 Client didn't provide suitable ciphers for anonymous PAC-provisioning"
ISE is trying to authenticate my phone with EAP-FAST while the Cisco phone is useing EAP-MD5
I read in another topic that some of you would consider MAB/Profiling for the APs and probably for the Cisco IP Phones. But I'm wondering if it's possible to have one authentication rule with allowed protocols EAP-PEAP-FAST-MD5
2) Also, if I place the EAP-MD5 authentication rule higher and then have a rule for EAP-PEAP-FAST below it doesn't work because only the first rule is matched. I have configured the first rule with "If authentication fails = Continue"
Does any of you have hints ?

I know now the problem. WLC try to connect with "anonymous bind" to the ldap server. It works well with Win2000. With Win2003 it works only if you open the security. See link: http://support.microsoft.com/kb/320528/en
You haven't the possiblity to configure any username/pwd for a secure ldap query. It's something that is an absolutely need for many customers.
For the moment I will sugest the "workaround" with AP->WLC->Radius->LDAP
Kind regards
Alex

ISE 1.1.1 - EAP-TLS / User Cert - Determine if corporate laptop?

Greets. Is there a way to determine if the machine a user has authenticated from via EAP-TLS / user cert (or PEAP / mschapV2) is an active directory computer or not. I understand that EAP-Chaining using EAP-FAST and the Anyconnect client would work for this, but what about using the native windows supplicant and a user cert (or PEAP / mschapv2)?
Long story short, what I'd like to do is:
User authenticates to ISE via EAP-TLS / user cert (or PEAP / mschapV2)
Authorization based on whether it's a personally owned device or a corporate laptop (different AuthZ rule/ACL's based on this)
personally owned devices only allowed to do ICA,
corporate device can use SQL, RDP, etc...
Thoughts, ideas?

Not sure i understand your response, or perhaps my original question isn't clear.
User authenticates with EAP-TLS / User cert
User is authorized based on user cert CN Name, Active Directory lookup, group membership matched, and proper ACL applied
Unable to determine if the machine that the user is authenticating from is an active directory computer or not which would need to be determine in order to allow further ACL refinement (permit/deny certain protocol's based on if it is a personally owned device or a domained device, etc...).
My question is, is it possible to do this using the native windows suplicant and EAP-TLS / user? I am only able to look up details based on the user cert (since this is what the supplicant is using), and not sure how to validate the PC as being a member of the domain or not (since the machine cert wasn't used in EAP-TLS).

EAP-TLS and EAP-PEAP Clients

Hi guys
I have installed a dot.1x solution for a customer using ISE. The ip phones have certificate from CUCM server. In the ISE a wired-dot.1x with eqp-tls enabled policy is configured so that when ip phones or PC connect to network they get authenticated using EAP -TLS. I have required certificates imported on pc's and ISE server. That part works absolutely fine.
Now I have been asked to configure EAP-PEAP for video end points which doesn't support EAP -TLS.
The endpoints are configured with a username and password. The credentials are created in ISE server.
I create a second policy for wired dot.1x with EAP - PEAP enabled
The problem I am hitting is that if the PCM and phone policy is on top. The phone and pc gets authenticated. But video endpoint doesn't. I get authentication error messages saying certificate expected but received credentials.
When I move the video end point authentication rule above the pc and phones. The video end points get authenticated successfully. But PC and phone authentication breaks. The error message I receive is saying usrname and password expected but received a certificated based authentication.
Has anyone seen this type of scenario ? Any idea how to make EAP -PEAP and EAP TLS authentication work together ?
Thanks in advance.
Sent from Cisco Technical Support iPad App

Hi,
There are two ways you can tackle this with ISE, I will start with the easiest one and then the other one to cover your options.
You need to create an identity store sequence. This allows you to mix both certificate based and password based authentications, keep in mind that you can only map one Certificate authentication Profile in when using identity store sequences. More informations about configuring this is provided below:
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_man_id_stores.html#wp1117203
The next option would be to use the authentication policy configuration to map the patterns of the username (if common with your video endpoints), to forward their requests to the internal identity store. You can use regex to make this work and you can check for the radius username attribute.
Thanks,
Tarik Admani
*Please rate helpful posts*

NPS & EAP-MD5

Hi there,
We are currently working on the deployment of 802.1x enterprise-wide. Since we have some old devices that don't support 802.1x natively, and have a Cisco infrastructure, we decided to go the MAC Authentication Bypass route.
When we tested it prior, we were running Windows 2003 + IAS. The test was flawless, however, it required us to enable Reversable Encryption and relax our password complexity requirements, which was unacceptable. We then decided to upgrade to Windows 2008 to leverage the seperate password/complexity policy requirements based on a user or a group of users.
I've just finished setting that up, and it works perfect. We decided to go with NPS, as it had a bunch of features that were lacking from Windows 2003's IAS (namelly exporting the configuration and being able to import it to our other IAS/NPS servers). We currently run the NPS service on our DC's (two of them for redundancy), however, we can't seem to make the MAC Authentication Bypass work. After some digging, it seems that Microsoft has removed support for EAP-MD5 from Vista/2008. They mention that there are third party EAPHost compliant vendors that 'may' have EAP-MD5 support, but I've been unable to find any.
My question is, has anyone else ran into this problem? If so, how did you go about fixing it. Unfortunately, Cisco only seems to support EAP-MD5 for the MAC Authentication Bypass, we're currently running this on 3560 Catalyst switches. I'd much rather get it working again on our NPS servers, as I don't want to revert back to IAS, as it's a pain to replicate the configurations between more than 1 box.
Thanks!
Warren

Hi PCGUY1184,
I am trying to get Mitel phones working with 802.1X, I have enabled MD5 and made the other changes you propose but its still not working. The event log is showing eventid 6274
Network Policy Server discarded the request for a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:   NULL SID
Account Name:   Mitel8021X
Account Domain:   #Domain Removed#
Fully Qualified Account Name: #Domain Removed#\Mitel8021X
Client Machine:
Security ID:   NULL SID
Account Name:   -
Fully Qualified Account Name: -
OS-Version:   -
Called Station Identifier:  -
Calling Station Identifier:  08-00-0F-5D-87-1A
NAS:
NAS IPv4 Address:  192.168.202.1
NAS IPv6 Address:  -
NAS Identifier:   -
NAS Port-Type:   Ethernet
NAS Port:   11
RADIUS Client:
Client Friendly Name:  Nortel5520
Client IP Address:   192.168.202.1
Authentication Details:
Connection Request Policy Name: Secure Wired Connections
Network Policy Name:  -
Authentication Provider:  Windows
Authentication Server:  #NPS Server FQDN#
Authentication Type:  -
EAP Type:   -
Account Session Identifier:  -
Reason Code:   1
Reason:    An internal error occurred. Check the system event log for additional information.
Did you come accross this problem? I saw a hotfix available for 2008R2 for EAP-MD5 where the name field is empty however the hotfix wont install as I believe I already have a newer version of raschap.dll
Regards,
Craig

PEAP + EAP-MD5

I've read that with the ACS 3.1 the only eap-type supported with PEAP is GTC.
Why it is not possible to use EAP-MD5 or EAP-TLS with PEAP? These EAP-type were already supported in ACS 3.0...
Thanks for your time.

As per my knowledge,Peap uses TLS protocol also to authenticate.
PEAP works in the following way:PEAP operates in two steps. The first step is the server authentication and second one is user authentication using a new EAP type .
PEAP uses TLS to authenticate the network infrastructure through the TLS Handshake protocol, to protect user credentials in transit by means of the TLS Record Protocol, and to generate cryptographic keying material using the TLS-defined pseudo-random function (PRF) functionality.
For information on this you can follow the URLs,
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a008010217f.html#4907
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0080102179.html
http://www.cisco.com/warp/public/cc/pd/sqsw/sq/prodlit/acsq_qp.htm

Using Windows 802.1x whith EAP-MD5 on Aironet 350 Adapter

Hello all,
I'm trying to use EAP-MD5 as the authentication mechanism with my Aironet Card and the Microsoft 802.1x stack under Win2K. Unfortunately, this choice is not possible while I can do it with legacy LAN cards. According to CCO litterature, it is supposed to be supported. Did anyone manage to have this working ?
Thanks in advance
Cyril

This is supported and it should work.
Check out this information:
http://www.cisco.com/univercd/cc/td/doc/product/wireless/airo_350/350cards/windows/incfg/win_ch6.htm#xtocid20

PEAP, EAP-TLS & EAP-MD5

Hi
Just want to know is there any known problems or issues having PEAP, EAP-TLS & EAP-MD5 enabled on ACS Radius servers for wireless authentication?

Hello,
There is no problems excep you have to have CA server for certificates for both ACS and wireless users.
Regards,
Belal

ISE 1.2 and iPEP Certificate Requirements

Hi,
For 1.1.x version of ISE, there are some constraints regarding the certificates used for iPEP and Admin:
Both EKU attributes should be disabled, if both EKU attributes are disabled in the Inline Posture certificate, or both EKU attributes should be enabled, if the server attribute is enabled in the Inline Postur certificate.
[http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bea904.shtml]
Does the same thing applies for iPEP in ISE 1.2? The User Guide for ISE 1.2 and Hardware Installation Guide doesn't mention anything about EKU and specific certificate attributes..
Any thoughts?
Thank you,
Octavian

The EKU validation has been removed in version 1.2
"If you configure ISE for services such as Inline Policy Enforcement Point (iPEP), the template used in order to generate the ISE server identity certificate should contain both client and server authentication attributes if you use ISE Version 1.1.x or earlier. This allows the admin and inline nodes to mutually authenticate each other. The EKU validation for iPEP was removed in ISE Version 1.2, which makes this requirement less relevant."
Source:
http://www.cisco.com/en/US/products/ps11640/products_tech_note09186a0080bff108.shtml

I want to integrate SMS gateway to Cisco ISE 1.2 and my question is SMS notifications are supported for Guest self−registration

I want to integrate SMS gateway to Cisco ISE 1.2 and my question is
SMS notifications are supported for Guest self−registration Services ? or it should be done by Sponsor

I'm not sure I understand the question. Do you want to log in to the Sponsor Portal using AD credentials?
Create an Identity Source Sequence using AD as an Authentication Source. Go to Administration > Identity Management > Identity Source Sequences. Either Edit or +Add a Sequence and choose from the Authentication Sources shown.
Then choose that Identity Source Sequence by going to Administration > Web Portal Management > Settings. Double-click Sponsor from the Left Menu and click Authentication Source. Choose the Identity Source Sequence. Click Save.
I hope this helps.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Cisco ISE 1.2 and Cisco ACS 5.4 patch 6 and support for snmp version 3

does anyone know if cisco ISE version 1.2 patch 8 and Cisco ACS 5.4 patch 6 support snmp version 3?
ciscoISE/admin(config)# snmp-server ?
community Set community string
contact    Text for mib object sysContact
host       Specify hosts to receive SNMP notifications
location   Text for mib object sysLocation
ciscoISE/admin(config)# snmp-server
Ciscoacs/admin(config)# snmp-server ?
community Set community string
contact    Text for mib object sysContact
host       Specify hosts to receive SNMP notifications
location   Text for mib object sysLocation
Ciscoacs/admin(config)# snmp-server

No support SNMP v3 on ISE v1.2 and 1.3 except for profilling
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/cli_ref_guide/ise_cli/ise_cli_app_a.html#12768
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/cli_ref_guide/b_ise_CLIReferenceGuide/b_ise_CLIReferenceGuide_chapter_0100.html#ID-1364-00000d30

ISE 1.3 and NAC

I have a customer running 5508 WLCs across the estate, and I'm retrofitting IEEE802.1x authentication for the corporate WLAN, and WebAuth for the Guest WLAN...they have PSK at the moment :(
They have AD and are showing great interest in ISE and NAC, so my immediate thoughts are to integrate ISE with AD, and use ISE as the RADIUS server for .1x on the WLC. Then use the WLC and ISE to do WebAuth for Guest...This is all standard stuff, but it gives the background.
Now we get to the interesting bit...they want to run BYOD. They are involved in financial markets, so the BYOD needs to be tightly controlled. They are asking about ISE coupled with NAC, but I'm not convinced I need NAC since the arrival of ISE1.3. Obviously, I will be looking at three (min) SSIDs, namely corporate, guest and BYOD, all logically separate. I don't need anything that ISE 1.2 can't support on corporate and guest, but BYOD needs full profiling and either barring or device remediation before access to the net.
Has anyone got any comments or suggestions? Is ISE 1.3 sufficiently NAC-like that I don't need it any more, or if that's not the case, what additional benefits does it bring that ISE can't support
Thanks for any advice/comments/experiences
Jim

Hi Jim-
Version 1.3 offers a built-in PKI and vastly improved guest services experience. The internal PKI is nice if the customer doesn't have an PKI solution in place. Keep in mind though that the internal ISE PKI can only issue certificates to BYOD devices that were on-boarded via the ISE BYOD "flow" So you cannot use the ISE PKI to issue certs to domain computers.
With regards to NAC: You will have to clarify exactly what is needed here. If you needed to perform "posture assessment" then ISE can do it for Windows and OSX based machines. You can check for things like: A/V, A/S, Firewall Status, Windows Patches, etc. If you want to perform posture on mobile devices then you will need to integrate ISE with an MDM (Mobile Device Management) solution such as: Airwatch, Mobile Iron, Maas360, etc. ISE can query the MDM for things like: Is the device protected with a PIN, is the device rooted, is the device encrypted, etc.
I hope this helps!
Thank you for rating helpful posts!

Ise patch 1 and 2 for 1.1.4 problem with resetting-application

Hi guys,
For your info. ISE patch 1 and 2 got the same problem on 1.1.4. If you got patches installed and tries to reset the application of ISE the monitoring applets are all gone. It's loading an empty page. Solution: rollback any installed patches. Monitoring is back up again. Install the patches again and erverything is fine. Took me one afternoon to figure this out.

Hi Ravi,
Do you know, what is going wrong? I'm wondering if everything is working correctly and if patches are applied correctly.

ISE 1.3 and Windows Posture Web Agent

Hello,
I am running ISE 1.3 and have an issue running the Posture Web Agent. The client authenticates and gets redirected to the client provisioning portal but get the following message
Detecting if Web Agent is installed and running gets ticked and then it keeps rolling at scanning your device. Open Web Agent to check the current status of the system scan and update your system as instructed.
See attached screen shot

is this issue specific to particular groups of clients/OS type... if using Windows 8, Internet Explorer 10 has two modes: Desktop and Metro. In Metro mode, the ActiveX plugins are restricted. You cannot download the Cisco NAC Agent in Metro mode. You must switch to Desktop mode, ensure ActiveX controls are enabled, and then launch Internet Explorer to download the Cisco NAC Agent. (If users are still not able to download Cisco NAC agent, check and enable “compatibility mode.”)

ISE 1.2 and EAP-MD5

Similar Messages

Maybe you are looking for