Local eap-tls drawbacks

Planning on implementing EAP-TLS for wireless security and tryingto wrap my brain around what will be lost if I use local eap-tls vs an external radius server for authentication of the certificates. I thought I saw in some older posts (3+ years) that there is no CRL available when using the controller as built-in radius. I am running on a 3650 as the integrated wlc. If I can tidy up the wireless solution so I dont have to utilize an external radius server (this would be the first necessity to have an external radius server for this org) than it would be nice to keep it simple. I am planning on doing "computer only" auth for some clients and the ability to invalidate their cert would likely push me to the external radius server - I just don't know if there are any other trade-offs by using the built-in radius.
    I also saw that you cant specify a radius server for anything else on the switch or the local built-in radius wont work, but then saw copnflictying info " You can disable RADIUS authentication for a given WLAN by using “config wlan radius_server auth disable wlan_id” CLI command." at this great page http://mrncciew.com/2013/04/21/configuring-local-eap-on-wlc/
but dont know if this is true or not either. I would like to know if I am locking myself into never having an external  radius server If i go down the local eap-tls path.
Thanks,
Brian

Thanks Nicolas, sad but true, I failed to find any possibilites at WLC.
It seems I need to configure external RADIUS and use local EAP only in case of WAN failure.

Similar Messages

  • WLC Local EAP-TLS auth, certificate ACL feature?

    Hi All,
    I implemented local EAP-TLS authentication according to http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080851b42.shtml. All is working fine, clients - Wi-Fi bar code scanners, WLC -2x4402, SV - 7.0.116.0 Certificates generated by Enterprise CA.
    Afterwards, I discovered that certificates cannot be filtered by cname, or user name on WLC. It means that ANY certificate issued by CA will be authenticated against my WLAN. CA issues a whole lot of certificates (RRAS VPNs, WEB clients, etc. ) I want to filter access for my wireless clients using local EAP solution (WLC are at remote location). Can I accomplish it without external RADIUS server? Something like IOS certificate ACL?
    Thanks in advance.

    Thanks Nicolas, sad but true, I failed to find any possibilites at WLC.
    It seems I need to configure external RADIUS and use local EAP only in case of WAN failure.

  • Authentication eap-tls on ACS or local EAP WLC over Lwapp and 7921

    Hi All,
    I install WLC to provide Wlan architecture and the project was extended for VoWLAN. we have 7921 and E51 running over the wide WLAN architecture.
    Computer using Data over wirless are working over PEAP done by ACS and CA signed certificate + user secret on PC is link to the domain account and secret stay the login and password. Our problem is that user and password is link via ACS to Active Directory. The policy of password is to change frequently.
    For the Phone we are actually running authentication over Leap but I'm working to define the best security solution for us.
    I confront PEAP and Eap-TLS for now:
    1) PEAP check the authentication of ACS via certificate trust and authenticate via MS-Chapv2 and the secret password known by user. My problem here is the phone can only be static what is potentially not acceptable
    2) Eap-tls which is the best secured security due to the double side certificate authentication + (login / password) on the phone
    so I need to manage here Certificate Management ? I mean I can use either the MIC CA certificate on the phone or User CA defined one which I can put on ACS or Local EAP WLC and the put the ACS CA trust on the Phone.
    If I understood well I have to put User.cer and ACS_CA.cer on each phone and pout the User_CA on the ACS ?
    I have already Certificate on the ACS signed by CA (like veri-signed) so I must create CSR for any phones to be able to use the same CA ?
    I'm thinking to use also the local Eap certificate of Controller to manage all of that to avoid every potential money to pay to the trust CA of ACS
    can you help me to know if I understood everything good ? I would be please to exchange experience on that
    thanks ;)
    bye

    I am currently using EAP-TLS authentication on my wireless users using ACS 3.2. I have had that problem before. This is what I did...
    Setup a Microsoft Certificate server as my
    CA. You can use same machine wih your ACS and CA.
    Then, generate certificate signing request from ACS then request a server certificate from CA then copy and install a certificate to ACS. On the ACS, go to global authentication setup check the EAP-TLS cetificate. If it failed to respond means that the server certificate is not properly setup.
    On the windows xp clients, connect your machine using wired LAN, then request a certificate from CA(the same CA that you have use to your ACS) using IE (ex. http://CAip/certsrv), but this time request a client certificate. The name you should put when requesting the cert must be you local windows user, use 1024, choose microsoft base cryptographic provider 1.0. then installl the certificate on the client. Verify you client certificate it i was installed properly.
    At that poit you should be able to connect you r wireless client using EAP-TLS.

  • 12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate

    Hi guys,
    I have root CA and intermediate CA in ISE local certificate store trusted for client authentication.
    I have imported both root ca and client certificate in the device I want to authenticate, but ISE keeps spitting out this error :
    12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate

    Refer the link for troubleshooting in page no 22 the issue is mentioned, check it: http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_81_troubleshooting_failed_authc.pdf

  • Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

    In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
    on this computer" and un-checked "Use simple certificate selection".
    My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
    client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
    drop down.
    Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
    TIA,
    -Rick

    Hi Rick,
    Thank you for your patience.
    According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
    know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
    Best regards,
    Steven Song
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • ISE 1.2 EAP-TLS handshake to external RADIUS

    Hi everyone!
    I'm trying to implement ISE to authenticate a wireless network using a cisco WLC 5508, I have an ISE virtual Appliance version 1.2  and a WLC 5508 version 7.6 with several 3602e Access Points (20 aproximately).
    Right now they are authenticating with a RADIUS Server (which I don't manage, it's out of my scope), the WLC uses this RADIUS Server to authenticate using 802.1x and EAP-TLS (which means the clients need to have a valid certificate and be in the RADIUS database which is integrated to the Active Directory), I can't touch the CA either. So now I need to authenticate using Cisco ISE instead of the RADIUS Server (at least directly), the problem is that for "security" reasons or whatever they don't let me integrate the ISE to the CA, so I added the RADIUS server as an external identity source and made my authentication Policy rule pointing at it, like this:
    If: Wireless_802.1X          Allow Protocols: Default Network Access          Use: RADIUS
    Then I added ISE as a RADIUS Server on my WLC and made a Test SSID 802.1X pointing to ISE to authenticate and all that, I did some tests and I got this error:
    12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate
    Which means the clients are trying to do the EAP-TLS Process to validate the certificate with the Cisco ISE (but ISE does not have the certificate because they won't let me integrate to the CA directly) so it fails. Is there any way I can do something to redirect that EAP-TLS handshake to the exernal RADIUS Server? Making ISE kind of like a connecting point only for the authentication, I realize it's not the best scenario but giving the circumstances it's the best I can do for now, later on I will add the AD to ISE and start creating some authorization policies based on that, but right now I just want them to authenticate.
    Any help is appreciated, thanks in advance!

  • ISE 1.2 / WLC 5508 EAP-TLS expired certificate error, but wireless still working

    Hi I have a customer that we've deployed ISE 1.2 and WLC 5508s at.  Customer is using EAP-TLS with and everything appears to setup properly.  Users are able to login to the network and authenticate, however, frequently, I'm getting the following error in ISE authentication logs:
    12516 EAP-TLS failed SSL/TLS handshake because of an expired certificate in the client certificates chain
    OpenSSL messages are:
    SSL alert: code=Ox22D=557 : source=local ; type=fatal : message="X509
    certificate ex pi red"'
    4 727850450.3616:error.140890B2: SS L
    rOYbne s: SSL 3_  G ET _CL IE NT  _CE RT IF ICAT E:no ce rtific ate
    relurned: s3_ srvr.c: 272 0
    I'm not sure if this is cosmetic or if this is something that I should be tracking down.  System isn't in full production yet, but every client seems to be working and there is no expired cert in the chain.  Any ideas what to check?

    Hello Dino,
      thanks very much for your reply.
      The client uses a machine-certificate, the PKI is not a microsoft one, but a third party PKI.   The certificate is fresh and valid, the root-cert is installed and checked to be validated against it for the login.
    Clock is correct too. The same setup works flawlessly in Windows 7 and XP.
    EKU is set on the certificate (1.3.6.1.5.5.7.3.2)
    I suspect the cert-setup itself, but don't get a clue where this might stuck...
    Björn

  • Wireless ISE - 12508 EAP-TLS handshake failed

    Hi guys,
    I'm in the middle of my very first wireless ISE deployment and I'm hitting issues with EAP-TLS based authentication.  In short, all EAP-TLS authentication is failing with the following error.  Below that is the relevant excerpt from the logs:
    Authentication failed : 12508 EAP-TLS handshake failed
    OpenSSLErrorMessage=SSL alert: code=0x233=563 \; source=local \; type=fatal \; message="X509 decrypt error -  certificate signature failure", OpenSSLErrorStack=   597863312:error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown  message digest algorithm:a_verify.c:146:,
    Setup:
    - Single standalone ISE 3355 appliance
    - Two tier MS enterprise PKI (outside of my direct control)
    - WLC 5508
    - Windows 7 laptop\
    - The ISE has both the root and intermediate CA server certificates installed (individually, not chained) and has an identity certificate from the intermediate CA.
    - The test laptop has both the root and intermediate CA server certificates installed  (individually, not chained) and has an identity certificate from the  intermediate CA.
    Now, I'm pretty new to certs so I'm sure I'm missing something simple here.  One thing that has come to mind as I'm writing this is that all of the issued certificates are using SHA1 as the Signature hash algorithm but if I remember correctly ISE defaults to SHA-256 when generating a CSR and I can't remember actually changing that.  Could my issue be as simple as this, or does this hash algorithm only apply to the CSR process?
    This is what TAC came back with, but none of the workarounds helped
    Symptom:
    ========
    EAP-TLS auth handshake  failing with X509 decrypt error. The error presented to the ISE  administrator is "12508: EAP-TLS handshake failed"
    Conditions:
    =========
    EAP-TLS certificate based authentications ISE 1.1.2.145
    Workaround:
    ===========
    1) Reboot or restart ISE  application service 2) Recreate CAP (Certificate Authentication Profile)  3) Toggle between ID sequence and single ID source

    Hi Amjad,
    Thanks for the response.  I realise that SHA256 is highly preferable, however as per my post the PKI is outside of my direct control so that's a whole other conversation.
    Cisco actually recommends avoiding chained certs for ISE, their best practice is that the intermediate and root CA server certificates should be imported into the ISE individually (I don't have a link for this, but it was presented in the Advanced ISE session at Cisco Live this year).  On the client side the identity certificate (machine) shows the full trust chain, so I would assume that there isn't an issue there but I'm happy to be corrected.
    The certificate format has not been modified in any way.  The server and identity certs have been pushed out to the clients via GPO. Tthe root and intermediate certs were exported in DER format directly from each the respective CAs and imported directly in to the ISE
    Cheers,
    Owen

  • EAP-TLS and ACS 5.1 with AD

    Hello,
    I want to set up the ACS 5.1 for dot1x-Port authentication. I want to make a machine authentication against an AD-Domain and I got the following error Message:
    24435  Machine Groups retrieval from Active Directory succeeded
    24100  Some of the expected attributes are not found on the subject record. The default values, if configured, will be used for these attributes.
    24483  Failed to retrieve the machine certificate from Active Directory.
    22049  Binary comparison of certificates failed
    22057  The advanced option that is configured for a failed authentication request is used.
    22061  The 'Reject' advanced option is configured in case of a failed authentication request.
    12507  EAP-TLS authentication failed
    11504  Prepared EAP-Failure
    11003  Returned RADIUS Access-Reject
    What ist the problem? I can't find documents how to configure this in detail.
    Can some one helf me?
    King regardes
    Torsten

    Hi Torsten,
    The option you are looking for is under system configuration:
    Configuring Local Server Certificates
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/admin_config.html#wp1052640
    Under acs-->Users and Identity Stores-->Local certificate-->Edit. You can only import/configure CA certificate:
    Configuring CA Certificates
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1158666
    HTH
    Regards,
    JK
    Plz rate helpful posts-

  • Wired EAP-TLS Problems

    I'm trying to setup wired clients to authenticate with EAP-TLS on a Catalyst 2950, I put together a test setup using the configs on my freeRADIUS server taken from another which is working with EAP-TLS over wireless, the requests are being passed through to the server but the authentication is still failing, could anyone give me some advice? Logs and configs included below......
    My current setup is:
    FreeRADIUS server - Fedora Core 6, freeradius-1.1.3-2.fc6, freeradius-mysql-1.1.3-2.fc6
    Cisco Catalyst 2950 - IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA9, RELEASE SOFTWARE (fc1) - c2950-i6q4l2-mz.121-22.EA9.bin
    Laptop - OpenSUSE 10.2
    I followed the guide to setting up 802.1x auth on the switch from the 2950 docs and from here:
    http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO (although I'm not using Windows, so only the switch config is relevant)
    "select * from nas" (comma seperated to make it easier):
    id,nasname,shortname,type,ports,secret,community,description
    1,10.10.0.9/32,Catalyst,cisco,NULL,<secret>,NULL Catalyst 2950
    wpa_supplicant.conf on laptop:
    ctrl_interface=/var/run/wpa_supplicant
    ctrl_interface_group=wheel
    ap_scan=0
    network={
    key_mgmt=IEEE8021X
    identity="SUSE Laptop"
    eapol_flags=0
    eap=TLS
    ca_cert="/home/evosys/Documents/cacert.pem"
    client_cert="/home/evosys/Documents/suse_cert.pem"
    private_key="/home/evosys/Documents/suse_key.pem"
    private_key_passwd="<password>"
    Outputs of the radiusd and wpa_supplicant are attached...

    Based on this:
    TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain)
    SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA
    I would say that your freeRADIUS server is providing a self-signed cert and the supplicant doesn't trust the signature. The client's ca_cert has to be the same one that signed the freeRADIUS server's cert (or you have to disable certificate verification on the client).
    Shelly

  • Eap-tls configuration assistance

    I am trying to get eap-tls working on my wireless network, with machine authentication. I have followed the numerous configuration guides on CCO but seem to be running around in circles. So can someone please give me a sanity check.
    Scenario
    MS CA (Windows 2008 Server)
    MS DC (Windows 2003 Server)
    ACS 4.2 (Windows 2003 Server)
    WLC 4402 (5.2)
    LWAP AIR-LAP1142N-N-K9
    Client MS XP SP3
    I have confirmed that the certficates are valid on both the ACS and client.
    The problem I have is, I see the client associate, but fails authentication. I look in the ACS failed log attempts, I see:
    13/07/2009 11:19:17 Authen failed host/e26458.internal.company Default Group 00-12-F0-82-77-2D (Default) External user not found .. .. 1 10.10.10.100 .. .. 13 EAP-TLS .. TWLC01 CITY
    I have configured ACS for Unkown User Policy and have the client e26458 in AD.
    I would like some advice from some people who have successfuly implemented EAP-TLS, as I have hit a brick wall. I have attached the results of the debug aaa events enable,debug aaa detail enable,
    debug dot1x events enable,debug dot1x states enable on the WLC.
    frustratingly yours

    I am unable to open the attachment, anyway let me tell you few things which you should conform while using certificates.
    1. Both your client and server certificates should be from same authority
    2. You should have the same username in which the certificate issued should be in your ACS database.
    3. Conform the validity of both your CA and device certificate
    Just to conform this is not an issue with your ACS server you can install the cert in your controller and try to authenticate the client using local auth.If this works then your certs are perfect and verify your ACS configurations

  • ACS 5.2 / WLC - EAP-TLS Certificate from 2 CA

    Hello,
    I'm Newbie with ACS equipment, i'm trying to implement it to secure our WIFI environment.
    One wifi SSID is broadcasted on a site, I would like to authenticate WIFI client through machine certificate.
    The big deal is that some client computer belong to an AD (AD1) and having its own CA1. Other client computer belong to another AD (AD2) also having its own CA (CA2). (With no relation or between the 2 CA)
    So computer1 having machine certificate from CA1 and computer2 having machine certificate from CA2
    I have imported the root certificate from the both CA into the "certificate authorities" store of the ACS.
    I have generated certificate signing request, one for each CA. Then I have binding the CA signed certificate.
    After configuring... the access services (identity, authorization...) and so on  I have the following issue:
    - Computer with certificate from the CA1 can connect without any problem.
    - Computer with certificate from the CA2 can NOT connect:
         - After investigation: the client computer do not trust the server ACS and reject the connection
         - Error return :
    RADIUS Status:Authentication failed 11514 Unexpectedly received empty TLS message; treating as a rejection by the client
         - (If i get ridd of the option "verify server identity" on wifi optionof the client, the computer can conect: but this option is not acceptable)
         - It seems that the ACS sends only its certificate signed by the CA1
    The questions are:
    1- How can I configure the ACS to send the right certificate signed by the right CA corresponding to the computer that is intenting to authenticate
    2- I could see in documentation:
        "For TLS related EAP protocols, a single local certificate is used to authenticate the server for all the TLS related protocol"
         --> Does it mean that we can only configure one local certificate to allow the ACS to authenticate to client for all the EAP-TLS protocol used ?
         --> How can I choose it ?
         --> For the current configuration, I have only the certificate signed by the CA which is configure "EAP: Used for EAP protocols that use SSL/TLS tunneling" (i don't know if this option has an impact with the certificate presented by the ACS when it authenticate itself to the client")
    Thanks for your helk and your information.
    Guillaume

    Hi Bastien,
    it is actually what i did.
    The point here i have 2 CA involved, with no relation between them.
    So I did the operation twice for each CA :
    -> making a certificate signing request, sent it to the CA, signed to by the CA and then imported/binded into the ACS
    -> I have added the root CA of each CA into the ACS as well.
    The point is when a computer, try to connect, it try to verify ACS server identity. And the ACS server only seems to present the certificate signed from CA1.
    So when a computer with certificate machine CA2, try to connect, it doesn't trust the ACS server has the ACS sent its certificate signed by CA1.
    I don't know how to allow the ACS to present the right signed certificated depending on the cleint that try to connect.
    Then another conf I do not understand is the option:
    EAP: Used for EAP protocols that use SSL/TLS tunneling --> in local cetificate, when you add a local certificate to the ACS
    I do not undestand what does this option stand for ?
    Then I culd see into Cisco do :
        "For TLS related EAP protocols, a single local certificate is used to authenticate the server for all the TLS related protocol"
    Doest it means that the ACS can use only one single certificate for All the TLS protocol configured in the ACS, to authenticate itself to the client?
    Or does the ACS can use a diferent local certificate from each dedicated eap-tls protocol?
    thx

  • EAP-TLS and MS AD auth problem

    Hi,
    I have a problem with an ACS to authenticate users with certificate on MS AD.
    Working things:
    PEAP authentication with the MS AD;
    EAP-TLS authentication with the local DB.
    Not working things:
    EAP-TLS authentication with MS AD.
    Because I'm able to auth users with PEAP on MS AD, I guess my config on MS AD is correct.
    Because I'm able to auth users with certif in EAP-TLS, I guess my certif config is correct.
    So, why it's not working with the combination EAP-TLS and MS AD.
    I receive the error 'External DB Account Restriction'
    Thanks for your help.

    This issue is generally seens when there are multiple domains. Try out this step. Choose Network Connections from the control panel. Right-click the local area connection.Choose Properties. Double-click the TCP/IP option. Choose Advanced at the bottom. Click on DNS at the top. Choose Append these DNS suffixes. Add the FQDN for each domain that ACS authenticates against in the field.

  • IEEE 802.1x with EAP-TLS issue in cisco 2960

    In My Cisco 2960 switch is not working with EAP-TLS mechanism of 802.1x but its works well with other  protocols like EAP-PEAP or MAC Address authentication.
    Below is the configuration
    aaa authentication login default group tacacs+ local
    aaa authentication enable default group tacacs+ enable
    aaa authentication dot1x default group radius
    aaa authorization commands 15 default group tacacs+ local
    aaa authorization network default group radius
    aaa authorization configuration default group radius
    aaa accounting update periodic 30
    aaa accounting dot1x default start-stop group radius
    aaa accounting exec default start-stop group tacacs+
    aaa accounting commands 0 default start-stop group tacacs+
    aaa accounting commands 15 default start-stop group tacacs+
    aaa accounting network default start-stop group tacacs+
    aaa accounting connection default start-stop group tacacs+
    aaa accounting system default start-stop group tacacs+
    interface FastEthernet0/1
    switchport access vlan 11
    switchport mode access
    speed 100
    duplex full
    authentication order dot1x mab webauth
    authentication port-control auto
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 3
    dot1x timeout supp-timeout 3
    spanning-tree portfast
    spanning-tree bpduguard enable
    Can anyone suggest me ?

    Thanks for the reply jatin.
    I have a client on the interface fa0/1 with a valid client certificate. And have a debug logs as below
    *Mar  8 00:03:06.266: dot1x-ev(Fa0/1): Interface state changed to UP
    *Mar  8 00:03:06.266: AAA/BIND(000001C7): Bind i/f 
    *Mar  8 00:03:06.266:     dot1x_auth Fa0/1: initial state auth_initialize has enter
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): 0xB0000DBA:auth_initialize_enter called
    *Mar  8 00:03:06.266:     dot1x_auth Fa0/1: during state auth_initialize, got event 0(cfg_auto)
    *Mar  8 00:03:06.266: @@@ dot1x_auth Fa0/1: auth_initialize -> auth_disconnected
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): 0xB0000DBA:auth_disconnected_enter called
    *Mar  8 00:03:06.266:     dot1x_auth Fa0/1: idle during state auth_disconnected
    *Mar  8 00:03:06.266: @@@ dot1x_auth Fa0/1: auth_disconnected -> auth_restart
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): 0xB0000DBA:auth_restart_enter called
    *Mar  8 00:03:06.266: dot1x-ev(Fa0/1): Sending create new context event to EAP for 0xB0000DBA (0000.0000.0000)
    *Mar  8 00:03:06.266:     dot1x_auth_bend Fa0/1: initial state auth_bend_initialize has enter
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_initialize_enter called
    *Mar  8 00:03:06.266:     dot1x_auth_bend Fa0/1: initial state auth_bend_initialize has idle
    *Mar  8 00:03:06.266:     dot1x_auth_bend Fa0/1: during state auth_bend_initialize, got event 16383(idle)
    *Mar  8 00:03:06.266: @@@ dot1x_auth_bend Fa0/1: auth_bend_initialize -> auth_bend_idle
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_idle_enter called
    *Mar  8 00:03:06.266: dot1x-ev(Fa0/1): Created a client entry (0xB0000DBA)
    *Mar  8 00:03:06.266: dot1x-ev(Fa0/1): Dot1x authentication started for 0xB0000DBA (0000.0000.0000)
    *Mar  8 00:03:06.266: dot1x-ev:DOT1X Supplicant not enabled on FastEthernet0/1
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): Posting !EAP_RESTART on Client 0xB0000DBA
    *Mar  8 00:03:06.266:     dot1x_auth Fa0/1: during state auth_restart, got event 6(no_eapRestart)
    *Mar  8 00:03:06.266: @@@ dot1x_auth Fa0/1: auth_restart -> auth_connecting
    *Mar  8 00:03:06.266: dot1x-sm(Fa0/1): 0xB0000DBA:auth_connecting_enter called
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): 0xB0000DBA:auth_restart_connecting_action called
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): Posting RX_REQ on Client 0xB0000DBA
    *Mar  8 00:03:06.274:     dot1x_auth Fa0/1: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    *Mar  8 00:03:06.274: @@@ dot1x_auth Fa0/1: auth_connecting -> auth_authenticating
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): 0xB0000DBA:auth_authenticating_enter called
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): 0xB0000DBA:auth_connecting_authenticating_action called
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): Posting AUTH_START for 0xB0000DBA
    *Mar  8 00:03:06.274:     dot1x_auth_bend Fa0/1: during state auth_bend_idle, got event 4(eapReq_authStart)
    *Mar  8 00:03:06.274: @@@ dot1x_auth_bend Fa0/1: auth_bend_idle -> auth_bend_request
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_enter called
    *Mar  8 00:03:06.274: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:06.274: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:06.274: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:06.274: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:06.274: EAPOL pak dump Tx
    *Mar  8 00:03:06.274: EAPOL Version: 0x3  type: 0x0  length: 0x0005
    *Mar  8 00:03:06.274: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1
    *Mar  8 00:03:06.274: dot1x-packet(Fa0/1): EAPOL packet sent to client 0xB0000DBA (0000.0000.0000)
    *Mar  8 00:03:06.274: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_idle_request_action called
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:06.794: dot1x-packet(Fa0/1): queuing an EAPOL pkt on Auth Q
    *Mar  8 00:03:06.794: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    *Mar  8 00:03:06.794: EAPOL pak dump rx
    *Mar  8 00:03:06.794: EAPOL Version: 0x1  type: 0x1  length: 0x0000
    *Mar  8 00:03:06.794: dot1x-ev:
    dot1x_auth_queue_event: Int Fa0/1 CODE= 0,TYPE= 0,LEN= 0
    *Mar  8 00:03:06.794: dot1x-packet(Fa0/1): Received an EAPOL frame
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): Received pkt saddr =d43d.7e65.4fc1 , daddr = 0180.c200.0003,
        pae-ether-type = 888e.0101.0000
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): Couldn't find the supplicant in the list
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): New client detected, notifying AuthMgr
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): Sending event (0) to Auth Mgr for d43d.7e65.4fc1
    *Mar  8 00:03:06.794: dot1x-packet(Fa0/1): Received an EAPOL-Start packet
    *Mar  8 00:03:06.794: EAPOL pak dump rx
    *Mar  8 00:03:06.794: EAPOL Version: 0x1  type: 0x1  length: 0x0000
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): Posting EAPOL_START on Client 0xB0000DBA
    *Mar  8 00:03:06.794:     dot1x_auth Fa0/1: during state auth_authenticating, got event 4(eapolStart)
    *Mar  8 00:03:06.794: @@@ dot1x_auth Fa0/1: auth_authenticating -> auth_aborting
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): 0xB0000DBA:auth_authenticating_exit called
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): 0xB0000DBA:auth_aborting_enter called
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): 802.1x method gets the go ahead from Auth Mgr for 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.794: %AUTHMGR-5-START: Starting 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EE240F5BAB
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): Posting AUTH_ABORT for 0xB0000DBA
    *Mar  8 00:03:06.794:     dot1x_auth_bend Fa0/1: during state auth_bend_request, got event 1(authAbort)
    *Mar  8 00:03:06.794: @@@ dot1x_auth_bend Fa0/1: auth_bend_request -> auth_bend_initialize
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_initialize_enter called
    *Mar  8 00:03:06.794:     dot1x_auth_bend Fa0/1: idle during state auth_bend_initialize
    *Mar  8 00:03:06.794: @@@ dot1x_auth_bend Fa0/1: auth_bend_initialize -> auth_bend_idle
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_idle_enter called
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): Posting !AUTH_ABORT on Client 0xB0000DBA
    *Mar  8 00:03:06.794:     dot1x_auth Fa0/1: during state auth_aborting, got event 20(no_eapolLogoff_no_authAbort)
    *Mar  8 00:03:06.794: @@@ dot1x_auth Fa0/1: auth_aborting -> auth_restart
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): 0xB0000DBA:auth_aborting_exit called
    *Mar  8 00:03:06.794: dot1x-sm(Fa0/1): 0xB0000DBA:auth_restart_enter called
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): Resetting the client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.794: dot1x-ev(Fa0/1): Sending create new context event to EAP for 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.802: dot1x-sm(Fa0/1): 0xB0000DBA:auth_aborting_restart_action called
    *Mar  8 00:03:06.802: dot1x-sm(Fa0/1): Posting !EAP_RESTART on Client 0xB0000DBA
    *Mar  8 00:03:06.802:     dot1x_auth Fa0/1: during state auth_restart, got event 6(no_eapRestart)
    *Mar  8 00:03:06.802: @@@ dot1x_auth Fa0/1: auth_restart -> auth_connecting
    *Mar  8 00:03:06.802: dot1x-sm(Fa0/1): 0xB0000DBA:auth_connecting_enter called
    *Mar  8 00:03:06.802: dot1x-sm(Fa0/1): 0xB0000DBA:auth_restart_connecting_action called
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): Posting RX_REQ on Client 0xB0000DBA
    *Mar  8 00:03:06.811:     dot1x_auth Fa0/1: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    *Mar  8 00:03:06.811: @@@ dot1x_auth Fa0/1: auth_connecting -> auth_authenticating
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): 0xB0000DBA:auth_authenticating_enter called
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): 0xB0000DBA:auth_connecting_authenticating_action called
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): Posting AUTH_START for 0xB0000DBA
    *Mar  8 00:03:06.811:     dot1x_auth_bend Fa0/1: during state auth_bend_idle, got event 4(eapReq_authStart)
    *Mar  8 00:03:06.811: @@@ dot1x_auth_bend Fa0/1: auth_bend_idle -> auth_bend_request
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_enter called
    *Mar  8 00:03:06.811: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:06.811: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:06.811: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:06.811: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:06.811: EAPOL pak dump Tx
    *Mar  8 00:03:06.811: EAPOL Version: 0x3  type: 0x0  length: 0x0005
    *Mar  8 00:03:06.811: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1
    *Mar  8 00:03:06.811: dot1x-packet(Fa0/1): EAPOL packet sent to client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_idle_request_action called
    *Mar  8 00:03:06.811: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:06.811: dot1x-packet(Fa0/1): Queuing an EAPOL pkt on Authenticator Q
    *Mar  8 00:03:06.811: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    *Mar  8 00:03:06.811: EAPOL pak dump rx
    *Mar  8 00:03:06.811: EAPOL Version: 0x1  type: 0x0  length: 0x0022
    *Mar  8 00:03:06.811: dot1x-ev:
    dot1x_auth_queue_event: Int Fa0/1 CODE= 2,TYPE= 1,LEN= 34
    *Mar  8 00:03:06.811: dot1x-packet(Fa0/1): Received an EAPOL frame
    *Mar  8 00:03:06.811: dot1x-ev(Fa0/1): Received pkt saddr =d43d.7e65.4fc1 , daddr = 0180.c200.0003,
        pae-ether-type = 888e.0100.0022
    *Mar  8 00:03:06.811: dot1x-packet(Fa0/1): Received an EAP packet
    *Mar  8 00:03:06.811: EAPOL pak dump rx
    *Mar  8 00:03:06.811: EAPOL Version: 0x1  type: 0x0  length: 0x0022
    *Mar  8 00:03:06.811: dot1x-packet(Fa0/1): Received an EAP packet from d43d.7e65.4fc1
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): Posting EAPOL_EAP for 0xB0000DBA
    *Mar  8 00:03:06.811:     dot1x_auth_bend Fa0/1: during state auth_bend_request, got event 6(eapolEap)
    *Mar  8 00:03:06.811: @@@ dot1x_auth_bend Fa0/1: auth_bend_request -> auth_bend_response
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_enter called
    *Mar  8 00:03:06.811: dot1x-ev(Fa0/1): dot1x_sendRespToServer: Response sent to the server from 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.811: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_response_action called
    *Mar  8 00:03:06.811: AAA/AUTHEN/8021X (000001C7): Pick method list 'default'
    *Mar  8 00:03:06.819: RADIUS/ENCODE(000001C7):Orig. component type = DOT1X
    *Mar  8 00:03:06.819: RADIUS(000001C7): Config NAS IP: 0.0.0.0
    *Mar  8 00:03:06.819: RADIUS/ENCODE(000001C7): acct_session_id: 724
    *Mar  8 00:03:06.819: RADIUS(000001C7): sending
    *Mar  8 00:03:06.819: RADIUS/ENCODE: Best Local IP-Address 10.26.237.11 for Radius-Server 10.26.13.59
    *Mar  8 00:03:06.819: RADIUS(000001C7): Send Access-Request to 10.26.13.59:1812 id 1645/83, len 251
    *Mar  8 00:03:06.819: RADIUS:  authenticator A1 79 FA E5 F4 B7 7F 4F - 2B 73 3A 0D 1F D8 89 20
    *Mar  8 00:03:06.819: RADIUS:  User-Name           [1]   31  "host/D0902MALL005.IN.intranet"
    *Mar  8 00:03:06.819: RADIUS:  Service-Type        [6]   6   Framed                    [2]
    *Mar  8 00:03:06.819: RADIUS:  Framed-MTU          [12]  6   1500                     
    *Mar  8 00:03:06.819: RADIUS:  Called-Station-Id   [30]  19  "D4-A0-2A-EE-14-81"
    *Mar  8 00:03:06.819: RADIUS:  Calling-Station-Id  [31]  19  "D4-3D-7E-65-4F-C1"
    *Mar  8 00:03:06.819: RADIUS:  EAP-Message         [79]  36 
    *Mar  8 00:03:06.819: RADIUS:   02 01 00 22 01 68 6F 73 74 2F 44 30 39 30 32 4D 41 4C 4C 30  ["host/D0902MALL0]
    *Mar  8 00:03:06.819: RADIUS:   30 35 2E 49 4E 2E 69 6E 74 72 61 6E 65 74    [ 05.IN.intranet]
    *Mar  8 00:03:06.819: RADIUS:  Message-Authenticato[80]  18 
    *Mar  8 00:03:06.819: RADIUS:   D6 6F 7B CD 36 46 5E F6 90 6F 85 A8 BD BD AE D8            [ o{6F^o]
    *Mar  8 00:03:06.819: RADIUS:  EAP-Key-Name        [102] 2   *
    *Mar  8 00:03:06.819: RADIUS:  Vendor, Cisco       [26]  49 
    *Mar  8 00:03:06.819: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0A1AED0B000000EE240F5BAB"
    *Mar  8 00:03:06.819: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    *Mar  8 00:03:06.819: RADIUS:  NAS-Port            [5]   6   50001                    
    *Mar  8 00:03:06.819: RADIUS:  NAS-Port-Id         [87]  17  "FastEthernet0/1"
    *Mar  8 00:03:06.819: RADIUS:  NAS-IP-Address      [4]   6   10.26.237.11             
    *Mar  8 00:03:06.819: RADIUS:  Acct-Session-Id     [44]  10  "000002D4"
    *Mar  8 00:03:06.819: RADIUS(000001C7): Started 3 sec timeout
    *Mar  8 00:03:06.861: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
    *Mar  8 00:03:06.903: RADIUS: Received from id 1645/83 10.26.13.59:1812, Access-Challenge, len 76
    *Mar  8 00:03:06.903: RADIUS:  authenticator 7B 1C DC CA A8 92 E9 34 - 17 86 25 2F 9D 7E 63 96
    *Mar  8 00:03:06.903: RADIUS:  EAP-Message         [79]  8  
    *Mar  8 00:03:06.903: RADIUS:   01 02 00 06 0D 20                 [  ]
    *Mar  8 00:03:06.903: RADIUS:  Message-Authenticato[80]  18 
    *Mar  8 00:03:06.903: RADIUS:   DD F3 7B 33 37 6D 40 BD F3 D2 78 DF F1 14 4D E4           [ {37m@xM]
    *Mar  8 00:03:06.903: RADIUS:  State               [24]  30 
    *Mar  8 00:03:06.903: RADIUS:   00 7D 00 9B 00 C1 00 40 ED B8 45 00 FC DD 50 2E DC 0E E6 03 FC 7B AD 4C B7 E7 B1 70          [ }@EP.{Lp]
    *Mar  8 00:03:06.911: RADIUS(000001C7): Received from id 1645/83
    *Mar  8 00:03:06.911: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes
    *Mar  8 00:03:06.911: dot1x-sm(Fa0/1): Posting EAP_REQ for 0xB0000DBA
    *Mar  8 00:03:06.911:     dot1x_auth_bend Fa0/1: during state auth_bend_response, got event 7(eapReq)
    *Mar  8 00:03:06.911: @@@ dot1x_auth_bend Fa0/1: auth_bend_response -> auth_bend_request
    *Mar  8 00:03:06.911: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_exit called
    *Mar  8 00:03:06.911: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_enter called
    *Mar  8 00:03:06.911: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:06.911: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:06.911: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:06.911: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:06.911: EAPOL pak dump Tx
    *Mar  8 00:03:06.911: EAPOL Version: 0x3  type: 0x0  length: 0x0006
    *Mar  8 00:03:06.911: EAP code: 0x1  id: 0x2  length: 0x0006 type: 0xD
    *Mar  8 00:03:06.911: dot1x-packet(Fa0/1): EAPOL packet sent to client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.911: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_request_action called
    *Mar  8 00:03:06.920: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:06.920: dot1x-packet(Fa0/1): Queuing an EAPOL pkt on Authenticator Q
    *Mar  8 00:03:06.920: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    *Mar  8 00:03:06.920: EAPOL pak dump rx
    *Mar  8 00:03:06.920: EAPOL Version: 0x1  type: 0x0  length: 0x0069
    *Mar  8 00:03:06.920: dot1x-ev:
    dot1x_auth_queue_event: Int Fa0/1 CODE= 2,TYPE= 13,LEN= 105
    *Mar  8 00:03:06.920: dot1x-packet(Fa0/1): Received an EAPOL frame
    *Mar  8 00:03:06.920: dot1x-ev(Fa0/1): Received pkt saddr =d43d.7e65.4fc1 , daddr = 0180.c200.0003,
        pae-ether-type = 888e.0100.0069
    *Mar  8 00:03:06.920: dot1x-packet(Fa0/1): Received an EAP packet
    *Mar  8 00:03:06.920: EAPOL pak dump rx
    *Mar  8 00:03:06.920: EAPOL Version: 0x1  type: 0x0  length: 0x0069
    *Mar  8 00:03:06.920: dot1x-packet(Fa0/1): Received an EAP packet from d43d.7e65.4fc1
    *Mar  8 00:03:06.920: dot1x-sm(Fa0/1): Posting EAPOL_EAP for 0xB0000DBA
    *Mar  8 00:03:06.920:     dot1x_auth_bend Fa0/1: during state auth_bend_request, got event 6(eapolEap)
    *Mar  8 00:03:06.920: @@@ dot1x_auth_bend Fa0/1: auth_bend_request -> auth_bend_response
    *Mar  8 00:03:06.920: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_enter called
    *Mar  8 00:03:06.920: dot1x-ev(Fa0/1): dot1x_sendRespToServer: Response sent to the server from 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:06.920: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_response_action called
    *Mar  8 00:03:06.920: AAA/AUTHEN/8021X (000001C7): Pick method list 'default'
    *Mar  8 00:03:06.920: RADIUS/ENCODE(000001C7):Orig. component type = DOT1X
    *Mar  8 00:03:06.920: RADIUS(000001C7): Config NAS IP: 0.0.0.0
    *Mar  8 00:03:06.920: RADIUS/ENCODE(000001C7): acct_session_id: 724
    *Mar  8 00:03:06.920: RADIUS(000001C7): sending
    *Mar  8 00:03:06.920: RADIUS/ENCODE: Best Local IP-Address 10.26.237.11 for Radius-Server 10.26.13.59
    *Mar  8 00:03:06.920: RADIUS(000001C7): Send Access-Request to 10.26.13.59:1812 id 1645/84, len 352
    *Mar  8 00:03:06.920: RADIUS:  authenticator 41 72 8D 6A B4 72 19 84 - 1B C8 33 F7 95 DD 07 BC
    *Mar  8 00:03:06.928: RADIUS:  User-Name           [1]   31  "host/D0902MALL005.IN.intranet"
    *Mar  8 00:03:06.928: RADIUS:  Service-Type        [6]   6   Framed                    [2]
    *Mar  8 00:03:06.928: RADIUS:  Framed-MTU          [12]  6   1500                     
    *Mar  8 00:03:06.928: RADIUS:  Called-Station-Id   [30]  19  "D4-A0-2A-EE-14-81"
    *Mar  8 00:03:06.928: RADIUS:  Calling-Station-Id  [31]  19  "D4-3D-7E-65-4F-C1"
    *Mar  8 00:03:06.928: RADIUS:  EAP-Message         [79]  107
    *Mar  8 00:03:06.928: RADIUS:   02 02 00 69 0D 80 00 00 00 5F 16 03 01 00 5A 01 00 00 56 03 01 52 C5 45 4F 07 CA B3 29 50 A7 CE 40 76 B6 BD F0 50 D4 CE 9A 8A 02 C4 3D 40 35 B5 F0 E1 E2 75  [i_ZVREO)P@vP=@5u]
    *Mar  8 00:03:06.928: RADIUS:   50 00 00 18 00 2F 00 35 00 05 00 0A C0 13 C0 14 C0 09 C0 0A 00 32 00 38 00 13 00 04 01 00 00 15 FF 01 00 01 00 00 0A 00 06 00 04 00 17 00 18 00 0B 00 02 01 00             [ P/528]
    *Mar  8 00:03:06.928: RADIUS:  Message-Authenticato[80]  18 
    *Mar  8 00:03:06.928: RADIUS:   A3 28 CE 27 20 C0 D6 2C 11 01 D6 61 1F C3 6F 03            [ (' ,ao]
    *Mar  8 00:03:06.928: RADIUS:  EAP-Key-Name        [102] 2   *
    *Mar  8 00:03:06.928: RADIUS:  Vendor, Cisco       [26]  49 
    *Mar  8 00:03:06.928: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0A1AED0B000000EE240F5BAB"
    *Mar  8 00:03:06.928: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    *Mar  8 00:03:06.928: RADIUS:  NAS-Port            [5]   6   50001                    
    *Mar  8 00:03:06.928: RADIUS:  NAS-Port-Id         [87]  17  "FastEthernet0/1"
    *Mar  8 00:03:06.928: RADIUS:  State               [24]  30 
    *Mar  8 00:03:06.928: RADIUS:   00 7D 00 9B 00 C1 00 40 ED B8 45 00 FC DD 50 2E DC 0E E6 03 FC 7B AD 4C B7 E7 B1 70          [ }@EP.{Lp]
    *Mar  8 00:03:06.928: RADIUS:  NAS-IP-Address      [4]   6   10.26.237.11             
    *Mar  8 00:03:06.928: RADIUS:  Acct-Session-Id     [44]  10  "000002D4"
    *Mar  8 00:03:06.928: RADIUS(000001C7): Started 3 sec timeout
    *Mar  8 00:03:07.004: RADIUS: Received from id 1645/84 10.26.13.59:1812, Access-Challenge, len 1188
    *Mar  8 00:03:07.004: RADIUS:  authenticator 7B 52 29 05 7E C3 EF 8E - 13 38 30 03 4B 65 64 0F
    *Mar  8 00:03:07.004: RADIUS:  EAP-Message         [79]  255
    *Mar  8 00:03:07.004: RADIUS:   01 03 04 56 0D C0 00 00 05 78 16 03 01 00 51 02 00 00 4D 03 01 52 C5 45 4F 0F 04 37 77 A0 C2 68 66 4E 45 92 AB 3D 7F 94 70 AF 36  [VxQMREO7whfNE=p6]
    *Mar  8 00:03:07.004: RADIUS:   1D C5 17 23 5C F1 FA CA 60 B0 20 A5 48 16 D5 3F F9 B0 FF 38 1D D5 13 B3 88 13 06 EF DC 87 5C AE 17 E7 7E 80 84 21 58 64 F7 A6 36 00 35 00 00 05 FF 01 00 01 00 16 03 01 02 1C 0B 00 02 18 00 02 15 00 02 12 30 82 02 0E 30  [#\` H?8\~!Xd6500]
    *Mar  8 00:03:07.004: RADIUS:   82 01 77 A0 03 02 01 02 02 09 00 88 7A CB 35 3F 1E 3E 62 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 2F 31 15 30 13 06 03 55 04 03 13 0C 53 50  [wz5?>b0*H0/10USP]
    *Mar  8 00:03:07.004: RADIUS:   49 4E 41 56 44 30 30 30 30 34 31 16 30 14 06 03 55 04 0A 13 0D 50 6F 6C  [INAVD0000410UPol]
    *Mar  8 00:03:07.004: RADIUS:   69 63 79 4D 61 6E 61 67 65 72 30 1E 17 0D 31 33 30 38 32  [icyManager013082]
    *Mar  8 00:03:07.004: RADIUS:   37 30 37 32 34 33 30 5A 17 0D 31 34 30 38 32 37 30 37  [7072430Z14082707]
    *Mar  8 00:03:07.004: RADIUS:   32 34 33 30 5A 30 2F 31 15 30 13 06 03 55 04 03 13 0C 53 50 49 4E 41 56  [2430Z0/10USPINAV]
    *Mar  8 00:03:07.004: RADIUS:   44 30 30               [ D00]
    *Mar  8 00:03:07.004: RADIUS:  EAP-Message         [79]  255
    *Mar  8 00:03:07.004: RADIUS:   30 30 34 31 16 30 14 06 03 55 04 0A 13 0D 50 6F 6C 69 63 79 4D 61 6E 61  [00410UPolicyMana]
    *Mar  8 00:03:07.004: RADIUS:   67 65 72 30 81 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 81 8D 00 30 81 89 02 81 81 00 C9 B9 03 65 83 EB 39 86 14 BC 95 7B DB 07 7E C5 8A D7 DA C7 8A CA 5A 88 6E 0B 93 06 35 57  [ger00*H0e9{~Zn5W]
    *Mar  8 00:03:07.012: RADIUS:   6E DE 93 CD C9 FE 8E 9F E1 5F A9 04 5C BD A9 AD 5A 04 6E 35 47 76 A1 58 E5 C4 32 D7 49 9E 17 75 20 C6 6F 45 40  [n_\Zn5GvX2Iu oE@]
    *Mar  8 00:03:07.012: RADIUS:   AC EF 40 6D 15 38 F9 C2 28 7E C9 68 37 52 3B BF F4 C1 5E B8 BA 46 68 43 79 B1 65 66  [@m8(~h7R;^FhCyef]
    *Mar  8 00:03:07.012: RADIUS:   9E 58 ED EC 8C 95 A2 D8 BF AA 77 AC 85 90 E3 AB C6 27 3A A2 22 AC 1C 48 B3 BF BE F7 85 CF 5C BB 2D 02 03 01 00 01 A3 32 30 30 30 0F 06 03 55 1D 11 04 08 30 06 87 04 0A 1A 0D 3B 30  [Xw':"H\-2000U0;0]
    *Mar  8 00:03:07.012: RADIUS:   1D 06 03 55 1D 25 04 16 30 14 06 08 2B 06 01 05 05 07 03 01 06 08 2B 06 01 05 05 07 03 03 30 0D 06 09 2A 86 48 86 F7 0D 01 01          [ U?0++0*H]
    *Mar  8 00:03:07.012: RADIUS:  EAP-Message         [79]  255
    *Mar  8 00:03:07.012: RADIUS:   05 05 00 03 81 81 00 C4 46 3E 38 3D 53 0F 28 34 C1 A6 ED DC 70 76 9B 70 6B A8 95 7C 44 8E 7D 6E D6 8B 6D  [F>8=S(4pvpk|D}nm]
    *Mar  8 00:03:07.012: RADIUS:   90 49 83 06 E4 BF 68 2F 9D 77 78 A3 76 76 19 84 AD 26 3F F3 ED AA 88 52 35 0E 35 DD 00 E5 96 88 44 30 79 A0 71  [Ih/wxvv&?R55D0yq]
    *Mar  8 00:03:07.012: RADIUS:   8D 25 3E 77 A0 E0 43 92 33 55 40 E1 C8 EE 88 11 25 E2 70 28 11 6C 5A 4E 3D F1 93 57 0A 6F  [?>wC3U@?p(lZN=Wo]
    *Mar  8 00:03:07.012: RADIUS:   36 51 72 04 08 C0 C0 DF F0 94 A9 F7 A1 05 C8 37 D6 F8 D4 9C 20 1A 7B CD 2C 17 83 7B 8E 20 F7 2D B6 16 03 01 02 FC 0D 00 02 F4 03 01 02 40 02 EE 00 63 30 61 31 0B 30  [6Qr7 {,{ -@c0a10]
    *Mar  8 00:03:07.012: RADIUS:   09 06 03 55 04 06 13 02 55 53 31 15 30 13 06 03 55 04 0A 13 0C 44 69 67 69 43 65 72 74 20 49  [UUS10UDigiCert I]
    *Mar  8 00:03:07.012: RADIUS:   6E 63 31 19 30 17 06 03 55 04 0B 13 10 77 77 77 2E 64 69 67 69 63 65 72  [nc10Uwww.digicer]
    *Mar  8 00:03:07.012: RADIUS:   74 2E 63 6F 6D 31 20 30 1E 06 03 55 04 03 13 17 44 69 67 69 43 65 72  [t.com1 0UDigiCer]
    *Mar  8 00:03:07.012: RADIUS:   74 20 47 6C 6F 62 61 6C 20 52 6F 6F 74 20 43 41  [t Global Root CA]
    *Mar  8 00:03:07.012: RADIUS:   00 48                 [ H]
    *Mar  8 00:03:07.012: RADIUS:  EAP-Message         [79]  255
    *Mar  8 00:03:07.012: RADIUS:   30 46 31 18 30 16 06 0A 09 92 26 89 93 F2 2C 64 01 19 16 08 69 6E 74 72 61 6E 65 74 31  [0F10&,dintranet1]
    *Mar  8 00:03:07.020: RADIUS:   12 30 10 06 0A 09 92 26 89 93 F2 2C 64 01 19 16 02 49 4E 31 16 30 14 06 03 55 04 03 13 0D 49 6E 64 69 61 20 52  [0&,dIN10UIndia R]
    *Mar  8 00:03:07.020: RADIUS:   6F 6F 74 20 43 41 00 4A 30 48 31 18 30 16 06 0A 09 92 26 89 93 F2 2C 64 01 19 16 08 69 6E  [oot CAJ0H10&,din]
    *Mar  8 00:03:07.020: RADIUS:   74 72 61 6E 65 74 31 12 30 10 06 0A 09 92 26 89 93 F2 2C 64 01 19 16 02 49 4E 31 18 30 16 06 03 55  [tranet10&,dIN10U]
    *Mar  8 00:03:07.020: RADIUS:   04 03 13 0F 45 6E 74 65 72 70 72 69 73 65 20 43 41 2D 31 00 4D  [Enterprise CA-1M]
    *Mar  8 00:03:07.020: RADIUS:   30 4B 31 18 30 16 06 0A 09 92 26 89 93 F2 2C 64 01 19 16 08 69 6E 74 72 61 6E 65 74 31  [0K10&,dintranet1]
    *Mar  8 00:03:07.020: RADIUS:   12 30 10 06 0A 09 92 26 89 93 F2 2C 64 01 19 16 02 49 4E 31 1B 30 19 06 03 55 04 03 13 12 49 4E 2D 53 50 49 4E  [0&,dIN10UIN-SPIN]
    *Mar  8 00:03:07.020: RADIUS:   43 52 54 30 30 30 30 33 2D 43 41 00 D5 30 81 D2 31 0B 30 09 06 03 55 04 06 13 02 55  [CRT00003-CA010UU]
    *Mar  8 00:03:07.020: RADIUS:   53 31 13 30 11 06 03 55 04              [ S10U]
    *Mar  8 00:03:07.020: RADIUS:  EAP-Message         [79]  100
    *Mar  8 00:03:07.020: RADIUS:   08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 12 30 10 06 03 55 04 07 0C 09 53 75 6E  [California10USun]
    *Mar  8 00:03:07.020: RADIUS:   6E 79 76 61 6C 65 31 17 30 15 06 03 55 04 0A 0C 0E 41 72 75 62 61 20 4E  [nyvale10UAruba N]
    *Mar  8 00:03:07.020: RADIUS:   65 74 77 6F 72 6B 73 31 40 30 3E 06 03 55 04 03 0C 37 43 6C 65  [etworks1@0>U7Cle]
    *Mar  8 00:03:07.020: RADIUS:   61 72 50 61 73 73 20 4F 6E 62 6F 61 72 64 20 4C  [arPass Onboard L]
    *Mar  8 00:03:07.020: RADIUS:   6F 63 61 6C 20 43 65 72 74 69        [ ocal Certi]
    *Mar  8 00:03:07.020: RADIUS:  Message-Authenticato[80]  18 
    *Mar  8 00:03:07.020: RADIUS:   12 75 40 41 6F 40 6B 6F A5 FE AB 85 F3 B3 CF A4           [ u@Ao@ko]
    *Mar  8 00:03:07.020: RADIUS:  State               [24]  30 
    *Mar  8 00:03:07.020: RADIUS:   00 6F 00 51 00 4B 00 6E EE B8 45 00 4B AA 6B A9 B6 D6 C8 CC 48 1A 91 99 7F 77 D3 C1         [ oQKnEKkHw]
    *Mar  8 00:03:07.029: RADIUS(000001C7): Received from id 1645/84
    *Mar  8 00:03:07.029: RADIUS/DECODE: EAP-Message fragments, 253+253+253+253+98, total 1110 bytes
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): Posting EAP_REQ for 0xB0000DBA
    *Mar  8 00:03:07.037:     dot1x_auth_bend Fa0/1: during state auth_bend_response, got event 7(eapReq)
    *Mar  8 00:03:07.037: @@@ dot1x_auth_bend Fa0/1: auth_bend_response -> auth_bend_request
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_exit called
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_enter called
    *Mar  8 00:03:07.037: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:07.037: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:07.037: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:07.037: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:07.037: EAPOL pak dump Tx
    *Mar  8 00:03:07.037: EAPOL Version: 0x3  type: 0x0  length: 0x0456
    *Mar  8 00:03:07.037: EAP code: 0x1  id: 0x3  length: 0x0456 type: 0xD
    *Mar  8 00:03:07.037: dot1x-packet(Fa0/1): EAPOL packet sent to client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_request_action called
    *Mar  8 00:03:07.037: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:07.037: dot1x-packet(Fa0/1): Queuing an EAPOL pkt on Authenticator Q
    *Mar  8 00:03:07.037: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    *Mar  8 00:03:07.037: EAPOL pak dump rx
    *Mar  8 00:03:07.037: EAPOL Version: 0x1  type: 0x0  length: 0x0006
    *Mar  8 00:03:07.037: dot1x-ev:
    dot1x_auth_queue_event: Int Fa0/1 CODE= 2,TYPE= 13,LEN= 6
    *Mar  8 00:03:07.037: dot1x-packet(Fa0/1): Received an EAPOL frame
    *Mar  8 00:03:07.037: dot1x-ev(Fa0/1): Received pkt saddr =d43d.7e65.4fc1 , daddr = 0180.c200.0003,
        pae-ether-type = 888e.0100.0006
    *Mar  8 00:03:07.037: dot1x-packet(Fa0/1): Received an EAP packet
    *Mar  8 00:03:07.037: EAPOL pak dump rx
    *Mar  8 00:03:07.037: EAPOL Version: 0x1  type: 0x0  length: 0x0006
    *Mar  8 00:03:07.037: dot1x-packet(Fa0/1): Received an EAP packet from d43d.7e65.4fc1
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): Posting EAPOL_EAP for 0xB0000DBA
    *Mar  8 00:03:07.037:     dot1x_auth_bend Fa0/1: during state auth_bend_request, got event 6(eapolEap)
    *Mar  8 00:03:07.037: @@@ dot1x_auth_bend Fa0/1: auth_bend_request -> auth_bend_response
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_enter called
    *Mar  8 00:03:07.037: dot1x-ev(Fa0/1): dot1x_sendRespToServer: Response sent to the server from 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:07.037: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_response_action called
    *Mar  8 00:03:07.037: AAA/AUTHEN/8021X (000001C7): Pick method list 'default'
    *Mar  8 00:03:07.046: RADIUS/ENCODE(000001C7):Orig. component type = DOT1X
    *Mar  8 00:03:07.046: RADIUS(000001C7): Config NAS IP: 0.0.0.0
    *Mar  8 00:03:07.046: RADIUS/ENCODE(000001C7): acct_session_id: 724
    *Mar  8 00:03:07.046: RADIUS(000001C7): sending
    *Mar  8 00:03:07.046: RADIUS/ENCODE: Best Local IP-Address 10.26.237.11 for Radius-Server 10.26.13.59
    *Mar  8 00:03:07.046: RADIUS(000001C7): Send Access-Request to 10.26.13.59:1812 id 1645/85, len 253
    *Mar  8 00:03:07.046: RADIUS:  authenticator 1C D7 6D 40 A3 D6 BA B1 - A7 E6 70 DA 32 83 2E 19
    *Mar  8 00:03:07.046: RADIUS:  User-Name           [1]   31  "host/D0902MALL005.IN.intranet"
    *Mar  8 00:03:07.046: RADIUS:  Service-Type        [6]   6   Framed                    [2]
    *Mar  8 00:03:07.046: RADIUS:  Framed-MTU          [12]  6   1500                     
    *Mar  8 00:03:07.046: RADIUS:  Called-Station-Id   [30]  19  "D4-A0-2A-EE-14-81"
    *Mar  8 00:03:07.046: RADIUS:  Calling-Station-Id  [31]  19  "D4-3D-7E-65-4F-C1"
    *Mar  8 00:03:07.046: RADIUS:  EAP-Message         [79]  8  
    *Mar  8 00:03:07.046: RADIUS:   02 03 00 06 0D 00
    *Mar  8 00:03:07.046: RADIUS:  Message-Authenticato[80]  18 
    *Mar  8 00:03:07.046: RADIUS:   73 1D 89 5C 66 19 32 B6 63 C2 64 C1 04 42 A9 F9           [ s\f2cdB]
    *Mar  8 00:03:07.046: RADIUS:  EAP-Key-Name        [102] 2   *
    *Mar  8 00:03:07.046: RADIUS:  Vendor, Cisco       [26]  49 
    *Mar  8 00:03:07.046: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0A1AED0B000000EE240F5BAB"
    *Mar  8 00:03:07.046: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    *Mar  8 00:03:07.046: RADIUS:  NAS-Port            [5]   6   50001                    
    *Mar  8 00:03:07.046: RADIUS:  NAS-Port-Id         [87]  17  "FastEthernet0/1"
    *Mar  8 00:03:07.046: RADIUS:  State               [24]  30 
    *Mar  8 00:03:07.046: RADIUS:   00 6F 00 51 00 4B 00 6E EE B8 45 00 4B AA 6B A9 B6 D6 C8 CC 48 1A 91 99 7F 77 D3 C1         [ oQKnEKkHw]
    *Mar  8 00:03:07.046: RADIUS:  NAS-IP-Address      [4]   6   10.26.237.11             
    *Mar  8 00:03:07.046: RADIUS:  Acct-Session-Id     [44]  10  "000002D4"
    *Mar  8 00:03:07.046: RADIUS(000001C7): Started 3 sec timeout
    *Mar  8 00:03:07.113: RADIUS: Received from id 1645/85 10.26.13.59:1812, Access-Challenge, len 378
    *Mar  8 00:03:07.113: RADIUS:  authenticator 1A 85 26 09 58 84 BC D4 - E0 A9 E3 C0 25 31 2D 31
    *Mar  8 00:03:07.113: RADIUS:  EAP-Message         [79]  255
    *Mar  8 00:03:07.121: RADIUS:   01 04 01 32 0D 00 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74  [2ficate Authorit]
    *Mar  8 00:03:07.121: RADIUS:   79 20 28 53 69 67 6E 69 6E 67 29 31 3F 30 3D 06 09 2A  [y (Signing)1?0=*]
    *Mar  8 00:03:07.121: RADIUS:   86 48 86 F7 0D 01 09 01 16 30 64 36 62 62 34 66 37 30 2D 66 34 31 32 2D  [H0d6bb4f70-f412-]
    *Mar  8 00:03:07.121: RADIUS:   34 35 35 32 2D 61 65 65 32 2D 63 37 61 30 32 36  [4552-aee2-c7a026]
    *Mar  8 00:03:07.121: RADIUS:   66 62 61 32 31 38 40 65 78 61 6D 70 6C 65 2E 63  [[email protected]]
    *Mar  8 00:03:07.121: RADIUS:   6F 6D 00 CB 30 81 C8 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66  [om010UUS10UCalif]
    *Mar  8 00:03:07.121: RADIUS:   6F 72 6E 69 61 31 12 30 10 06 03 55 04 07 0C 09 53 75 6E 6E 79 76 61 6C  [ornia10USunnyval]
    *Mar  8 00:03:07.121: RADIUS:   65 31 17 30 15 06 03 55 04 0A 0C 0E 41 72 75 62 61 20 4E 65 74 77 6F 72  [e10UAruba Networ]
    *Mar  8 00:03:07.121: RADIUS:   6B 73 31 36 30 34 06 03 55 04 03 0C 2D 43 6C 65 61 72 50 61 73  [ks1604U-ClearPas]
    *Mar  8 00:03:07.121: RADIUS:   73 20 4F 6E 62 6F 61 72 64 20 4C 6F 63 61 6C 20  [s Onboard Local ]
    *Mar  8 00:03:07.121: RADIUS:   43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68  [Certificate Auth]
    *Mar  8 00:03:07.121: RADIUS:   6F 72 69 74 79 31 3F 30 3D 06 09 2A 86 48 86 F7 0D 01 09 01 16       [ ority1?0=*H]
    *Mar  8 00:03:07.121: RADIUS:  EAP-Message         [79]  55 
    *Mar  8 00:03:07.121: RADIUS:   30 64 36 62 62 34 66 37 30 2D 66 34 31 32 2D 34  [0d6bb4f70-f412-4]
    *Mar  8 00:03:07.121: RADIUS:   35 35 32 2D 61 65 65 32 2D 63 37 61 30 32 36 66  [552-aee2-c7a026f]
    *Mar  8 00:03:07.121: RADIUS:   62 61 32 31 38 40 65 78 61 6D 70 6C 65 2E 63 6F  [[email protected]]
    *Mar  8 00:03:07.121: RADIUS:   6D 0E 00 00 00                 [ m]
    *Mar  8 00:03:07.121: RADIUS:  Message-Authenticato[80]  18 
    *Mar  8 00:03:07.121: RADIUS:   4C 46 AA B9 A5 D5 DF EA DB E7 2B 7B 51 7E 58 3F          [ LF+{Q~X?]
    *Mar  8 00:03:07.121: RADIUS:  State               [24]  30 
    *Mar  8 00:03:07.121: RADIUS:   00 EF 00 B9 00 0A 00 00 EF B8 45 00 EF D2 C4 3C 81 6C 72 0E 23 FE 11 EA 12 17 50 A1            [ E
    *Mar  8 00:03:07.121: RADIUS(000001C7): Received from id 1645/85
    *Mar  8 00:03:07.121: RADIUS/DECODE: EAP-Message fragments, 253+53, total 306 bytes
    *Mar  8 00:03:07.130: dot1x-sm(Fa0/1): Posting EAP_REQ for 0xB0000DBA
    *Mar  8 00:03:07.130:     dot1x_auth_bend Fa0/1: during state auth_bend_response, got event 7(eapReq)
    *Mar  8 00:03:07.130: @@@ dot1x_auth_bend Fa0/1: auth_bend_response -> auth_bend_request
    *Mar  8 00:03:07.130: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_exit called
    *Mar  8 00:03:07.130: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_request_enter called
    *Mar  8 00:03:07.130: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:07.130: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:07.130: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:07.130: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:07.130: EAPOL pak dump Tx
    *Mar  8 00:03:07.130: EAPOL Version: 0x3  type: 0x0  length: 0x0132
    *Mar  8 00:03:07.130: EAP code: 0x1  id: 0x4  length: 0x0132 type: 0xD
    *Mar  8 00:03:07.130: dot1x-packet(Fa0/1): EAPOL packet sent to client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:07.130: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_request_action called
    *Mar  8 00:03:07.138: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:07.138: dot1x-packet(Fa0/1): Queuing an EAPOL pkt on Authenticator Q
    *Mar  8 00:03:07.138: dot1x-ev:Enqueued the eapol packet to the global authenticator queue
    *Mar  8 00:03:07.138: EAPOL pak dump rx
    *Mar  8 00:03:07.138: EAPOL Version: 0x1  type: 0x0  length: 0x05D4
    *Mar  8 00:03:07.138: dot1x-ev:
    dot1x_auth_queue_event: Int Fa0/1 CODE= 2,TYPE= 13,LEN= 1492
    *Mar  8 00:03:07.138: dot1x-packet(Fa0/1): Received an EAPOL frame
    *Mar  8 00:03:07.138: dot1x-ev(Fa0/1):
    ^Z
    Malleswaram_2960#
    *Mar  8 00:03:07.180: RADIUS:  State               [24]  30 
    *Mar  8 00:03:07.180: RADIUS:   00 EF 00 B9 00 0A 00 00 EF B8 45 00 EF D2 C4 3C 81 6C 72 0E 23 FE 11 EA 12 17 50 A1            [ E
    *Mar  8 00:03:07.180: RADIUS:  NAS-IP-Address      [4]   6   10.26.237.11             
    *Mar  8 00:03:07.180: RADIUS:  Acct-Session-Id     [44]  10  "000002D4"
    *Mar  8 00:03:07.180: RADIUS(000001C7): Started 3 sec timeout
    Malleswaram_2960#
    *Mar  8 00:03:07.893: %SYS-5-CONFIG_I: Configured from console by jameela on vty0 (10.26.20.5)
    Malleswaram_2960#
    *Mar  8 00:03:10.225: RADIUS(000001C7): Request timed out
    *Mar  8 00:03:10.225: RADIUS: Retransmit to (10.26.13.59:1812,1813) for id 1645/86
    *Mar  8 00:03:10.225: RADIUS(000001C7): Started 3 sec timeout
    Malleswaram_2960#
    *Mar  8 00:03:13.354: RADIUS(000001C7): Request timed out
    *Mar  8 00:03:13.354: RADIUS: Retransmit to (10.26.13.59:1812,1813) for id 1645/86
    *Mar  8 00:03:13.354: RADIUS(000001C7): Started 3 sec timeout
    Malleswaram_2960#
    *Mar  8 00:03:16.307: RADIUS(000001C7): Request timed out
    *Mar  8 00:03:16.307: RADIUS: Retransmit to (10.26.13.59:1812,1813) for id 1645/86
    *Mar  8 00:03:16.307: RADIUS(000001C7): Started 3 sec timeout
    Malleswaram_2960#
    *Mar  8 00:03:19.369: RADIUS(000001C7): Request timed out
    *Mar  8 00:03:19.369: RADIUS: Retransmit to (10.26.13.59:1812,1813) for id 1645/86
    *Mar  8 00:03:19.369: RADIUS(000001C7): Started 3 sec timeout
    Malleswaram_2960#
    *Mar  8 00:03:22.456: RADIUS(000001C7): Request timed out
    *Mar  8 00:03:22.456: RADIUS: Fail-over denied to  (10.26.13.59:1812,1813) for id 1645/86
    *Mar  8 00:03:22.456: RADIUS: No response from (10.26.13.59:1812,1813) for id 1645/86
    *Mar  8 00:03:22.456: RADIUS/DECODE: parse response no app start; FAIL
    *Mar  8 00:03:22.456: RADIUS/DECODE: parse response; FAIL
    *Mar  8 00:03:22.456: dot1x-ev(Fa0/1): Received an EAP Fail
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): Posting EAP_FAIL for 0xB0000DBA
    *Mar  8 00:03:22.456:     dot1x_auth_bend Fa0/1: during state auth_bend_response, got event 10(eapFail)
    *Mar  8 00:03:22.456: @@@ dot1x_auth_bend Fa0/1: auth_bend_response -> auth_bend_fail
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_exit called
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_fail_enter called
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_response_fail_action called
    *Mar  8 00:03:22.456:     dot1x_auth_bend Fa0/1: idle during state auth_bend_fail
    *Mar  8 00:03:22.456: @@@ dot1x_auth_bend Fa0/1: auth_bend_fail -> auth_bend_idle
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_bend_idle_enter called
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): Posting AUTH_FAIL on Client 0xB0000DBA
    *Mar  8 00:03:22.456:     dot1x_auth Fa0/1: during state auth_authenticating, got event 15(authFail)
    *Mar  8 00:03:22.456: @@@ dot1x_auth Fa0/1: auth_authenticating -> auth_authc_result
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_authenticating_exit called
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_authc_result_enter called
    *Mar  8 00:03:22.456: %DOT1X-5-FAIL: Authentication failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID
    *Mar  8 00:03:22.456: dot1x-ev(Fa0/1): Sending event (2) to Auth Mgr for d43d.7e65.4fc1
    *Mar  8 00:03:22.456: %AUTHMGR-7-RESULT: Authentication result 'fail' from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EE240F5BAB
    *Mar  8 00:03:22.456: %AUTHMGR-5-FAIL: Authorization failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EE240F5BAB
    *Mar  8 00:03:22.456: dot1x-redundancy: State for client  d43d.7e65.4fc1 successfully retrieved
    *Mar  8 00:03:22.456: dot1x-ev(Fa0/1): Received Authz fail for the client  0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): Posting_AUTHZ_FAIL on Client 0xB0000DBA
    *Mar  8 00:03:22.456:     dot1x_auth Fa0/1: during state auth_authc_result, got event 22(authzFail)
    *Mar  8 00:03:22.456: @@@ dot1x_auth Fa0/1: auth_authc_result -> auth_held
    *Mar  8 00:03:22.456: dot1x-sm(Fa0/1): 0xB0000DBA:auth_held_enter called
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:22.464: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:22.464: EAPOL pak dump Tx
    *Mar  8 00:03:22.464: EAPOL Version: 0x3  type: 0x0  length: 0x0004
    *Mar  8 00:03:22.464: EAP code: 0x4  id: 0x4  length: 0x0004
    *Mar  8 00:03:22.464: dot1x-packet(Fa0/1): EAPOL packet sent to client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): Posting FAILOVER_RETRY on Client 0xB0000DBA
    *Mar  8 00:03:22.464:     dot1x_auth Fa0/1: during state auth_held, got event 21(failover_retry)
    *Mar  8 00:03:22.464: @@@ dot1x_auth Fa0/1: auth_held -> auth_restart
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_held_exit called
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_restart_enter called
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Sending create new context event to EAP for 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_held_restart_action called
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): Posting !EAP_RESTART on Client 0xB0000DBA
    *Mar  8 00:03:22.464:     dot1x_auth Fa0/1: during state auth_restart, got event 6(no_eapRestart)
    *Mar  8 00:03:22.464: @@@ dot1x_auth Fa0/1: auth_restart -> auth_connecting
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_connecting_enter called
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_restart_connecting_action called
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): Posting REAUTH_MAX on Client 0xB0000DBA
    *Mar  8 00:03:22.464:     dot1x_auth Fa0/1: during state auth_connecting, got event 11(reAuthMax)
    *Mar  8 00:03:22.464: @@@ dot1x_auth Fa0/1: auth_connecting -> auth_disconnected
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_disconnected_enter called
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): d43d.7e65.4fc1:auth_disconnected_enter sending canned failure to version 1 supplicant
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:22.464: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:22.464: EAPOL pak dump Tx
    *Mar  8 00:03:22.464: EAPOL Version: 0x3  type: 0x0  length: 0x0004
    *Mar  8 00:03:22.464: EAP code: 0x4  id: 0x5  length: 0x0004
    *Mar  8 00:03:22.464: dot1x-packet(Fa0/1): dot1x_auth_txCannedStatus: EAPOL packet sent to client 0xB0000DBA (d43d.7e65.4fc1)
    *Mar  8 00:03:22.464: dot1x-sm(Fa0/1): 0xB0000DBA:auth_connecting_disconnected_reAuthMax_action called
    *Mar  8 00:03:22.464:     dot1x_auth Fa0/1: idle during state auth_disconnected
    *Mar  8 00:03:22.464: @@@ dot1x_auth Fa0/1: auth_disconnected -> auth_restart
    *Mar  8 00:03:22.464: dot1x-ev(Fa0/1): Sending event (1) to Auth Mgr for d43d.7e65.4fc1
    *Mar  8 00:03:22.464: dot1x-ev:Delete auth client (0xB0000DBA) message
    *Mar  8 00:03:22.464: dot1x-ev:Auth client ctx destroyed
    *Mar  8 00:03:22.674: AAA/BIND(000001C8): Bind i/f 
    *Mar  8 00:03:22.674:     dot1x_auth Fa0/1: initial state auth_initialize has enter
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_initialize_enter called
    *Mar  8 00:03:22.674:     dot1x_auth Fa0/1: during state auth_initialize, got event 0(cfg_auto)
    *Mar  8 00:03:22.674: @@@ dot1x_auth Fa0/1: auth_initialize -> auth_disconnected
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_disconnected_enter called
    *Mar  8 00:03:22.674:     dot1x_auth Fa0/1: idle during state auth_disconnected
    *Mar  8 00:03:22.674: @@@ dot1x_auth Fa0/1: auth_disconnected -> auth_restart
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_restart_enter called
    *Mar  8 00:03:22.674: dot1x-ev(Fa0/1): Sending create new context event to EAP for 0x4A000DBB (0000.0000.0000)
    *Mar  8 00:03:22.674:     dot1x_auth_bend Fa0/1: initial state auth_bend_initialize has enter
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_initialize_enter called
    *Mar  8 00:03:22.674:     dot1x_auth_bend Fa0/1: initial state auth_bend_initialize has idle
    *Mar  8 00:03:22.674:     dot1x_auth_bend Fa0/1: during state auth_bend_initialize, got event 16383(idle)
    *Mar  8 00:03:22.674: @@@ dot1x_auth_bend Fa0/1: auth_bend_initialize -> auth_bend_idle
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_idle_enter called
    *Mar  8 00:03:22.674: dot1x-ev(Fa0/1): Created a client entry (0x4A000DBB)
    *Mar  8 00:03:22.674: dot1x-ev(Fa0/1): Dot1x authentication started for 0x4A000DBB (0000.0000.0000)
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): Posting !EAP_RESTART on Client 0x4A000DBB
    *Mar  8 00:03:22.674:     dot1x_auth Fa0/1: during state auth_restart, got event 6(no_eapRestart)
    *Mar  8 00:03:22.674: @@@ dot1x_auth Fa0/1: auth_restart -> auth_connecting
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_connecting_enter called
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_restart_connecting_action called
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): Posting RX_REQ on Client 0x4A000DBB
    *Mar  8 00:03:22.674:     dot1x_auth Fa0/1: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
    *Mar  8 00:03:22.674: @@@ dot1x_auth Fa0/1: auth_connecting -> auth_authenticating
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_authenticating_enter called
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_connecting_authenticating_action called
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): Posting AUTH_START for 0x4A000DBB
    *Mar  8 00:03:22.674:     dot1x_auth_bend Fa0/1: during state auth_bend_idle, got event 4(eapReq_authStart)
    *Mar  8 00:03:22.674: @@@ dot1x_auth_bend Fa0/1: auth_bend_idle -> auth_bend_request
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_request_enter called
    *Mar  8 00:03:22.674: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:22.674: dot1x-ev(Fa0/1): Role determination not required
    Malleswaram_2960#
    *Mar  8 00:03:22.674: dot1x-registry:registry:dot1x_ether_macaddr called
    *Mar  8 00:03:22.674: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:22.674: EAPOL pak dump Tx
    *Mar  8 00:03:22.674: EAPOL Version: 0x3  type: 0x0  length: 0x0005
    *Mar  8 00:03:22.674: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1
    *Mar  8 00:03:22.674: dot1x-packet(Fa0/1): EAPOL packet sent to client 0x4A000DBB (0000.0000.0000)
    *Mar  8 00:03:22.674: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_idle_request_action called
    *Mar  8 00:03:22.791: dot1x-ev(Fa0/1): New client notification from AuthMgr for 0x4A000DBB - d43d.7e65.4fc1
    *Mar  8 00:03:22.791: %AUTHMGR-5-START: Starting 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:03:25.761: dot1x-sm(Fa0/1): Posting EAP_REQ for 0x4A000DBB
    *Mar  8 00:03:25.761:     dot1x_auth_bend Fa0/1: during state auth_bend_request, got event 7(eapReq)
    *Mar  8 00:03:25.761: @@@ dot1x_auth_bend Fa0/1: auth_bend_request -> auth_bend_request
    *Mar  8 00:03:25.761: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_request_request_action called
    *Mar  8 00:03:25.761: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_request_enter called
    *Mar  8 00:03:25.761: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:25.761: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:25.761: dot1x-registry:registry:dot1x_ether_macaddr called
    Malleswaram_2960#n
    *Mar  8 00:03:25.761: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:25.761: EAPOL pak dump Tx
    *Mar  8 00:03:25.761: EAPOL Version: 0x3  type: 0x0  length: 0x0005
    *Mar  8 00:03:25.761: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1
    *Mar  8 00:03:25.761: dot1x-packet(Fa0/1): EAPOL packet sent to client 0x4A000DBB (d43d.7e65.4fc1)
    Malleswaram_2960#no debu
    Malleswaram_2960#no debug
    *Mar  8 00:03:28.848: dot1x-sm(Fa0/1): Posting EAP_REQ for 0x4A000DBB
    *Mar  8 00:03:28.848:     dot1x_auth_bend Fa0/1: during state auth_bend_request, got event 7(eapReq)
    *Mar  8 00:03:28.848: @@@ dot1x_auth_bend Fa0/1: auth_bend_request -> auth_bend_request
    *Mar  8 00:03:28.848: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_request_request_action called
    *Mar  8 00:03:28.848: dot1x-sm(Fa0/1): 0x4A000DBB:auth_bend_request_enter called
    *Mar  8 00:03:28.848: dot1x-ev(Fa0/1): Sending EAPOL packet to group PAE address
    *Mar  8 00:03:28.848: dot1x-ev(Fa0/1): Role determination not required
    *Mar  8 00:03:28.848: dot1x-registry:registry:dot1x_ether_macaddr called
    Malleswaram_2960#no debug all
    *Mar  8 00:03:28.848: dot1x-ev(Fa0/1): Sending out EAPOL packet
    *Mar  8 00:03:28.848: EAPOL pak dump Tx
    *Mar  8 00:03:28.848: EAPOL Version: 0x3  type: 0x0  length: 0x0005
    *Mar  8 00:03:28.848: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1
    *Mar  8 00:03:28.848: dot1x-packet(Fa0/1): EAPOL packet sent to client 0x4A000DBB (d43d.7e65.4fc1)
    Malleswaram_2960#no debug all
    All possible debugging has been turned off
    Malleswaram_2960#
    *Mar  8 00:03:31.180: AAA: parse name=tty1 idb type=-1 tty=-1
    *Mar  8 00:03:31.180: AAA: name=tty1 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=1 channel=0
    *Mar  8 00:03:31.180: AAA/MEMORY: create_user (0x21D1684) user='jameela' ruser='Malleswaram_2960' ds0=0 port='tty1' rem_addr='10.26.20.5' authen_type=ASCII service=NONE priv=15 initial_task_id='0', vrf= (id=0) key=C9A1F1D1
    *Mar  8 00:03:31.389: TAC+: (-1901802859): received author response status = PASS_ADD
    *Mar  8 00:03:31.389: AAA/MEMORY: free_user (0x21D1684) user='jameela' ruser='Malleswaram_2960' port='tty1' rem_addr='10.26.20.5' authen_type=ASCII service=NONE priv=15
    *Mar  8 00:03:31.935: %DOT1X-5-FAIL: Authentication failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID
    *Mar  8 00:03:31.935: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    *Mar  8 00:03:31.935: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    *Mar  8 00:03:31.935: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:03:31.935: %AUTHMGR-5-FAIL: Authorization failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#no deb
    Malleswaram_2960#no debug al
    Malleswaram_2960#no debug all
    All possible debugging has been turned off
    Malleswaram_2960#
    *Mar  8 00:04:32.677: %AUTHMGR-5-START: Starting 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:04:41.938: %DOT1X-5-FAIL: Authentication failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID
    *Mar  8 00:04:41.938: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    *Mar  8 00:04:41.938: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    *Mar  8 00:04:41.938: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:04:41.938: %AUTHMGR-5-FAIL: Authorization failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:05:42.654: %AUTHMGR-5-START: Starting 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:05:51.915: %DOT1X-5-FAIL: Authentication failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID
    *Mar  8 00:05:51.915: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    *Mar  8 00:05:51.915: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    *Mar  8 00:05:51.915: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Malleswaram_2960#
    *Mar  8 00:05:51.915: %AUTHMGR-5-FAIL: Authorization failed for client (d43d.7e65.4fc1) on Interface Fa0/1 AuditSessionID 0A1AED0B000000EF240F9BC3
    Pls dont worry about day and time.

  • ISE - dot1x EAP TLS for Cisco IP Phones

    Hi Gents,
    I have a question about the CA configs for ISE or ACS.
    As I understand, LSC certificate is issued by the CUCM by its Certificate Authority Proxy Function. If an IP Phone needs to be authenticated by its LSC (Locally Significant Certificate), which of the following CA we need to trust:
    1. Cisco CA Certificate
    2. CUCM Locally signed Certificate or CUCM Identity Certificate
    And if these certificates are imported into ISE/ACS, will the ISE/ACS will be able to authenticate the IP Phone if the dot1x EAP-TLS authentication is enabled for IP Phones?
    Is there any other configs needed?
    I would highly appreicate if someone can clearify me this process.
    Regards,

    I got the answer, for the first part of the EAP TLS authentication: Phone authentication
    In an IEEE 802.1X authentication, the AAA server  is responsible for validating the certificate provided by the phone. To  do this, the AAA server must have a copy of the root CA certificate that  signed the phone's certificate. The root certificates for both LSCs and  MICs can be exported from the CUCM Operating System Administration  interface and imported into your AAA server
    http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-605524.html#wp9000412
    As this is EAP TLS, Server (ISE/ACS) is also required to authenticate itself to the phone.
    What is needed for this?

Maybe you are looking for

  • How to write to the file

    Hello Please help me I have a question, I try to write variables in the file. FileOutputStream ot=new FileOutputStream("minor.txt"); ot.write(ints5);//ints5- string variable ot.close(); but compilator gives;Incompatible type for method can't convert

  • Deleting expired backup not working.

    Hi, I am cleaning up the backup by deleting all the expired backups. My OS is RHEL 4 and DB is 10.2.0.3 and the backup is Veritas Netbackup using RMAN Recovery Manager: Release 10.2.0.3.0 - Production on Mon Mar 28 12:51:16 2011 Copyright (c) 1982, 2

  • Error with Java WebStart Signed Jars on 1.6.0_19's new Mixed  Code

    All, First, we have a valid code signing certificate/keystore from Thawte that works for signing webstart jars as of update 18. For some reason, if you run our webstart application on update 19 JRE, the runtime believes that some of the jars are not

  • Odata services in Design studio 1.2 ?

    Hello All, I am exploring Design studio at the moment and I know that we can do scripting along with drag and drop functionalities. But I would like to know if it also possible to consume Odata services or send Odata requests to HANA database to get

  • Constantly receiving a password disable message when ordering from iPad.

    When I attempt a purchase or download from my iPad 2 I get a message telling me that my account has been temporarily disabled. I have to go to Apple.com to enter my password to clear things up. I am careful to enter my password correctly at the time