Machine authentication for ACS5.1

Question

Hi, I met a problem with machine authentication. Following is the conditions::
1. WLC5508, version 6.0.196
2. ACS 5.1.0.44
3. WIN AD
4. PEAP-MSCHAPv2+machine authentication
the machine auth failed, I checked the log, it says Machine not found in AD:
11001  Received RADIUS Access-Request
11017  RADIUS created a new session
Evaluating Service Selection Policy
15004  Matched rule
15012  Selected Access Service - WLAN Access Policy
11507  Extracted EAP-Response/Identity
12300  Prepared EAP-Request proposing PEAP with challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12302  Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated
12318  Successfully negotiated PEAP version 0
12800  Extracted first TLS record; TLS handshake started.
12805  Extracted TLS ClientHello message.
12806  Prepared TLS ServerHello message.
12807  Prepared TLS Certificate message.
12810  Prepared TLS ServerDone message.
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
12318  Successfully negotiated PEAP version 0
12812  Extracted TLS ClientKeyExchange message.
12804  Extracted TLS Finished message.
12801  Prepared TLS ChangeCipherSpec message.
12802  Prepared TLS Finished message.
12816  TLS handshake succeeded.
12310  PEAP full handshake finished successfully
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
12313  PEAP inner method started
11521  Prepared EAP-Request/Identity for inner EAP method
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
11522  Extracted EAP-Response/Identity for inner EAP method
11806  Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
11808  Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated
Evaluating Identity Policy
15006  Matched Default Rule
15013  Selected Identity Store -
24431  Authenticating machine against Active Directory
24437  Machine not found in Active Directory
22056  Subject not found in the applicable identity store(s).
22058  The advanced option that is configured for an unknown user is used.
22061  The 'Reject' advanced option is configured in case of a failed authentication request.
11823  EAP-MSCHAP authentication attempt failed
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
5411  EAP session timed out
However this machine account definately is in the AD, what's wrong? Any idea? Thanks in advance!

Answer 1

From your screenshot, the client faied in the "Evaluating Group Mapping Policy", after "12304  Extracted EAP-Response containing PEAP challenge-response", it says "client sent result TLV indicating failure"
For the normal process, this should be sth like:
12304  Extracted EAP-Response containing PEAP challenge-response
11810  Extracted EAP-Response for inner method containing MSCHAP challenge-response
11814  Inner EAP-MSCHAP authentication succeeded
11519  Prepared EAP-Success for inner EAP method
12314  PEAP inner method finished successfully
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
12306  PEAP authentication succeeded
11503  Prepared EAP-Success
It seems your configuration on MSCHAP has some problem, so double check your PEAP-MSCHAPv2 configuration on both the client and the ACS. In ACS5.1, it should looks like:
in client, it should looks like:
BTW, what had you configured for group mapping? In your case, it seems not need it because in Authorization policy, you just used AD1:ExternalGroups instead of Identity Group.
If you can paste your configured AD parameter(General, Directory Groups, Directory Attributes), access policy(General, Allowed Protocol, Identity, Group Mapping, Authorization), all the steps for the failed auth(including Evaluating Service Selection Policy, Evaluating Identity Policy, Evaluating Group Mapping Policy,Evaluating Authorization Policy), it can help to troubleshoot your problem.