Meaning of EAP-TLS errors in ACS

Hi Guys,
I'm trying to get a device authenticated to my wireless network using certificates. I get the generic error in ACS (4.2.0.124):
EAP-TLS or PEAP authentication failed during SSL handshake
Looking in the Auth log I get:
AUTH 12/09/2013 15:56:40 E 2255 3096 0x8b7ea5 EAP: EAP-TLS: ProcessResponse: SSL send alert fatal:handshake failure
AUTH 12/09/2013 15:56:40 E 2258 3096 0x8b7ea5 EAP: EAP-TLS: ProcessResponse: SSL ext error reason: c7 (Ext error code = 0)
AUTH 12/09/2013 15:56:40 E 2297 3096 0x8b7ea5 EAP: EAP-TLS: ProcessResponse(1519): mapped SSL error code (3) to -2120
AUTH 12/09/2013 15:56:42 E 3159 297052 0x0 AuthenReaper thread : Session Timed out since challenge not provided, freeing it
Can anyone help me with the reason codes or point me in the right direction?
Thanks,
John.

Hi John,
This is mostly due to improper certificate installed on either the server or on the client machine.
Considering the issue with only one client I guess the server is clean.
Can you verify if proper root certificate, intermediate certificate and the id certificates are installed on client?
You can also regenerate a new machine ID cert for the client and give a try.
Thanks.

Similar Messages

  • EAP-TLS error message on ACS server

    Receving this message when client attempts authentication....Any idea or pointers on troubleshooting this?
    "EAP-TLS authentication failed during handshake"

    turn on debugging at the AccessPoint (:eap_diag1_on at 350-Series) or at the ACS (csradius -d -p -z) to get more information
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_tech_note09186a00800afec1.shtml
    Verify Certificates and CA at the client and the ACS
    http://www.cisco.com/en/US/products/hw/wireless/ps458/products_white_paper09186a008009256b.shtml

  • EAP-TLS error .........failed SSL/TLS handshake because of an unknown CA in client certificate chain

    Hi,
    I am using 802.1x and EAP-TLS as authentication protocol. The clients are not able to pass the authentication the error log on ACS is
    Authentication failed: EAP-TLS handshake failed SSL/TLS handshake because of an unknown CA in the client certification chain.
    I have installed certificates on the WLC and ACS, however authentication is unsuccessful.
    Can anybody help regarding this issue.

    Hi Sandeep,
    Web auth certificate is defult certificate in wlc but you can also use your own(3rd party).
    http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/70584-csr-wlc-00.html
    Virtual interface : This interface handles any mobility management, VPN Termination, Web authentication, and is also a DHCP relay for WLAN clients.
    Yes its interconnected, the purpose for this entry is so that the controller knows the name of the of the certificates to virtual address translation.
    1. Guest Client go to google.com
    2. Client goes to DNS (the one its is assign in DHCP)
    3. DNS resolves the DNS for google.com
    4. Client then attempts to go to google.com
    5. Controller intercepts GET and replaces it with a 1.1.1.1
    6. Controller then takes the 1.1.1.1 and translates this to the DNS name to negat the (accpet this cert screen)
    7. DNS then gets resolve to the name (example guest.xxx.com)
    8. Controller presents the guest screen
    Hope it helps.
    Regards
    Dont forget to rate helpful posts

  • EAP-TLS authentication with ACS 5.2

    Hi all,
    I have question on EAP-TLS with ACS 5.2.
    If I would like to implement the EAP-TLS with Microsoft CA, how will the machine and user authentication take place?
    Understand that the cert are required on both client and server end, but is this certificate ties to the machine or ties to individual user?
    If ties to user, and I have a shared PC which login by few users, is that mean every user account will have their own certificates?
    And every individual user will have to manually get the cert from CA? is there any other method as my environment has more than 3000 PCs.
    And also if it ties to user, all user can get their cert from CA with their AD login name and password, if they bring in their own device and try to get the cert from CA, they will be able to successfully install the cert into their device right?
    Hope you guys can help on this. THanks.

    Yes, you can configure:
    machine authentication only
    user authentication only
    Machine and user authentication.
    Machine or user authentication
    So machine authentication only is quite common scenarion. Correct, as long as machine is a part of a domain, you will be authenticated via machine authentication.
    PEAP-based machine authentication uses PEAP (EAP-MS-CHAPv2) and the password for the computer established automatically when it was added to the Microsoft Windows domain. The computer sends its name as the username and the format is:
    host/computer.domain
    If the machine is a valid machine in the domain then during the boot process, once the HAL is loaded, the system begins loading device drivers to support the various hardware devices configured on the client in question. After loading the device drivers, the network interface is initialized. At this point, machine start getting ip address and once it done, the user may have access to most of the network.
    Regards,
    Jatin

  • EAP-TLS Error

    Hello.
    I cannot get EAP-TLS auth to work on windows 7 wired setup. I've tested EAP-PEAP on wireless and wired - works fine. Also EAP-TLS for wireless works great. Clients are on same domain as radius (wich is Cisco ISE), we've deployed CA-services on that same domain too and are distributing certificates to clients via GPOs. Authenticators (switchports) are configured correctly, certificates work on EAP-TLS wireless setup, everything seems to be ok, but wired connection still cannot auth and  EAP timeouts.
    Here is the error:
    Logged At: May 14,2013 11:52:12.159 AM
    RADIUS Status: No response received during 120 seconds on last EAP message sent to the client : 5411 No response received during 120 seconds on last EAP message sent to the client

    Have you confirmed that the Supplicant is configured properly for EAP-TLS authentication? I have done this type of deployment many times and haven't had this issue. 
    Thank you for rating helpful posts! 

  • EAP-TLS + CA MICROSOFT + ACS 3.2 APPLIANCE = Problem

    I have a Wireless Lan platform composed by equipment Access Points Cisco 1100 with ACS 3,1 and CA Microsoft.The security scheme is EAP-TLS (certificates).This architecture was completely functional. The problem took place when replacing the ACS 3,1 by the ACS 3,2 APPLIANCE, for which new certificates they were emitted by the CA of the infrastructure. The problem appears when a wireless client tries to connect to the wireless network,without obtaining the objective ,being in a state of "trying to authenticate" in networks adapters, in addition the ACS Logs appear the following message "NAS duplicated authentication attempt".
    If somebody knows the reason of this problem, can be contacted to my mail ([email protected]).

    A hint i could give you that in such a scenario you need an Trusted boundary between the ACS Appliance and the MS AD/PDC. This we be realized trough an PC/Host who is a regitered member or user of the AD/PDC. This relay Computer then communicates with the MS CA. The SW that Cisco Provides is the Cisco Secure ACS Agent. Hope this helps as we found the same problem in leap authentication as the ACS Appliance could not be set into a AD/PDC Domain. This has to be realized trough this smal piece of SW installed on an PC/Host etc. wich is a active AD/PDC Member.

  • Nokia E66 EAP-TLS error

    Hi, I am configuring a Nokia E66 (wich is v4 in Cisco Compatible Extensions, so it supports EAP-TLS) with WPA2 EAP-TLS against IAS in a Cisco Wireless Network and I always obtain the same error in the IAS event viewer.
    denied accesss
    Authentication-Type = EAP
    EAP-Type = Smart Card or other certificate
    Reason-Code = 16
    Reason = Authentication was not successful because an unknown user name or incorrect password was used.
    Has anybody tried E66 with EAP-TLS?
    Any experiences?

    Yes, this is my setup
    - hidden network
    - infraestructure
    - security: WPA/ WPA2
    - EAP
    - Plug -ins: EAP-TLS. I select the user certificate and the CA certificate. User name from the certificate, domain from the certificate
    - WPA2 only mode
    In the IAS log, the username is correct, but always appear this strange error. The certificates and infraestructure I use it works well in a notebook
    Thanks

  • E66 EAP-TLS error

    Hi, I have configured an E66 with WPA2 EAP-TLS against IAS and I always obtain the same error in the IAS event viewer.
    denied accesss
    Authentication-Type = EAP
    EAP-Type = Smart Card or other certificate
    Reason-Code = 16
    Reason = Authentication was not successful because an unknown user name or incorrect password was used.
    Has anybody tried E66 with EAP-TLS?
    Any experiences?

    Yes, this is my setup
    - hidden network
    - infraestructure
    - security: WPA/ WPA2
    - EAP
    - Plug -ins: EAP-TLS. I select the user certificate and the CA certificate. User name from the certificate, domain from the certificate
    - WPA2 only mode
    In the IAS log, the username is correct, but always appear this strange error. The certificates and infraestructure I use it works well in a notebook
    Thanks

  • PEAP & EAP-TLS together on ACS

    We have recently deployed lightweight APs/WLCs in my organization and the authentication mechanism for WLANs is PEAP. We plan to add a new wireless LAN and want to use certificate based authentication, EAP-TLS for this new wlan. Our authenticating server is Cisco ACS, and want to use the same authenticating server for authenticating these two wlans. I haven't found a way to configure exclusively to assign a particular authentication mechanism for a wlan on ACS. Neither the sub authentication be specified in WLC. Any clues?
    Thanks,
    Vijay

    In ACS 5.x, you can specify both EAP type and then also have a condition to grant access to a certain AD OU.  If users are in a different OU, then you create two policies that look at conditions for EAP type, SSID and OU.
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/access_policies.html

  • [Cisco ACS 5.2] Windows XP - EAP-TLS error

    Hi,
    We used RADIATOR with Cisco WLC and Cisco AP in our WiFi architecture.
    We just replaced RADIATOR with Cisco ACS 5.2 .
    Few computers with Windows XP SP3 have this error : 11514 Unexpectedly received empty TLS message; treating as a rejection by the client
    Description:
    While  trying to negotiate a TLS handshake with the client, ACS expected to  receive a non-empty TLS message or TLS alert message, but instead  received an empty TLS message. This could be due to an inconformity in  the implementation of the protocol between ACS and the supplicant. For  example, it is a known issue that the XP supplicant sends an empty TLS  message instead of a non-empty TLS alert message. It might also involve  the supplicant not trusting the ACS server certificate for some reason.  ACS treated the unexpected message as a sign that the client rejected  the tunnel establishment.
    Resolution Steps :
    Ensure  that the client's supplicant does not have any known compatibility  issues and that it is properly configured. Also ensure that the ACS  server certificate is trusted by the client, by configuring the  supplicant with the CA certificate that signed the ACS server  certificate. It is strongly recommended to not disable the server  certificate validation on the client!
    Most of the computers (hundreds of Windows XP and Windows 7) got no problem.
    ACS says "it is a known issue that the XP supplicant sends an empty TLS  message instead of a non-empty TLS alert message".
    If it was a known issue, we would have this error for other computer but we don't have (fortunately )
    Wireless profile is sent to computers using GPO so they trust ACS server certificate...
    Do you know how to correct this issue on XP supplicant? I dont find this issue on Google
    Thanks for your help,
    Patrick

    Patrick,
    One way to troubleshoot is to physically have one of the laptops and see if unchecking the box that validates the server certificate fixes the issue. I have seen the same issue as you are seeing before and I would like for you to verfiy that.
    If that doesnt fix the issue then we will have to proceed to taking a wireshark of the client and running a few debugs on the ACS.
    Thanks,
    Tarik Admani

  • Cisco ACS with External DB - EAP-TLS

    Hi Guys,
    I understand how the EAP-TLS exchange works (I think), but If I have a client (wireless or wired) that is using EAP-TLS with an ACS, can I confirm the following.
    Let say both user and computer certs are employed:
    1. Both Client and ACS perform check with each others certs to ensure they are know to each other. The eap-tls exchange.
    2a. At some stage and I am assuming before the eap-tls success message is sent back to the client, the ACS has to check if either the username or computer name is in the AD database?
    2b. Wot is the paramater that is checked against the AD database?
    I read here that it can be : http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/configuration/guide/peap_tls.html#wp999517
    Client Certificates
    Client Certificates are used to positively identify the user in EAP-TLS. They have no role in building the TLS tunnel and are not used for encryption. Positive identification is accomplished by one of three means:
    CN (or Name)Comparison-Compares the CN in the certificate with the username in the database. More information on this comparison type is included in the description of the Subject field of the certificate.
    SAN Comparison-Compares the SAN in the certificate with the username in the database. This is only supported as of ACS 3.2. More information on this comparison type is included in the description of the Subject Alternative Name field of the certificate.
    Binary Comparison-Compares the certificate with a binary copy of the certificate stored in the database (only AD and LDAP can do this). If you use certificate binary comparison, you must store the user certificate in a binary format. Also, for generic LDAP and Active Directory, the attribute that stores the certificate must be the standard LDAP attribute named "usercertificate".
    3. With the above, if options 1 or 2 are used (CN or SAN comparison), I assume this is just a check between a value pulled out of the CERT by the ACS and checked with AD, is that correct? With option 3, does the ACS perform a full compaison of the certificate between what the client has and a "client stored cert" on the AD DB?
    Please can someone help me with these points.
    I am so lost in this stuff :)) I think.
    Many thx and many kind regards,
    Ken

    only TLS *handshake* is completed/succcessful, but because user authentication fails,
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSLv3 read client key exchange A
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSLv3 read certificate verify A
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSLv3 read finished A
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSLv3 write change cipher spec A
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSLv3 write finished A
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSLv3 flush data
    CryptoLib.SSLConnection.pvServerInfoCB - Process TLS data: SSL state=SSL negotiation finished successfully
    EAP: EAP-TLS: Handshake succeeded
    EAP: EAP-TLS: Authenticated handshake
    EAP: EAP-TLS: Using CN from certificate as identity for authentication
    EAP: EAP state: action = authenticate, username = 'jatin', user identity = 'jatin'
    pvAuthenticateUser: authenticate 'jatin' against CSDB
    pvCopySession: setting session group ID to 0.
    pvCheckUnknownUserPolicy: session group ID is 0, calling pvAuthenticateUser.
    pvAuthenticateUser: authenticate 'jatin' against Windows Database
    External DB [NTAuthenDLL.dll]: Creating Domain cache
    External DB [NTAuthenDLL.dll]: Loading Domain Cache
    External DB [NTAuthenDLL.dll]: No UPN Suffixes Found
    External DB [NTAuthenDLL.dll]: Failed to get Domain Controller for trust dwacs.com, [Error = 1355]
    External DB [NTAuthenDLL.dll]: Failed to get Domain Controller for trust enigma.com, [Error = 1355]
    External DB [NTAuthenDLL.dll]: Failed to get Domain Controller for trust acsteam.com, [Error = 1355]
    External DB [NTAuthenDLL.dll]: Failed to get Domain Controller for trust vikram.com, [Error = 1355]
    External DB [NTAuthenDLL.dll]: Domain cache loaded
    External DB [NTAuthenDLL.dll]: Could not find user jatin [0x00005012]
    External DB [NTAuthenDLL.dll]: User jatin was not found
    pvCheckUnknownUserPolicy: setting session group ID to 0.
    Unknown User 'jatin' was not authenticated
    So the EAP-Failure(Radius Access-Reject( is sent, not EAP-Success(Radius Access-Accept).
    And any port/point wont be allowed to pass traffic unless the NAS device gets an EAP-Success(Radius Accept) for the user.
    HTH
    Regards,
    Prem

  • EAP-TLS with machine certificate

    Hello all,
    I'm looking for a solution to authenticate both machine and wireless users. I've been finding out solutions like EAP-TLS using the machine certificate to stablished the tunnel and authenticating user credentials (LDAP store) over this tunnel. Now i want to know if is possible to use this configuration using an ACS Radius servers and what SOs are supported to do this without external supplicants (Windows XP, Windows 7, Windows 8, iOs, Android...).
    Thanks a lot.
    Best regards.

    Hi Alfonso, 
    Certificate Retrieval for EAP-TLS Authentication
    ACS 5.4 supports certificate retrieval for user or machine authentication that uses EAP-TLS protocol. The user or machine record on AD includes a certificate attribute of binary data type. This can contain one or more certificates. ACS refers to this attribute as userCertificate and does not allow you to configure any other name for this attribute. 
    ACS retrieves this certificate for verifying the identity of the user or machine. The certificate authentication profile determines the field (SAN, CN, SSN, SAN-Email, SAN-DNS, or SAN-other name) to be used for retrieving the certificates. 
    After ACS retrieves the certificate, it performs a binary comparison of this certificate with the client certificate. When multiple certificates are received, ACS compares the certificates to check if one of them match. When a match is found, ACS grants the user or machine access to the network. 
    Configuring CA Certificates
    When a client uses the EAP-TLS protocol to authenticate itself against the ACS server, it sends a client certificate that identifies itself to the server. To verify the identity and correctness of the client certificate, the server must have a preinstalled certificate from the Certificate Authority (CA) that has digitally signed the client certificate. 
    If ACS does not trust the client's CA certificate, then you must install in ACS the entire chain of successively signed CA certificates, all the way to the top-level CA certificate that ACS trusts. CA certificates are also known as trust certificates. 
    You use the CA options to install digital certificates to support EAP-TLS authentication. ACS uses the X.509 v3 digital certificate standard. ACS also supports manual certificate acquisition and provides the means for managing a certificate trust list (CTL) and certificate revocation lists (CRLs). 
    Digital certificates do not require the sharing of secrets or stored database credentials. They can be scaled and trusted over large deployments. If managed properly, they can serve as a method of authentication that is stronger and more secure than shared secret systems. 
    Mutual trust requires that ACS have an installed certificate that can be verified by end-user clients. This server certificate may be issued from a CA or, if you choose, may be a self-signed certificate
    Also check the below link,  
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/users_id_stores.html#wp1170404

  • EAP-TLS Questions....

    Hi all,
    My setup is like this..
    Laptop - LWAPP - WLC - ACS - AD
    I m using CA to generate certificate.. I have configured EAP-TLS on WLC & ACS SE. Everything is working fine ie when i issue a certificate from CA on my AD login name & install that certificate i m able to connect to WLAN.. For security on WLC i have enable WPA & 802.1x...
    What i want is that when i boot up the laptop it should directly get connected to Wireless network & whne i try to login using my user name & password it should prompt for if my password is expired or something & get connected to AD. But this is not happening which use to happen when we were using peap as it ask for username & paswword to connect but not in case of EAP_TLS it only check for valid certificates....
    Thanks in advance..
    regards,
    piyush

    Hi Fella,
    i had one more issue ie want to do perform machine authentication as the laptops boot up along with the user authentication hen the users logs in.
    I had set AuthMode value to 1 for it. But how should i check on my ACS SE that the machine is authenticated or not & is it possible that during login using username & password the WLAN should get connected as it is for ethernet LAN.
    Thanks for ur reply..
    Piyush

  • ISE - dot1x EAP TLS for Cisco IP Phones

    Hi Gents,
    I have a question about the CA configs for ISE or ACS.
    As I understand, LSC certificate is issued by the CUCM by its Certificate Authority Proxy Function. If an IP Phone needs to be authenticated by its LSC (Locally Significant Certificate), which of the following CA we need to trust:
    1. Cisco CA Certificate
    2. CUCM Locally signed Certificate or CUCM Identity Certificate
    And if these certificates are imported into ISE/ACS, will the ISE/ACS will be able to authenticate the IP Phone if the dot1x EAP-TLS authentication is enabled for IP Phones?
    Is there any other configs needed?
    I would highly appreicate if someone can clearify me this process.
    Regards,

    I got the answer, for the first part of the EAP TLS authentication: Phone authentication
    In an IEEE 802.1X authentication, the AAA server  is responsible for validating the certificate provided by the phone. To  do this, the AAA server must have a copy of the root CA certificate that  signed the phone's certificate. The root certificates for both LSCs and  MICs can be exported from the CUCM Operating System Administration  interface and imported into your AAA server
    http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-605524.html#wp9000412
    As this is EAP TLS, Server (ISE/ACS) is also required to authenticate itself to the phone.
    What is needed for this?

  • EAP-TLS and getting a new user to log in on a wireless network

    I have setup EAP-TLS using AP1232 + ACS + CA + Active Directory + some wireless client machines. Works fine.
    My issue is when I have a new user, who has never logged onto the client workstation. I know that if I attach the workstation to a wired network and have the user login, request a cert, issue it, and install it, the wireless will work once I have the wired connection disabled and wireless enabled. However, that kinda defeats the purpose of a WLAN.
    How can I get my new users in? After all, getting associated to the AP depends on the user cert, which depends on the ability to get to the network in the first place to request/install a cert.
    After further reading and research, I believe that my delima will be fixed by configuring EAP-TLS Machine Authentication. What I'd like to know is whether the CA in this scenario MUST be an Enterprise Root CA or can it be a Standalone CA?
    Paras

    check the below link and read server requirements.
    http://support.microsoft.com/default.aspx?scid=kb;en-us;814394
    The stanalone ca needs to be trusted by AD
    http://groups.google.co.uk/group/microsoft.public.win2000.security/browse_thread/thread/1cf098c0dfa97ca0/b964dd05c12fd3fb?lnk=st&q=eap-tls+certificates+standalone+root&rnum=2&hl=en#b964dd05c12fd3fb
    What windows are you using? The default behaviour of windows is it do user authentication.You would need to play with registry to make systems to do only machine authentication.
    You would need connectivity when you want install the ca certificate, or else allow open authentication on the access point to have the connectivity and once the certificates are installed disable it.
    Please rate the post if it helps

Maybe you are looking for