Wildcard Certificats and 4400 WLC

First, I know the 4400 has been EOS. I am planning on replacing this with a new controller next year as part of a larger project. In the meantime, the certificate we have setup on our guest network is due to expire soon.
I am pretty familiar with how to get a new certificate setup, but was wondering if anyone has had any experience at using a "wildcard" type certificate, instead of the standard webserver style cert?  (http://www.digicert.com/wildcard-ssl-certificates.htm)
Its my understanding that a wildcard certificate can be used for any type of server, but the server needs to support it.
Thanks.

All my recent install using a 3rd party certificate has been with installing a chained certificate.
Here is a doc that shows you how to combine a chained certificate and install it on a wlc.
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a77592.shtml
Sent from Cisco Technical Support iPhone App

Similar Messages

  • Installing wildcard certificate in a WLC (ver 7.0.240 and 7.5.102)

    Is it possible to install a widcard certificate for web auth in those versions?
    Is there any difference between this two versions.
    Are both of them versions supporting wildcards certificates?
    Here you have the log file resulting of installing the wildcart certificate in the wlc with v 7.0.240.
    *TransferTask: Nov 28 11:20:51.117: Memory overcommit policy changed from 0 to 1
    *TransferTask: Nov 28 11:20:51.319: Delete ramdisk for ap bunble
    *TransferTask: Nov 28 11:20:51.432: RESULT_STRING: TFTP Webauth cert transfer starting.
    *TransferTask: Nov 28 11:20:51.432: RESULT_CODE:1
    *TransferTask: Nov 28 11:20:55.434: Locking tftp semaphore, pHost=10.16.50.63 pFilename=/wild2013_priv.pem
    *TransferTask: Nov 28 11:20:55.516: Semaphore locked, now unlocking, pHost=10.16.50.63 pFilename=/wild2013_priv.pem
    *TransferTask: Nov 28 11:20:55.516: Semaphore successfully unlocked, pHost=10.16.50.63 pFilename=/wild2013_priv.pem
    *TransferTask: Nov 28 11:20:55.517: TFTP: Binding to local=0.0.0.0 remote=10.16.50.63
    *TransferTask: Nov 28 11:20:55.588: TFP End: 1666 bytes transferred (0 retransmitted packets)
    *TransferTask: Nov 28 11:20:55.589: tftp rc=0, pHost=10.16.50.63 pFilename=/wild2013_priv.pem
         pLocalFilename=cert.p12
    *TransferTask: Nov 28 11:20:55.589: RESULT_STRING: TFTP receive complete... Installing Certificate.
    *TransferTask: Nov 28 11:20:55.589: RESULT_CODE:13
    *TransferTask: Nov 28 11:20:59.590: Adding cert (5 bytes) with certificate key password.
    *TransferTask: Nov 28 11:20:59.590: RESULT_STRING: Error installing certificate.
    *TransferTask: Nov 28 11:20:59.591: RESULT_CODE:12
    *TransferTask: Nov 28 11:20:59.591: ummounting: <umount /mnt/download/ >/dev/null 2>&1>  cwd  = /mnt/application
    *TransferTask: Nov 28 11:20:59.624: finished umounting
    *TransferTask: Nov 28 11:20:59.903: Create ramdisk for ap bunble
    *TransferTask: Nov 28 11:20:59.904: start to create c1240 primary image
    *TransferTask: Nov 28 11:21:01.322: start to create c1240 backup image
    *TransferTask: Nov 28 11:21:02.750: Success to create the c1240 image
    *TransferTask: Nov 28 11:21:02.933: Memory overcommit policy restored from 1 to 0
    (Cisco Controller) >
    Would I have the same results in wlc with  v 7.5.102?
    Thank you.

    Hi Pdero,
    Please check out these docs:
    https://supportforums.cisco.com/thread/2052662
    http://netboyers.wordpress.com/2012/03/06/wildcard-certs-for-wlc/
    https://supportforums.cisco.com/thread/2067781
    https://supportforums.cisco.com/thread/2024363
    https://supportforums.cisco.com/community/netpro/wireless-mobility/security-network-management/blog/2011/11/26/generate-csr-for-third-party-cert-and-download-unchained-cert-on-wireless-lan-controller-wlc
    Regards
    Dont forget to rate helpful posts.

  • Wildcard Certificate and Wireless Lan Controller

    Hello,
    I'm working with wlc 5508 version 7.2.111.3 and I'm looking to use a wildcard certificate, I've just checked on the forum that there was a bug-id and it seems it's been closed with a workaround of not using wildcard certs, is it resolved now?
    If yes, could you indicate to me how can I proceed to install it quickly?
    Regards

    Hello,
    The bug was about bad behavior when the wildcard certificate is used. The status of the bug now is "Terminated". That means it was found that the root cause for this bug is not really a bug (bad description, normal behavior...etc).
    So, I think you can go with the wildcard certificat you have. The bug was opened on 5.2 version which is very old comparing to 7.2.
    Let us know how it goes.
    Regards,
    Amjad
    Rating useful replies is more useful than saying "Thank you"

  • Wildcard certificates and portal gateway

    Hi,
    I have configured our portal gateway as follows:
    hostname: gateway.domain.com
    supplier.domain.com --> gateway.domain.com/supplier
    employee.domain.com --> gateway.domain.com/employee
    In order to get rid of the warning messages while connecting with the gateway, we plan to install a server certificate signed by Thawte. Because we have multiple hostnames (supplier and employee) I decided to give it a go with a trial wildcard certificate. I got this certificate from the thawte website and installed it using certadmin.
    Everything works fine with IE6.5 but when I try to connect with the gateway with netscape communicator (4.5 and 4.7) i get the following error:
    ...improperly formatted DER-encoded message.
    Did anyone experience the same error? Is it a browser issue, or did I request the wrong certificate type?
    --regards, Jordi                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           

    Seems to be more of a browser issue rather than a gateway issue, however try getting a cert like gateway.domain.com and see if that works fine instead of the wild character ..

  • 1140 and 4400 WLC detection issues.

    I am not able to get our 4400 WLC to detect a new AIR-AP1142N-A-K9. (1140 series).
    I have given the interface bvi1 an ip address and subnet mask that the controller should pick up.
    The software version of the 4400 WLC is 7.0.230.0.
    The software version of the AIR-AP1142N-A-K9 is C1140-K9W7-M.
    I am able to connect older AIR-LAP1242AG-A-K9 units without any problem using the LWAPP commands but this unit does not seem to support these commands?

    I obtained the Wireless LAN LWAPP Upgrade and Recovery Image for 1140 Series (c1140-rcvk9w8-tar.124-21a.JA2.tar) and issued the following command:
    "archive download-sw /force-reload /overwrite tftp://TFTPSERVER/c1140-rcvk9w8-mx"
    I receive the following error:
    "%tar checksum error in fd 0 ERROR: Failed to extract from archive file tftp://TFTPSERVER/c1140-rcvk9w8-mx"
    Is this the correct image?

  • Problem: Mixed Exchange 2007 / 2013 CAS Servers with wildcard certificates in Europe and non-wildcard Certficate in China

    Hi,
    we have following problem. We have a mixed multi-domain one-forest AD environment. We also have still a mixed exchange 2007 / 2013 environment. We also have different CAS Servers for 2007 SP3 (RU15) and 2013 (CU8) in europe and one 2007 SP3 (RU15) CAS Server
    in China, because of bad connection to Europe. For the Migration to 2013 in Europe we installed a wildcard-certificate *.xyz.com and used the Set-OutlookProvider EXPR -CertPrincipalName msstd:*.xyz.com, so the wildcard certificate is accepted. Everything in
    Europe works fine, inside and outside also between exchange 2007 and 2013 (both CAS Server 2013 and 2007 use the same wildcard certificate). But since the change of the Set-OutlookProvider EXPR we are facing problems with our CAS Server in China, because this
    server has a different non-wildcard certificate and a different domain name (cas-server.xyz-china.com instead xyz.com). Now we have the problem that this Chinese CAS server the Outlook Anywhere does not work anymore and prompts always for the username. As
    I see it is because of the EXPR change. Is it possible to set the the Outlook-Provider EXPR per Cas-Server ? (They also have their own Autodiscover on this front-end server). Because I see that the Outlook-Provider can only be stored forest-wide.
    If not the other solution would be to register the chinese cas server in our xyz.com domain and use the same wildcard certificate on this system right ?
    Any help would be appreciate….

    Yes setting the EXPR value is most likely the cause of your issue.  When you set this value you are telling Outlook to only accept connections from connections that have the cert with the subject name you specify here.
    Unfortunately, based on my experience I believe this is an organization wide setting and cannot be configured on a CAS by CAS basis (If I'm wrong someone please keep me honest :)).  
    So the only option would you have is to change all the URLs to be on *.xyz.com domain.  There's no need to change the domain the server actually resides on.  The other option would be to purchase a UCC Cert with all the names you need and apply
    to all your CAS servers and reset the EXPR value. 
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread

  • ISE 1.3 - wildcard certificate

    How to install an external wildcard certificate for SSL on ISE 1.3 and get it running for a guest portal ?
    Follow this links for guidance:
    Cisco Identity Services Engine Admin Guide, Release 1.3
    http://www.networkworld.com/article/2225032/infrastructure-management/what-are-wildcard-certificates-and-how-do-i-use-them-with-ciscos-ise.html
    https://supportforums.cisco.com/discussion/12305836/installing-wildcard-cert-ise-httpeap
    see Recording of Tech Talk Security: BYOD, Integrated CA, Multi-AD WebSession from November 6, 2014 of Aaron Woland
    and now.....     RESTART your ISE engine !
     ISE need to get restarted to bind the intermediate and the wildcard certificate which will
    send to the client for SSL. The client can now validate the certificates in the chain.
    Currently the restart is not documented by Cisco and there is no warning message to restart the ISE engine.

    Hi,
    You would have to restart the services, there is a note in the Cisco ISE document. Please refer it below:
    If you are using Firefox and Internet Explorer 8 browsers and you change the HTTPS local certificate on a node, existing browser sessions connected to that node do not automatically switch over to the new certificate. You must restart your browser to see the new certificate.
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_cert.html#pgfId-1183856
    Regards,
    Tushar Bangia
    Note : Please do rate post if you find it helpful!!

  • Implementing Wildcard Certificate on SQL Server

    Hi,
    I've been trying to configure WildCard Certificate and no matter what I do, the certificates I create and import into local store do not show up in the "Protocols for ...." window.
    In my opinion what is missing is a complete guide or document to show how to configure and implement
    wildcard certificates for SQL Server
    regards

    Hi ArashMasroor,
    According to your description, you need to install a  certificate on a computer that is running Microsoft SQL Server by using Microsoft Management Console (MMC), then you can request certificates for a SQL Server stand-alone server, and
    then use the certificate for Secure Sockets Layer (SSL) encryption.
    After you successfully install the certificate, the certificate does not appear in the Certificate list on the Certificate tab, the error occurs because you may have installed an invalid certificate. You must ensure the certificate meets the following requirements.
    1. You have a private key that corresponds to this certificate.
    2. On the Details tab, the value for the Subject field must be server name.
    3. The value for the Enhanced Key Usage field must be Server Authentication (<number>).
    4. On the Certification Path tab, the server name must appear under Certification path.
    For using the MMC snap-in to install the certificate on the server, you can review the following articles.
    http://support.microsoft.com/kb/316898
    http://technet.microsoft.com/en-us/library/dd851419.aspx
    Regards,
    Sofiya Li
    Sofiya Li
    TechNet Community Support

  • VPN Cluster and Wildcard Certificate

    Hi,
    I am setting up a VPN cluster with three ASA boxes and i am wondering if anyone has any experience using a wildcard certificate with this kind of setup.
    I am done with the setup and everything works fine, but as my initial setup (and the doc i have been reading) shows, the client first connect to:
    cluster.domain.com
    Then the master returns the address or fqdn (i am using fqdn) of the least busy asa in the cluster:
    vpn01.domain.com
    or
    vpn02.domain.com
    or
    vpn03.domain.com
    Thus i would need 4 certificates to meet my needs. The cluster.domain.com certificate also must be present on all 3 boxes, because the cluster ip is configured on all boxes, and the master role is shifted if one of the boxes fail.
    Because of this i thought it would be a good idea to use 1 wildcard certificate (*.doman.com) on all boxes and avoid the hassle.
    Any experience or recommendations?
    BR,
    /K

    Hello Kenneth,
    It was working for version before 9.
    On ASA9 you even can not install wildcard certificate to manage ASA via ASDM, so i guess vpn loadbalancing with wildcard certificate will not work either (but i have not tested that).
    And it's not a bug - it's a feature - it's a security device and wildcardard certificates are strongly discouraged
    Michal

  • HTTP adapter, SSL and wildcard certificate

    Hi,
    I am developing a B2B integration solution using BizTalk Server. The protocol used to communicate with the partner’s server is HTTPS and so it uses SSL.
    The certificate the partner is using to establish SSL connections is provided by GeoTrust but it is a wildcard certificate, issued to *.*.*.company.com
    The server I am trying to contact to is on a domain of the form: a.b.c.company.com (which seems to match the wildcard).
    When I try to open an HTTPS connection to the server (either through Internet Explorer, a .Net Windows Application or BizTalk), the connection cannot be established because the certificate is said to not be trusted. For example, Internet Explorer shows a pop-up message saying that:
    - The certificate is issued from a valid CA
    - The certificate date is valid
    - The name of the certificate is NOT matching the name of the site. This means that the certificate is issued for a domain different that the one we are accessing to. So it seems that the wildcard system is not working for this certificate? Is that possible if they aquire a wrong type of certificate by mistake? or is multipart wildcard certificate (*.*.*) not supported?
    Anyway even if their certificate is not 100% valid, they refuse to change it as their other partners work with that and they won't change to a proper certificate just for us...
    In .Net 2.0 code, it is easy to circumvent any certificate validation by setting the delegate ServicePointManager.ServerCertificateValidationCallback to a callback method with something like:
    ServicePointManager.ServerCertificateValidationCallback = delegate(Object obj, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors)  { return true; };
    Nevertheless, I need to achieve this sort of circumvention with BizTalk Server 2006 and I would like to know if anyone ever did that.
    I am aware that I can write my own custom HTTP Adapter but I need this urgently so I thought of asking this forum's community first. Maybe someone as a quicker way than writing a custom adapter such as some "hack" (registry keys, custom class... ) or knows of an existing custom adapter already doing the job.
    Thanks in advance,
    Best regards,
    Francois Malgreve

    The certificate needs to be installed as a explicitly trusted certificate in the store under the computer a/c on the BzTalk machine and then it'll work. Refer
    https://thinkintegration.wordpress.com/2011/12/02/biztalk-https-adapter-and-certificate-configurations/ for the steps.
    Regards.

  • Differences Between WLC 2000 and 4400 series

    Besides the supported number of access points, what are the differences in features between the WLC 2000 and 4400 series?

    On the 2006, you have 4 ports on the back, that can support up to 3 AP's being directly connected, and the other port as your connection to the network, and it does not support LAG (Link AGgregation). The ports are 10/100M, and it can not be an anchor for a mobility group.
    On the 4400, you either have a 4402 or a 4404,the 2 has 2 Gig interfaces, and the 4404 has 4 Gig interfaces, you can not connect AP's directly to a 4400. Both 4400's will support LAG, and they can be used as anchors in a mobility group. Those are the big differences in them. They configure up the same, and interact with the wired and wireless networks the same.

  • Rdpsign and wildcard certificate

    Hi,
    All is working fine with rdp sign and I can sign file with thumbprint of our wildcard certificate, but when running file I still have a message "Do you trust the publisher of this remote connection?". It's not yellow with warning, but a warning
    anyway. I can see a message:
    Publisher: *.domain.com (our wildcard certificate)
    Remote computer: rds.domain.com
    Gateway server: rdg.domain.com
    Is this normal for rdg files signed with wildcard cert used for RDS deployment?
    Best,
    Marcin

    Hi Marcin,
    Do you need any other assistance?
    Thanks.
    Dharmesh Solanki
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • WLC 5508 - 7.5.102.0 - Wildcard Certificates

    Does this controller/firmware support the use of a wildcard certificate? I'm using GoDaddy as our public CA.

    Yes, it does support.
    You may visit the below listed URL while generating the CSR or installing the certificates.
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • Diifference between WLC 2100 and 4400 and 5500

    Hi
    what is the difference between wire lan controllers(WLAN) 2100 and 4400 and 5500.

    Hello syed
    Cisco 5500 Series Controllers:
    The Cisco 5500 Series Wireless LAN Controller is currently available in one model: 5508. The 5508 controller supports up to 250 lightweight access points and 7000 wireless clients (or 5000 wireless clients and 2500 RFID tags when using the client location feature), making it ideal for large enterprises and high-density applications.
    Cisco 4400 Series Controllers:
    Because the Cisco 4400 Series Wireless LAN Controller supports 802.11a/b/g and the IEEE 802.11n draft 2.0 standard, organizations can deploy the solution that best meets their individual requirements. Organizations can offer robust coverage with 802.11 a/b/g or deliver greater performance with 5x the throughput and unprecedented reliability using 802.11n and Cisco's Next-Generation Wireless Solutions and Cisco Enterprise Wireless Mesh.
    The Cisco 4400 Series Wireless LAN Controller is available in two models. The Cisco 4402 Wireless LAN Controller with two 1 GB Ethernet ports comes in configurations that support 12, 25, and 50 access points. The Cisco 4404 Wireless LAN Controller with four 1 GB Ethernet ports supports 100 access points. The Cisco 4402 controller provides one expansion slot. The Cisco 4404 controller provides two expansion slots that can be used to add VPN termination.
    Cisco 2100 Series Controllers:
    These controllers are part of a Payment Card Industry (PCI) certified architecture, and are well suited for retail customers who deploy transactional data applications such as scanners and kiosks. With performance up to 100 Mbps, the Cisco 2100 Series Wireless LAN Controllers also enable small and medium branch offices to deploy collaboration applications such as guest access and mobile voice.

  • Problem with certificate authentication at wlc 4402

    Hi,
    we have a problem to get a connection from the client to the WLC. 
    we  are using Cisco Aironet 1130 AG and a Cisco 4402 WLC in our network. The certificate service is installed on a Windows 2008 R2 server. We use a standalone Root CA with a Enterprise Sub CA hierarchy. Issueing certificates to clients works fine. The vendor and ca certificates are installed on the WLC and the user have his user certificate. During implementation we used following document: "http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml#wlc". Instead of Anonymous Bind, we use a service user to read in AD (works fine, too).
    We use the Intel/PRO wireless utility on our Testclient and configured it for EAP-FAST and TLS. We can select the installed certificate in the utility, but when we try to connect, the utility throw the message: "Authentication failed due to an invalid certificate".
    We´ve logged the WLC and thats a part of the logfile (i´ve greyed out all enterprise data):
    *EAP Framework: Jan 18 12:08:21.921: EAP-AUTH-EVENT: Waiting for asynchronous reply from LL
    *LDAP DB Task 1: Jan 18 12:08:21.921: ldapTask [1] received msg 'REQUEST' (2) in state 'IDLE' (1)
    *LDAP DB Task 1: Jan 18 12:08:21.922: LDAP server 1 changed state to INIT
    *LDAP DB Task 1: Jan 18 12:08:21.922: LDAP_OPT_REFERRALS = -1*LDAP DB Task 1: Jan 18 12:08:21.925: LDAP_CLIENT: UID Search (...)))
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: ldap_search_ext_s returns 0 85
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: Returned 2 msgs including 0 references
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: Returned msg 1 type 0x64
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: Received 1 attributes in search entry msg
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT: Returned msg 2 type 0x65
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT : No matched DN
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT : Check result error 0 rc 1013
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT: Received no referrals in search result msg
    *LDAP DB Task 1: Jan 18 12:08:21.927: ldapAuthRequest [1] called lcapi_query base="..." (rc = 0 - Success)
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP ATTR> dn = CN=... (size 76)
    *LDAP DB Task 1: Jan 18 12:08:21.927: Handling LDAP response Success
    *LDAP DB Task 1: Jan 18 12:08:21.927: 18:3d:a2:0a:ec:bc [Response] Client requested no retries for mobile 18:3D:A2:0A:EC:BC
    *LDAP DB Task 1: Jan 18 12:08:21.927: 18:3d:a2:0a:ec:bc Returning AAA Success for mobile 18:3d:a2:0a:ec:bc
    *LDAP DB Task 1: Jan 18 12:08:21.927: AuthorizationResponse: 0x33a5affc*LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: Found context matching MAC address - 319
    *LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: (EAP:319) User credential callback invoked
    *LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: EAP Unable to find password in credentials. Skipped
    *LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: EAP Unable to find wlan in credentials. Skipped
    *LDAP DB Task 1: Jan 18 12:08:21.928: Authenticated bind : Closing the binded session*LDAP DB Task 1: Jan 18 12:08:21.928: ldapClose [1] called lcapi_close (rc = 0 - Success)
    *LDAP DB Task 1: Jan 18 12:08:21.929: LDAP server 1 changed state to IDLE
    *EAP Framework: Jan 18 12:08:21.930: EAP-EVENT: Received event 'EAP_LL_REPLY' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.930: EAP-AUTH-EVENT: Using credential profile name: ...(0x78000041)
    *EAP Framework: Jan 18 12:08:21.930: EAP-AUTH-EVENT: Maximum EAP packet size: 1000
    *EAP Framework: Jan 18 12:08:21.930: EAP-AUTH-EVENT: Sending method new context directive for EAP context 0x78000041
    *EAP Framework: Jan 18 12:08:21.930: EAP-EVENT: Sending method directive 'New Context' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.930: eap_fast.c-EVENT: New context (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:21.931: id_manager.c-AUTH-SM: Got new ID f700000e - id_get
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c-EVENT: Allocated new EAP-FAST context (handle = 0xF700000E)
    *EAP Framework: Jan 18 12:08:21.931: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:21.931: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-EVENT: Received Identity
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_tlv.c-AUTH-EVENT: Adding PAC A-ID TLV (436973636f0000000000000000000000)
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-EVENT: Sending Start
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-SM: Changing state: Reset -> Start
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c:138: Version: 1  Flags:S  Length:0x0014
    *EAP Framework: Jan 18 12:08:21.931: eap_core.c:1422:     Payload:  00040010436973636F00000000000000 ...
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:21.931: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x001a  Type:FAST
    *EAP Framework: Jan 18 12:08:21.932: eap_core.c:1422:     Payload:  2100040010436973636F000000000000 ...
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:21.932: eap_core.c:1484: Code:REQUEST  ID:0x 2  Length:0x001a  Type:FAST
    *EAP Framework: Jan 18 12:08:21.932: eap_core.c:1422:     Payload:  2100040010436973636F000000000000 ...
    *EAP Framework: Jan 18 12:08:21.932: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.932: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:21.932: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.932: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:21.932: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:21.932: AuthorizationResponse: 0x13c713fc*EAP Framework: Jan 18 12:08:21.934: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 1a
    *EAP Framework: Jan 18 12:08:21.934: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.290: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.290: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.290: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 2) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.291: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.291: eap_core.c:1484: Code:RESPONSE  ID:0x 2  Length:0x0042  Type:FAST
    *EAP Framework: Jan 18 12:08:22.291: eap_core.c:1422:     Payload:  810000003816030100330100002F0301 ...
    *EAP Framework: Jan 18 12:08:22.291: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.292: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.292: eap_fast.c-AUTH-EVENT: Process Response, type: 0x2b
    *EAP Framework: Jan 18 12:08:22.292: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:22.292: eap_fast_auth.c-RX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.292: eap_core.c:1484: Code:RESPONSE  ID:0x 2  Length:0x0042  Type:FAST
    *EAP Framework: Jan 18 12:08:22.292: eap_core.c:1422:     Payload:  810000003816030100330100002F0301 ...
    *EAP Framework: Jan 18 12:08:22.292: eap_fast_auth.c-AUTH-EVENT: Received TLS record type: Handshake in state: Start
    *EAP
    Framework: Jan 18 12:08:22.292: EAP-EVENT: Sending lower layer event
    'EAP_GET_CREDENTIAL_PROFILE_FROM_PROFILE_NAME' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.292: LOCAL_AUTH: Found matching context for id - 319
    *EAP
    Framework: Jan 18 12:08:22.292: LOCAL_AUTH: (EAP:319) Returning profile
    *EAP Framework: Jan 18 12:08:22.293: IOS_PKI_SHIM: [StartSession] - New session 0x335ee108 started (TP = 'vendor')
    *EAP Framework: Jan 18 12:08:22.293: IOS_PKI_SHIM: [StartSession] - Trustpoint identity (cert) set to 'Vendor'
    *EAP
    Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Subject : ...
    *EAP Framework: Jan 18
    12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Issuer : ...
    *EAP Framework: Jan 18
    12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Valid from '2012 Jan 12th,
    17:06:50 GMT' to '2016 Jan 11th, 17:06:50 GMT'
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Is not a CA cert
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: Added cert (type 1) to chain (1 present on chain)
    *EAP
    Framework: Jan 18 12:08:22.300: IOS_PKI_SHIM: [CA-CERT] Subject :
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [CA-CERT] Issuer : CN=...
    *EAP
    Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [CA-CERT] Valid from
    '2012 Jan 12th, 16:54:49 GMT' to '2020 Jan 12th, 17:04:49 GMT'
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [CA-CERT] Is a CA cert
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: Added cert (type 2) to chain (2 present on chain)
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [StartSession] - Getting older style priv key
    *EAP Framework: Jan 18 12:08:22.338: IOS_PKI_SHIM: Session 0x335ee108 init'd OK
    *EAP Framework: Jan 18 12:08:22.338: eap_fast_auth.c-AUTH-EVENT: Local certificate found
    *EAP Framework: Jan 18 12:08:22.339: eap_fast_auth.c-AUTH-EVENT: Reading Client Hello handshake
    *EAP Framework: Jan 18 12:08:22.339: eap_fast.c:286: EAP-FAST-AUTH-RX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.339: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0033
    *EAP Framework: Jan 18 12:08:22.339: eap_core.c:1422:     Payload:  0100002F03014F16A8262631FC9DC042 ...
    *EAP Framework: Jan 18 12:08:22.340: eap_fast.c:202: Handshake type:Client Hello  Length:0x002F
    *EAP Framework: Jan 18 12:08:22.340: eap_core.c:1422:     Payload:  03014F16A8262631FC9DC042253D3E24 ...
    *EAP Framework: Jan 18 12:08:22.340: eap_fast_auth.c-AUTH-EVENT: TLS_RSA_WITH_AES_128 proposed...
    *EAP Framework: Jan 18 12:08:22.341: eap_fast_auth.c-AUTH-EVENT: TLS_DHE_RSA_WITH_AES_128_CBC_SHA proposed...
    *EAP Framework: Jan 18 12:08:22.341: eap_fast_auth.c-AUTH-EVENT: TLS_RSA_WITH_RC4_128 proposed...
    *EAP Framework: Jan 18 12:08:22.341: eap_fast_auth.c-AUTH-EVENT: TLS_DH_anon_WITH_AES_128_CBC_SHA proposed...
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT: Proposed ciphersuite(s):
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT:     TLS_RSA_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT:     TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT:     TLS_RSA_WITH_RC4_128_SHA
    *EAP Framework: Jan 18 12:08:22.343: eap_fast.c-EVENT:     TLS_DH_anon_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.343: eap_fast.c-EVENT: Selected ciphersuite:
    *EAP Framework: Jan 18 12:08:22.343: eap_fast.c-EVENT:     TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.343: eap_fast_auth.c-AUTH-EVENT: Building Provisioning Server Hello
    *EAP Framework: Jan 18 12:08:22.344: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.344: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x002A
    *EAP Framework: Jan 18 12:08:22.344: eap_core.c:1422:     Payload:  0200002603015F3325EADF12E6296F91 ...
    *EAP Framework: Jan 18 12:08:22.344: eap_fast.c:202: Handshake type:Server Hello  Length:0x0026
    *EAP Framework: Jan 18 12:08:22.345: eap_core.c:1422:     Payload:  03015F3325EADF12E6296F91530FE67F ...
    *EAP Framework: Jan 18 12:08:22.345: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.345: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0B54
    *EAP Framework: Jan 18 12:08:22.346: eap_core.c:1422:     Payload:  0B000B50000B4D00059F3082059B3082 ...
    *EAP Framework: Jan 18 12:08:22.346: eap_fast.c:202: Handshake type:Certificate  Length:0x0B50
    *EAP Framework: Jan 18 12:08:22.346: eap_core.c:1422:     Payload:  000B4D00059F3082059B30820483A003 ...
    *EAP Framework: Jan 18 12:08:22.347: eap_fast_crypto.c-EVENT: Starting Diffie Hellman phase 1 ...
    *EAP Framework: Jan 18 12:08:22.661: eap_fast_crypto.c-EVENT: Diffie Hellman phase 1 complete
    *EAP Framework: Jan 18 12:08:22.677: IOS_PKI_SHIM: PKI_SignMessage PostHashEncrypt ret SUCCESS.. op_len 128
    *EAP Framework: Jan 18 12:08:22.678: eap_fast_auth.c-AUTH-EVENT: DH signature length = 128
    *EAP Framework: Jan 18 12:08:22.678: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.678: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x028D
    *EAP Framework: Jan 18 12:08:22.679: eap_core.c:1422:     Payload:  0C0002890100FFFFFFFFFFFFFFFFC90F ...
    *EAP Framework: Jan 18 12:08:22.679: eap_fast.c:202: Handshake type:Server Key Exchange  Length:0x0289
    *EAP Framework: Jan 18 12:08:22.679: eap_core.c:1422:     Payload:  0100FFFFFFFFFFFFFFFFC90FDAA22168 ...
    *EAP Framework: Jan 18 12:08:22.679: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.680: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x000B
    *EAP Framework: Jan 18 12:08:22.680: eap_core.c:1422:     Payload:  0D00000704030401020000
    *EAP Framework: Jan 18 12:08:22.680: eap_fast.c:202: Handshake type:Certificate Request  Length:0x0007
    *EAP Framework: Jan 18 12:08:22.680: eap_core.c:1422:     Payload:  04030401020000
    *EAP Framework: Jan 18 12:08:22.681: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.681: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0004
    *EAP Framework: Jan 18 12:08:22.681: eap_core.c:1422:     Payload:  0E000000
    *EAP Framework: Jan 18 12:08:22.681: eap_fast.c:202: Handshake type:Server Done  Length:0x0000
    *EAP Framework: Jan 18 12:08:22.682: eap_fast_auth.c-AUTH-EVENT: Sending Provisioning Serving Hello
    *EAP Framework: Jan 18 12:08:22.682: eap_fast_auth.c-AUTH-SM: Changing state: Start -> Sent provisioning Server Hello
    *EAP Framework: Jan 18 12:08:22.682: eap_fast.c-EVENT: Tx packet fragmentation required
    *EAP Framework: Jan 18 12:08:22.683: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.683: eap_fast.c:138: Version: 1  Flags:LM  Length:0x03DE
    *EAP Framework: Jan 18 12:08:22.683: eap_core.c:1422:     Payload:  160301002A0200002603015F3325EADF ...
    *EAP Framework: Jan 18 12:08:22.684: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.684: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.684: eap_core.c:1422:     Payload:  C100000E33160301002A020000260301 ...
    *EAP Framework: Jan 18 12:08:22.684: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.685: eap_core.c:1484: Code:REQUEST  ID:0x 3  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.686: eap_core.c:1422:     Payload:  C100000E33160301002A020000260301 ...
    *EAP Framework: Jan 18 12:08:22.686: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.686: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.686: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.686: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.687: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.687: AuthorizationResponse: 0x13c713fc*EAP Framework: Jan 18 12:08:22.755: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 297
    *EAP Framework: Jan 18 12:08:22.755: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.830: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.830: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.830: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 6) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.831: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.831: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.831: eap_core.c:1484: Code:RESPONSE  ID:0x 6  Length:0x015c  Type:FAST
    *EAP Framework: Jan 18 12:08:22.831: eap_core.c:1422:     Payload:  810000015216030100070B0000030000 ...
    *EAP Framework: Jan 18 12:08:22.831: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.831: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.832: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.832: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.832: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c-AUTH-EVENT: Process Response, type: 0x2b
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-RX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1484: Code:RESPONSE  ID:0x 6  Length:0x015c  Type:FAST
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1422:     Payload:  810000015216030100070B0000030000 ...
    *EAP
    Framework: Jan 18 12:08:22.832: eap_fast_auth.c-AUTH-EVENT: Received
    TLS record type: Handshake in state: Sent provisioning Server Hello
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-AUTH-EVENT: Reading Client Certificate handshake
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c:286: EAP-FAST-AUTH-RX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0007
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1422:     Payload:  0B000003000000
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c:202: Handshake type:Certificate  Length:0x0003
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1422:     Payload:  000000
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c-EVENT: Client Certificate handshake empty
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-EVENT: Rx'd I-ID: "EAP-FAST I-ID" from Peer Cert
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-ERROR: Required cert not provided by client
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:255: Content:Alert  Version:0301  Length:0x0002
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1422:     Payload:  0228
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-SM: Changing state: Sent provisioning Server Hello -> Alert
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:138: Version: 1  Flags:L  Length:0x0007
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1422:     Payload:  15030100020228
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x0011  Type:FAST
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1422:     Payload:  810000000715030100020228
    *EAP Framework: Jan 18 12:08:22.833: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-EVENT: EAP method decision: Fail
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.834: eap_core.c:1484: Code:REQUEST  ID:0x 7  Length:0x0011  Type:FAST
    *EAP Framework: Jan 18 12:08:22.834: eap_core.c:1422:     Payload:  810000000715030100020228
    *EAP Framework: Jan 18 12:08:22.834: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.834: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.834: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.834: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.834: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.834: AuthorizationResponse: 0x13c713fc
    We think that the reason why it didn´t work, is the part:
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c-EVENT: Client Certificate handshake empty
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-EVENT: Rx'd I-ID: "EAP-FAST I-ID" from Peer Cert
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-ERROR: Required cert not provided by client
    But we aren´t sure.
    Maybe anyone can help us. Many thanks in advance.
    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2012.01.18 12:08:18 =~=~=~=~=~=~=~=~=~=~=~=
    debug aaa all disable                     debug aaa all enable(Cisco Controller) >*Dot1x_NW_MsgTask_0: Jan 18 12:08:21.917: 18:3d:a2:0a:ec:bc Audit Session ID added to the mscb: 0a63081e000000994f16a825
    *Dot1x_NW_MsgTask_0: Jan 18 12:08:21.917: Creating audit session ID (dot1x_aaa_eapresp_supp) and Radius Request
    *aaaQueueReader: Jan 18 12:08:21.917: AuthenticationRequest: 0x30b52e90
    *aaaQueueReader: Jan 18 12:08:21.917: Callback.....................................0x10b7803c*aaaQueueReader: Jan 18 12:08:21.917: protocolType.................................0x00140001*aaaQueueReader: Jan 18 12:08:21.917: proxyState...................................18:3D:A2:0A:EC:BC-02:00*aaaQueueReader: Jan 18 12:08:21.917: Packet contains 16 AVPs (not shown)*aaaQueueReader: Jan 18 12:08:21.917: 18:3d:a2:0a:ec:bc [Error] Client requested no retries for mobile 18:3D:A2:0A:EC:BC
    *aaaQueueReader: Jan 18 12:08:21.918: 18:3d:a2:0a:ec:bc Returning AAA Error 'No Server' (-7) for mobile 18:3d:a2:0a:ec:bc
    *aaaQueueReader: Jan 18 12:08:21.918: AuthorizationResponse: 0x3e04bd08
    *aaaQueueReader: Jan 18 12:08:21.918: structureSize................................32*aaaQueueReader: Jan 18 12:08:21.918: resultCode...................................-7*aaaQueueReader: Jan 18 12:08:21.918: protocolUsed.................................0xffffffff*aaaQueueReader: Jan 18 12:08:21.918: proxyState...................................18:3D:A2:0A:EC:BC-02:00*aaaQueueReader: Jan 18 12:08:21.918: Packet contains 0 AVPs:*aaaQueueReader: Jan 18 12:08:21.918: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:21.918: LOCAL_AUTH: Creating new context
    *aaaQueueReader: Jan 18 12:08:21.918: EAP-EVENT: Received context create from lower layer (0x0000013F)
    *aaaQueueReader: Jan 18 12:08:21.918: id_manager.c-AUTH-SM: Got new ID 78000041 - id_get
    *aaaQueueReader: Jan 18 12:08:21.918: EAP-EVENT: Received credential profile name: "(null)" from LL
    *aaaQueueReader: Jan 18 12:08:21.918: EAP-EVENT: Allocated new EAP context (handle = 0x78000041)
    *aaaQueueReader: Jan 18 12:08:21.919: LOCAL_AUTH: Created new context eap session handle 78000041
    *aaaQueueReader: Jan 18 12:08:21.919: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 1) to EAP subsys
    *EAP Framework: Jan 18 12:08:21.919: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.920: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:21.920: eap_core.c:1484: Code:RESPONSE  ID:0x 1  Length:0x002b  Type:IDENTITY
    *EAP Framework: Jan 18 12:08:21.920: eap_core.c:1422:     Payload:  416E6472652E54736368656E74736368 ...
    *EAP Framework: Jan 18 12:08:21.920: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:21.920: EAP-AUTH-EVENT: EAP Response type = Identity
    *EAP Framework: Jan 18 12:08:21.920: EAP-AUTH-EVENT: Received peer identity: [email protected]
    *EAP Framework: Jan 18 12:08:21.920: EAP-EVENT: Sending lower layer event 'EAP_GET_CREDENTIAL_PROFILE_FROM_USERNAME' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.920: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:21.921: LOCAL_AUTH: (EAP) Sending user credential request username '[email protected]' to LDAP
    *aaaQueueReader: Jan 18 12:08:21.921: AuthenticationRequest: 0x33a6ae18
    *aaaQueueReader: Jan 18 12:08:21.921: Callback.....................................0x10765234*aaaQueueReader: Jan 18 12:08:21.921: protocolType.................................0x00100002*aaaQueueReader: Jan 18 12:08:21.921: proxyState...................................18:3D:A2:0A:EC:BC-00:00*aaaQueueReader: Jan 18 12:08:21.921: Packet contains 2 AVPs (not shown)*EAP Framework: Jan 18 12:08:21.921: EAP-AUTH-EVENT: Waiting for asynchronous reply from LL
    *LDAP DB Task 1: Jan 18 12:08:21.921: ldapTask [1] received msg 'REQUEST' (2) in state 'IDLE' (1)
    *LDAP DB Task 1: Jan 18 12:08:21.922: LDAP server 1 changed state to INIT
    *LDAP DB Task 1: Jan 18 12:08:21.922: LDAP_OPT_REFERRALS = -1*LDAP DB Task 1: Jan 18 12:08:21.922: ldapInitAndBind [1] called lcapi_init (rc = 0 - Success)
    *LDAP DB Task 1: Jan 18 12:08:21.925: ldapInitAndBind [1] configured Method Authenticated lcapi_bind (rc = 0 - Success)
    *LDAP DB Task 1: Jan 18 12:08:21.925: LDAP server 1 changed state to CONNECTED
    *LDAP DB Task 1: Jan 18 12:08:21.925: disabled LDAP_OPT_REFERRALS*LDAP DB Task 1: Jan 18 12:08:21.925: LDAP_CLIENT: UID Search (base=DC=group,DC=jenoptik,DC=corp, pattern=(&(objectclass=Person)([email protected])))
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: ldap_search_ext_s returns 0 85
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: Returned 2 msgs including 0 references
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: Returned msg 1 type 0x64
    *LDAP DB Task 1: Jan 18 12:08:21.926: LDAP_CLIENT: Received 1 attributes in search entry msg
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT: Returned msg 2 type 0x65
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT : No matched DN
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT : Check result error 0 rc 1013
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP_CLIENT: Received no referrals in search result msg
    *LDAP DB Task 1: Jan 18 12:08:21.927: ldapAuthRequest [1] called lcapi_query base="DC=group,DC=jenoptik,DC=corp" type="Person" attr="userPrincipalName" user="[email protected]" (rc = 0 - Success)
    *LDAP DB Task 1: Jan 18 12:08:21.927: LDAP ATTR> dn = CN=Tschentscher\, Andre,OU=Users,OU=SSC,OU=JOAG,DC=group,DC=jenoptik,DC=corp (size 76)
    *LDAP DB Task 1: Jan 18 12:08:21.927: Handling LDAP response Success
    *LDAP DB Task 1: Jan 18 12:08:21.927: 18:3d:a2:0a:ec:bc [Response] Client requested no retries for mobile 18:3D:A2:0A:EC:BC
    *LDAP DB Task 1: Jan 18 12:08:21.927: 18:3d:a2:0a:ec:bc Returning AAA Success for mobile 18:3d:a2:0a:ec:bc
    *LDAP DB Task 1: Jan 18 12:08:21.927: AuthorizationResponse: 0x33a5affc
    *LDAP DB Task 1: Jan 18 12:08:21.927: structureSize................................180*LDAP DB Task 1: Jan 18 12:08:21.927: resultCode...................................0*LDAP DB Task 1: Jan 18 12:08:21.927: protocolUsed.................................0x00000002*LDAP DB Task 1: Jan 18 12:08:21.927: proxyState...................................18:3D:A2:0A:EC:BC-00:00*LDAP DB Task 1: Jan 18 12:08:21.928: Packet contains 2 AVPs:*LDAP DB Task 1: Jan 18 12:08:21.928:     AVP[01] Unknown Attribute 0......................CN=Tschentscher\, Andre,OU=Users,OU=SSC,OU=JOAG,DC=group,DC=jenoptik,DC=corp (76 bytes)*LDAP DB Task 1: Jan 18 12:08:21.928:     AVP[02] User-Name................................Andre.Tschentscher@group.jenoptik.corp (38 bytes)*LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: Found context matching MAC address - 319
    *LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: (EAP:319) User credential callback invoked
    *LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: EAP Unable to find password in credentials. Skipped
    *LDAP DB Task 1: Jan 18 12:08:21.928: LOCAL_AUTH: EAP Unable to find wlan in credentials. Skipped
    *LDAP DB Task 1: Jan 18 12:08:21.928: Authenticated bind : Closing the binded session*LDAP DB Task 1: Jan 18 12:08:21.928: ldapClose [1] called lcapi_close (rc = 0 - Success)
    *LDAP DB Task 1: Jan 18 12:08:21.929: LDAP server 1 changed state to IDLE
    *EAP Framework: Jan 18 12:08:21.930: EAP-EVENT: Received event 'EAP_LL_REPLY' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.930: EAP-AUTH-EVENT: Using credential profile name: [email protected] (0x78000041)
    *EAP Framework: Jan 18 12:08:21.930: EAP-AUTH-EVENT: Maximum EAP packet size: 1000
    *EAP Framework: Jan 18 12:08:21.930: EAP-AUTH-EVENT: Sending method new context directive for EAP context 0x78000041
    *EAP Framework: Jan 18 12:08:21.930: EAP-EVENT: Sending method directive 'New Context' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.930: eap_fast.c-EVENT: New context (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:21.931: id_manager.c-AUTH-SM: Got new ID f700000e - id_get
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c-EVENT: Allocated new EAP-FAST context (handle = 0xF700000E)
    *EAP Framework: Jan 18 12:08:21.931: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:21.931: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-EVENT: Received Identity
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_tlv.c-AUTH-EVENT: Adding PAC A-ID TLV (436973636f0000000000000000000000)
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-EVENT: Sending Start
    *EAP Framework: Jan 18 12:08:21.931: eap_fast_auth.c-AUTH-SM: Changing state: Reset -> Start
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c:138: Version: 1  Flags:S  Length:0x0014
    *EAP Framework: Jan 18 12:08:21.931: eap_core.c:1422:     Payload:  00040010436973636F00000000000000 ...
    *EAP Framework: Jan 18 12:08:21.931: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:21.931: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x001a  Type:FAST
    *EAP Framework: Jan 18 12:08:21.932: eap_core.c:1422:     Payload:  2100040010436973636F000000000000 ...
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:21.932: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:21.932: eap_core.c:1484: Code:REQUEST  ID:0x 2  Length:0x001a  Type:FAST
    *EAP Framework: Jan 18 12:08:21.932: eap_core.c:1422:     Payload:  2100040010436973636F000000000000 ...
    *EAP Framework: Jan 18 12:08:21.932: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.932: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:21.932: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:21.932: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:21.932: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:21.932: AuthorizationResponse: 0x13c713fc
    *EAP Framework: Jan 18 12:08:21.933: structureSize................................74*EAP Framework: Jan 18 12:08:21.933: resultCode...................................255*EAP Framework: Jan 18 12:08:21.933: protocolUsed.................................0x00000080*EAP Framework: Jan 18 12:08:21.933: proxyState...................................18:3D:A2:0A:EC:BC-02:00*EAP Framework: Jan 18 12:08:21.934: Packet contains 1 AVPs (not shown)*EAP Framework: Jan 18 12:08:21.934: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 1a
    *EAP Framework: Jan 18 12:08:21.934: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.290: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.290: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.290: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 2) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.291: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.291: eap_core.c:1484: Code:RESPONSE  ID:0x 2  Length:0x0042  Type:FAST
    *EAP Framework: Jan 18 12:08:22.291: eap_core.c:1422:     Payload:  810000003816030100330100002F0301 ...
    *EAP Framework: Jan 18 12:08:22.291: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.291: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.292: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.292: eap_fast.c-AUTH-EVENT: Process Response, type: 0x2b
    *EAP Framework: Jan 18 12:08:22.292: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:22.292: eap_fast_auth.c-RX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.292: eap_core.c:1484: Code:RESPONSE  ID:0x 2  Length:0x0042  Type:FAST
    *EAP Framework: Jan 18 12:08:22.292: eap_core.c:1422:     Payload:  810000003816030100330100002F0301 ...
    *EAP Framework: Jan 18 12:08:22.292: eap_fast_auth.c-AUTH-EVENT: Received TLS record type: Handshake in state: Start
    *EAP Framework: Jan 18 12:08:22.292: EAP-EVENT: Sending lower layer event 'EAP_GET_CREDENTIAL_PROFILE_FROM_PROFILE_NAME' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.292: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.292: LOCAL_AUTH: (EAP:319) Returning profile '[email protected]' (username '[email protected]')
    *EAP Framework: Jan 18 12:08:22.293: IOS_PKI_SHIM: [StartSession] - New session 0x335ee108 started (TP = 'vendor')
    *EAP Framework: Jan 18 12:08:22.293: IOS_PKI_SHIM: [StartSession] - Trustpoint identity (cert) set to 'Vendor'
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Subject : C=DE, ST=Thuringia, L=Jena, O=Jenoptik AG, OU=Jenoptik SSC GmbH, CN=Cisco WLC 1st, [email protected]
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Issuer : DC=corp, DC=jenoptik, CN=Jenoptik WLAN Certificate Authority
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Valid from '2012 Jan 12th, 17:06:50 GMT' to '2016 Jan 11th, 17:06:50 GMT'
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: [ID-CERT] Is not a CA cert
    *EAP Framework: Jan 18 12:08:22.297: IOS_PKI_SHIM: Added cert (type 1) to chain (1 present on chain)
    *EAP Framework: Jan 18 12:08:22.300: IOS_PKI_SHIM: [CA-CERT] Subject : DC=corp, DC=jenoptik, CN=Jenoptik WLAN Certificate Authority
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [CA-CERT] Issuer : CN=Jenoptik Certificate Authority
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [CA-CERT] Valid from '2012 Jan 12th, 16:54:49 GMT' to '2020 Jan 12th, 17:04:49 GMT'
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [CA-CERT] Is a CA cert
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: Added cert (type 2) to chain (2 present on chain)
    *EAP Framework: Jan 18 12:08:22.301: IOS_PKI_SHIM: [StartSession] - Getting older style priv key
    *EAP Framework: Jan 18 12:08:22.338: IOS_PKI_SHIM: Session 0x335ee108 init'd OK
    *EAP Framework: Jan 18 12:08:22.338: eap_fast_auth.c-AUTH-EVENT: Local certificate found
    *EAP Framework: Jan 18 12:08:22.339: eap_fast_auth.c-AUTH-EVENT: Reading Client Hello handshake
    *EAP Framework: Jan 18 12:08:22.339: eap_fast.c:286: EAP-FAST-AUTH-RX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.339: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0033
    *EAP Framework: Jan 18 12:08:22.339: eap_core.c:1422:     Payload:  0100002F03014F16A8262631FC9DC042 ...
    *EAP Framework: Jan 18 12:08:22.340: eap_fast.c:202: Handshake type:Client Hello  Length:0x002F
    *EAP Framework: Jan 18 12:08:22.340: eap_core.c:1422:     Payload:  03014F16A8262631FC9DC042253D3E24 ...
    *EAP Framework: Jan 18 12:08:22.340: eap_fast_auth.c-AUTH-EVENT: TLS_RSA_WITH_AES_128 proposed...
    *EAP Framework: Jan 18 12:08:22.341: eap_fast_auth.c-AUTH-EVENT: TLS_DHE_RSA_WITH_AES_128_CBC_SHA proposed...
    *EAP Framework: Jan 18 12:08:22.341: eap_fast_auth.c-AUTH-EVENT: TLS_RSA_WITH_RC4_128 proposed...
    *EAP Framework: Jan 18 12:08:22.341: eap_fast_auth.c-AUTH-EVENT: TLS_DH_anon_WITH_AES_128_CBC_SHA proposed...
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT: Proposed ciphersuite(s):
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT:     TLS_RSA_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT:     TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.342: eap_fast.c-EVENT:     TLS_RSA_WITH_RC4_128_SHA
    *EAP Framework: Jan 18 12:08:22.343: eap_fast.c-EVENT:     TLS_DH_anon_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.343: eap_fast.c-EVENT: Selected ciphersuite:
    *EAP Framework: Jan 18 12:08:22.343: eap_fast.c-EVENT:     TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    *EAP Framework: Jan 18 12:08:22.343: eap_fast_auth.c-AUTH-EVENT: Building Provisioning Server Hello
    *EAP Framework: Jan 18 12:08:22.344: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.344: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x002A
    *EAP Framework: Jan 18 12:08:22.344: eap_core.c:1422:     Payload:  0200002603015F3325EADF12E6296F91 ...
    *EAP Framework: Jan 18 12:08:22.344: eap_fast.c:202: Handshake type:Server Hello  Length:0x0026
    *EAP Framework: Jan 18 12:08:22.345: eap_core.c:1422:     Payload:  03015F3325EADF12E6296F91530FE67F ...
    *EAP Framework: Jan 18 12:08:22.345: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.345: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0B54
    *EAP Framework: Jan 18 12:08:22.346: eap_core.c:1422:     Payload:  0B000B50000B4D00059F3082059B3082 ...
    *EAP Framework: Jan 18 12:08:22.346: eap_fast.c:202: Handshake type:Certificate  Length:0x0B50
    *EAP Framework: Jan 18 12:08:22.346: eap_core.c:1422:     Payload:  000B4D00059F3082059B30820483A003 ...
    *EAP Framework: Jan 18 12:08:22.347: eap_fast_crypto.c-EVENT: Starting Diffie Hellman phase 1 ...
    *EAP Framework: Jan 18 12:08:22.661: eap_fast_crypto.c-EVENT: Diffie Hellman phase 1 complete
    *EAP Framework: Jan 18 12:08:22.677: IOS_PKI_SHIM: PKI_SignMessage PostHashEncrypt ret SUCCESS.. op_len 128
    *EAP Framework: Jan 18 12:08:22.678: eap_fast_auth.c-AUTH-EVENT: DH signature length = 128
    *EAP Framework: Jan 18 12:08:22.678: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.678: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x028D
    *EAP Framework: Jan 18 12:08:22.679: eap_core.c:1422:     Payload:  0C0002890100FFFFFFFFFFFFFFFFC90F ...
    *EAP Framework: Jan 18 12:08:22.679: eap_fast.c:202: Handshake type:Server Key Exchange  Length:0x0289
    *EAP Framework: Jan 18 12:08:22.679: eap_core.c:1422:     Payload:  0100FFFFFFFFFFFFFFFFC90FDAA22168 ...
    *EAP Framework: Jan 18 12:08:22.679: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.680: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x000B
    *EAP Framework: Jan 18 12:08:22.680: eap_core.c:1422:     Payload:  0D00000704030401020000
    *EAP Framework: Jan 18 12:08:22.680: eap_fast.c:202: Handshake type:Certificate Request  Length:0x0007
    *EAP Framework: Jan 18 12:08:22.680: eap_core.c:1422:     Payload:  04030401020000
    *EAP Framework: Jan 18 12:08:22.681: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.681: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0004
    *EAP Framework: Jan 18 12:08:22.681: eap_core.c:1422:     Payload:  0E000000
    *EAP Framework: Jan 18 12:08:22.681: eap_fast.c:202: Handshake type:Server Done  Length:0x0000
    *EAP Framework: Jan 18 12:08:22.682: eap_fast_auth.c-AUTH-EVENT: Sending Provisioning Serving Hello
    *EAP Framework: Jan 18 12:08:22.682: eap_fast_auth.c-AUTH-SM: Changing state: Start -> Sent provisioning Server Hello
    *EAP Framework: Jan 18 12:08:22.682: eap_fast.c-EVENT: Tx packet fragmentation required
    *EAP Framework: Jan 18 12:08:22.683: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.683: eap_fast.c:138: Version: 1  Flags:LM  Length:0x03DE
    *EAP Framework: Jan 18 12:08:22.683: eap_core.c:1422:     Payload:  160301002A0200002603015F3325EADF ...
    *EAP Framework: Jan 18 12:08:22.684: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.684: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.684: eap_core.c:1422:     Payload:  C100000E33160301002A020000260301 ...
    *EAP Framework: Jan 18 12:08:22.684: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.685: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.685: eap_core.c:1484: Code:REQUEST  ID:0x 3  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.686: eap_core.c:1422:     Payload:  C100000E33160301002A020000260301 ...
    *EAP Framework: Jan 18 12:08:22.686: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.686: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.686: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.686: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.687: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.687: AuthorizationResponse: 0x13c713fc
    *EAP Framework: Jan 18 12:08:22.687: structureSize................................1048*EAP Framework: Jan 18 12:08:22.687: resultCode...................................255*EAP Framework: Jan 18 12:08:22.687: protocolUsed.................................0x00000080*EAP Framework: Jan 18 12:08:22.688: proxyState...................................18:3D:A2:0A:EC:BC-02:01*EAP Framework: Jan 18 12:08:22.688: Packet contains 1 AVPs (not shown)*EAP Framework: Jan 18 12:08:22.688: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 3e8
    *EAP Framework: Jan 18 12:08:22.688: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.700: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.701: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.701: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 3) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.701: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.701: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.702: eap_core.c:1484: Code:RESPONSE  ID:0x 3  Length:0x0006  Type:FAST
    *EAP Framework: Jan 18 12:08:22.702: eap_core.c:1422:     Payload:  01
    *EAP Framework: Jan 18 12:08:22.702: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.703: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.703: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.703: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.704: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.704: eap_fast.c-AUTH-EVENT: eap_fast_rx_packet(): EAP Fast NoData (0x2b)
    *EAP Framework: Jan 18 12:08:22.704: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.704: eap_fast.c:138: Version: 1  Flags:M  Length:0x03E2
    *EAP Framework: Jan 18 12:08:22.705: eap_core.c:1422:     Payload:  3A2F2F2F434E3D4A656E6F7074696B25 ...
    *EAP Framework: Jan 18 12:08:22.705: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.705: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.705: eap_core.c:1422:     Payload:  413A2F2F2F434E3D4A656E6F7074696B ...
    *EAP Framework: Jan 18 12:08:22.706: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.706: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:22.706: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.706: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.707: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.707: eap_core.c:1484: Code:REQUEST  ID:0x 4  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.707: eap_core.c:1422:     Payload:  413A2F2F2F434E3D4A656E6F7074696B ...
    *EAP Framework: Jan 18 12:08:22.707: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.708: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.708: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.708: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.708: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.709: AuthorizationResponse: 0x13c713fc
    *EAP Framework: Jan 18 12:08:22.709: structureSize................................1048*EAP Framework: Jan 18 12:08:22.709: resultCode...................................255*EAP Framework: Jan 18 12:08:22.709: protocolUsed.................................0x00000080*EAP Framework: Jan 18 12:08:22.710: proxyState...................................18:3D:A2:0A:EC:BC-02:02*EAP Framework: Jan 18 12:08:22.710: Packet contains 1 AVPs (not shown)*EAP Framework: Jan 18 12:08:22.710: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 3e8
    *EAP Framework: Jan 18 12:08:22.711: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.723: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.723: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.724: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 4) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.724: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.725: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.725: eap_core.c:1484: Code:RESPONSE  ID:0x 4  Length:0x0006  Type:FAST
    *EAP Framework: Jan 18 12:08:22.725: eap_core.c:1422:     Payload:  01
    *EAP Framework: Jan 18 12:08:22.725: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.726: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.726: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.726: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.726: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.727: eap_fast.c-AUTH-EVENT: eap_fast_rx_packet(): EAP Fast NoData (0x2b)
    *EAP Framework: Jan 18 12:08:22.727: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.727: eap_fast.c:138: Version: 1  Flags:M  Length:0x03E2
    *EAP Framework: Jan 18 12:08:22.728: eap_core.c:1422:     Payload:  BD84CC4BF49A766267DA94429BEBE087 ...
    *EAP Framework: Jan 18 12:08:22.728: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.728: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.728: eap_core.c:1422:     Payload:  41BD84CC4BF49A766267DA94429BEBE0 ...
    *EAP Framework: Jan 18 12:08:22.729: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.729: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:22.729: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.729: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.730: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.730: eap_core.c:1484: Code:REQUEST  ID:0x 5  Length:0x03e8  Type:FAST
    *EAP Framework: Jan 18 12:08:22.730: eap_core.c:1422:     Payload:  41BD84CC4BF49A766267DA94429BEBE0 ...
    *EAP Framework: Jan 18 12:08:22.731: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.731: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.731: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.731: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.732: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.732: AuthorizationResponse: 0x13c713fc
    *EAP Framework: Jan 18 12:08:22.732: structureSize................................1048*EAP Framework: Jan 18 12:08:22.732: resultCode...................................255*EAP Framework: Jan 18 12:08:22.733: protocolUsed.................................0x00000080*EAP Framework: Jan 18 12:08:22.733: proxyState...................................18:3D:A2:0A:EC:BC-02:03*EAP Framework: Jan 18 12:08:22.733: Packet contains 1 AVPs (not shown)*EAP Framework: Jan 18 12:08:22.734: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 3e8
    *EAP Framework: Jan 18 12:08:22.734: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.746: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.747: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.747: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 5) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.747: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.747: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.748: eap_core.c:1484: Code:RESPONSE  ID:0x 5  Length:0x0006  Type:FAST
    *EAP Framework: Jan 18 12:08:22.748: eap_core.c:1422:     Payload:  01
    *EAP Framework: Jan 18 12:08:22.748: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.749: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.749: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.749: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.750: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.750: eap_fast.c-AUTH-EVENT: eap_fast_rx_packet(): EAP Fast NoData (0x2b)
    *EAP Framework: Jan 18 12:08:22.750: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.750: eap_fast.c:138: Version: 1  Flags:  Length:0x0291
    *EAP Framework: Jan 18 12:08:22.751: eap_core.c:1422:     Payload:  34C4C6628B80DC1CD129024E088A67CC ...
    *EAP Framework: Jan 18 12:08:22.751: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.751: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x0297  Type:FAST
    *EAP Framework: Jan 18 12:08:22.751: eap_core.c:1422:     Payload:  0134C4C6628B80DC1CD129024E088A67 ...
    *EAP Framework: Jan 18 12:08:22.751: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.751: EAP-AUTH-EVENT: EAP method decision: Unknown
    *EAP Framework: Jan 18 12:08:22.752: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.752: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.752: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.752: eap_core.c:1484: Code:REQUEST  ID:0x 6  Length:0x0297  Type:FAST
    *EAP Framework: Jan 18 12:08:22.752: eap_core.c:1422:     Payload:  0134C4C6628B80DC1CD129024E088A67 ...
    *EAP Framework: Jan 18 12:08:22.753: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.753: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.753: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.753: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.753: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.754: AuthorizationResponse: 0x13c713fc
    *EAP Framework: Jan 18 12:08:22.754: structureSize................................711*EAP Framework: Jan 18 12:08:22.754: resultCode...................................255*EAP Framework: Jan 18 12:08:22.754: protocolUsed.................................0x00000080*EAP Framework: Jan 18 12:08:22.754: proxyState...................................18:3D:A2:0A:EC:BC-02:04*EAP Framework: Jan 18 12:08:22.754: Packet contains 1 AVPs (not shown)*EAP Framework: Jan 18 12:08:22.755: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 297
    *EAP Framework: Jan 18 12:08:22.755: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.830: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.830: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.830: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 6) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.831: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.831: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.831: eap_core.c:1484: Code:RESPONSE  ID:0x 6  Length:0x015c  Type:FAST
    *EAP Framework: Jan 18 12:08:22.831: eap_core.c:1422:     Payload:  810000015216030100070B0000030000 ...
    *EAP Framework: Jan 18 12:08:22.831: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.831: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.832: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.832: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.832: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c-AUTH-EVENT: Process Response, type: 0x2b
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-RX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1484: Code:RESPONSE  ID:0x 6  Length:0x015c  Type:FAST
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1422:     Payload:  810000015216030100070B0000030000 ...
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-AUTH-EVENT: Received TLS record type: Handshake in state: Sent provisioning Server Hello
    *EAP Framework: Jan 18 12:08:22.832: eap_fast_auth.c-AUTH-EVENT: Reading Client Certificate handshake
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c:286: EAP-FAST-AUTH-RX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c:255: Content:Handshake  Version:0301  Length:0x0007
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1422:     Payload:  0B000003000000
    *EAP Framework: Jan 18 12:08:22.832: eap_fast.c:202: Handshake type:Certificate  Length:0x0003
    *EAP Framework: Jan 18 12:08:22.832: eap_core.c:1422:     Payload:  000000
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c-EVENT: Client Certificate handshake empty
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-EVENT: Rx'd I-ID: "EAP-FAST I-ID" from Peer Cert
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-ERROR: Required cert not provided by client
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:286: EAP-FAST-AUTH-TX-TLS-RECORD:
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:255: Content:Alert  Version:0301  Length:0x0002
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1422:     Payload:  0228
    *EAP Framework: Jan 18 12:08:22.833: eap_fast_auth.c-AUTH-SM: Changing state: Sent provisioning Server Hello -> Alert
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:2367: eap-fast tx packet:
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c:138: Version: 1  Flags:L  Length:0x0007
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1422:     Payload:  15030100020228
    *EAP Framework: Jan 18 12:08:22.833: eap_fast.c-TX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1484: Code:REQUEST  ID:0x 0  Length:0x0011  Type:FAST
    *EAP Framework: Jan 18 12:08:22.833: eap_core.c:1422:     Payload:  810000000715030100020228
    *EAP Framework: Jan 18 12:08:22.833: EAP-AUTH-EVENT: EAP method state: Continue
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-EVENT: EAP method decision: Fail
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-EVENT: Current method = 43
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-EVENT: Sending packet to lower layer for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.834: EAP-AUTH-TX-PAK:
    *EAP Framework: Jan 18 12:08:22.834: eap_core.c:1484: Code:REQUEST  ID:0x 7  Length:0x0011  Type:FAST
    *EAP Framework: Jan 18 12:08:22.834: eap_core.c:1422:     Payload:  810000000715030100020228
    *EAP Framework: Jan 18 12:08:22.834: EAP-EVENT: Started 'Authenticator Retransmit' timer (60) for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.834: EAP-EVENT: Started EAP tick timer
    *EAP Framework: Jan 18 12:08:22.834: EAP-EVENT: Sending lower layer event 'EAP_TX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.834: LOCAL_AUTH: Found matching context for id - 319
    *EAP Framework: Jan 18 12:08:22.834: LOCAL_AUTH: (EAP:319) transmit event
    *EAP Framework: Jan 18 12:08:22.834: AuthorizationResponse: 0x13c713fc
    *EAP Framework: Jan 18 12:08:22.834: structureSize................................65*EAP Framework: Jan 18 12:08:22.834: resultCode...................................255*EAP Framework: Jan 18 12:08:22.835: protocolUsed.................................0x00000080*EAP Framework: Jan 18 12:08:22.835: proxyState...................................18:3D:A2:0A:EC:BC-02:05*EAP Framework: Jan 18 12:08:22.835: Packet contains 1 AVPs (not shown)*EAP Framework: Jan 18 12:08:22.835: LOCAL_AUTH: AAA LOCAL AUTH EAP PKT AVP attribute 4f length 11
    *EAP Framework: Jan 18 12:08:22.835: LOCAL_AUTH: AAA LOCAL AUTH TX PKT DUMP code cc id 00 type 2b
    *aaaQueueReader: Jan 18 12:08:22.838: LOCAL_AUTH: EAP: Received an auth request
    *aaaQueueReader: Jan 18 12:08:22.838: LOCAL_AUTH: Found context matching MAC address - 319
    *aaaQueueReader: Jan 18 12:08:22.838: LOCAL_AUTH: (EAP:319) Sending the Rxd EAP packet (id 7) to EAP subsys
    *EAP Framework: Jan 18 12:08:22.838: EAP-EVENT: Received event 'EAP_RX_PACKET' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.839: EAP-AUTH-RX-PAK:
    *EAP Framework: Jan 18 12:08:22.839: eap_core.c:1484: Code:RESPONSE  ID:0x 7  Length:0x0006  Type:FAST
    *EAP Framework: Jan 18 12:08:22.839: eap_core.c:1422:     Payload:  01
    *EAP Framework: Jan 18 12:08:22.839: EAP-EVENT: Stopping 'Authenticator Retransmit' timer for EAP session handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.839: EAP-AUTH-EVENT: EAP Response received by context 0x78000041
    *EAP Framework: Jan 18 12:08:22.839: EAP-AUTH-EVENT: EAP Response type = Method (43)
    *EAP Framework: Jan 18 12:08:22.839: EAP-AUTH-EVENT: Sending method data for context 0x78000041
    *EAP Framework: Jan 18 12:08:22.839: EAP-EVENT: Sending method directive 'Receive Packet' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.839: eap_fast.c-AUTH-EVENT: eap_fast_rx_packet(): EAP Fast NoData (0x2b)
    *EAP Framework: Jan 18 12:08:22.840: eap_fast.c-AUTH-EVENT: Process Response, type: 0x2b
    *EAP Framework: Jan 18 12:08:22.840: eap_fast_auth.c-AUTH-EVENT: Process Response (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:22.840: eap_fast_auth.c-RX-AUTH-PAK:
    *EAP Framework: Jan 18 12:08:22.840: eap_core.c:1484: Code:RESPONSE  ID:0x 7  Length:0x0006  Type:FAST
    *EAP Framework: Jan 18 12:08:22.840: eap_core.c:1422:     Payload:  01
    *EAP Framework: Jan 18 12:08:22.840: eap_fast_auth.c-AUTH-EVENT: Received ACK from peer
    *EAP Framework: Jan 18 12:08:22.840: EAP-AUTH-EVENT: EAP method state: Done
    *EAP Framework: Jan 18 12:08:22.840: EAP-AUTH-EVENT: EAP method decision: Fail
    *EAP Framework: Jan 18 12:08:22.840: EAP-EVENT: Received get canned status from lower layer (0x78000041)
    *EAP Framework: Jan 18 12:08:22.840: EAP-EVENT: Sending method directive 'Free Context' on handle 0x78000041
    *EAP Framework: Jan 18 12:08:22.840: eap_fast.c-EVENT: Free context (EAP handle = 0x78000041)
    *EAP Framework: Jan 18 12:08:22.840: id_manager.c-AUTH-SM: Entry deleted fine id f700000e - id_delete
    *EAP Framework: Jan 18 12:08:22.840: IOS_PKI_SHIM: Session 0x335ee108 deleted
    *EAP Framework: Jan 18 12:08:2

    Now we found the reason.
    The WLC doesn´t work with the Sub CA respectively with chain certificates for device authentication.
    "Support for Chained Certificate
    In controller versions earlier than 5.1.151.0, web authentication  certificates can be only device certificates and should not contain the  CA roots chained to the device certificate (no chained certificates).
    With controller version 5.1.151.0 and later, the controller allows  for the device certificate to be downloaded as a chained certificate for  web authentication.
    Certificate Levels
    Level 0—Use of only a server certificate on WLC.
    Level 1—Use of server certificate on WLC and a CA root certificate.
    Level 2—Use of server certificate on WLC, one single CA intermediate certificate, and a CA root certificate.
    Level 3—Use of server certificate on WLC, two CA intermediate certificates, and a CA root certificate.
    WLC does not support chained certificates more than 10KB size on the WLC.
    Note: Chained certificates are supported for web authentication only; they are not supported for the management certificate."
    So the WLC can´t decode the peer certificate.

Maybe you are looking for

  • Problem in Open Workbook from Database dialogue

    Hi, at my customer we migrated to 'OracleBI Discoverer 10.1.2' and it works fine with one exception. In the item 'View' of the 'Open Workbook from Database' dialogue there i am able to choose one of four values. If i move with the mouse over the want

  • RoboHelp 8 HTML import of Word file does not create topics

    I imported a large Word file (350+ pages, 4Mb) into RoboHelp 8 HTML (8.0208). In the status bar at the bottom of the screen, it said "Converting filename.doc..." with a progress bar and then (way too fast for a large file) it said "Ready". RoboHelp c

  • Not able to change Default Write Disk-Lenovo A7000

    Hi..I am also facing the same issue,I tried to do factory reset and after that it got solved for few days but again same problem has come back...dont know whats the solution..Can you please assist me here ? how can I get Phone storage back to SD Card

  • trans-attribute in ejb-jar.xml

    Dear All, To improve performance of my EJB's, I wish to set trans-attribute as "Supports" for all my get methods and rest of the methods as "Required". Heres the snippet from my ejb-jar.xml which I'm using to achieve the same: ======== start ejb-jar.

  • Forgot weblogic Password on 11g Release 2 Developer install. How do I reset my passwor

    Hello, I forgot my weblogic password. If anyone know how to reset lost passwords please let me know ORacle 11g Release 2 Forms/Reports on Windows 8.1 Thanks Rao