Wired 802.1x re-authentication passes but no connectivity after 1 hour

I am testing wired 802.1x with the desired behavior of machine auth with user auth. I have a 6509 CAT OS 8.3(5) using the dot1x global defaults, 2 laptops one is XP SP1 and XP SP2 both with AuthMode=1 and SupplicantMode=3 with windows update as of 02mar2005. Active Directory. ACS SE 3.2 using vlan assignment. Have tested PC and user in different vlans and it works fine.
1st observation:
The initial EAP authentication is good. Every hour there is an EAP request with a final result of success in the packet trace. The switch shows connected dot1x-123. The ACS log shows the passed re-authentication. Everything looks good but both laptops lose connectivity 1 hour after the first authorization. If I issue "set port dot1x initialize" or enable/disable the port the process starts over.
2nd observation:
I can connect with Remote Desktop. There are 2 EAP start frames then the port becomes unauthorized about a minute later.
Any ideas?

No. I am still waiting on Cisco to address the 1st observation. Does it occur on your 6506 8.4(2). I see it also in my 6509 with 8.4(2). I find it interesting that it works in my end of life 2948g switch 8.2(1)GLX.
The MS supplicant defaults for WIRED are authmode=1 and supplicantmode=2. Remote Desktop works in their default WIRED mode.
At this point I am content controlling machine access until dot1x matures. Cisco ACS has a machine access restriction feature that authorizes the port after a successful User Auth. I have found if enabled, a successful Machine Auth will be unauthorized when logged in with a local account. If disable the local account is authorized b/c MA has only occurred.

Similar Messages

  • I am trying to update Firefox, but haven't been able to connect to server. Keeps saying "connecting to server", but no connection after an hour of trying.

    Question
    I am trying to update Firefox per its suggestion, but haven't been able to connect to server. Keeps saying "connecting to server", but no connection after an hour of trying.

    Try running the combo update.
    10.9.5 Combo Update

  • ACS 5.1 Failure: 5411 EAP session timed out -- Wired 802.1X, machine-authentication

    Hi guys,
    I have a strange error here and I`m really disappointed.
    We currently try to do "Wired-802.1X" with our Windows XP SP3 Clients with EAP-TLS and "machine-only" authentication.
    We use ACS5.1 to authenticate the clients. At about 50% of the clients authentication works fine.
    At the other clients we can see a strange error at the ACS.
    At the Reports page --> "Authentications - RADIUS - Today" we see that a client is trying to authenticate, but this fails with the Failure Code: 5411 EAP session timed out.
    Logged At RADIUS
    Status NAS
    Failure Details Username MAC/IP
    Address Access Service Authentication
    Method Network Device NAS IP Address NAS Port ID CTS
    Security Group ACS Instance Failure  Reason
    Sep 2,10 3:37:46.916 PM
    Wired_802.1X_EAP-TLS
    EAP-TLS
    svacs01
    5411 EAP session timed out
    Steps
    11001  Received RADIUS Access-Request
    11017  RADIUS created a new session
    Evaluating Service Selection Policy
    15004  Matched rule
    15012  Selected Access Service - Wired_802.1X_EAP-TLS
    11507  Extracted EAP-Response/Identity
    12500  Prepared EAP-Request proposing EAP-TLS with challenge
    11006  Returned RADIUS Access-Challenge
    5411  EAP session timed out
    At the switch I used "Authentication Open" to get the client working and capture traffic with wireshark.
    Switch --> Request Identity --> Client
    Switch <-- Response Identity <-- Client
    Switch --> Request EAP-TLS --> Client
    Switch --> Request EAP-TLS --> Client
    Switch --> Request EAP-TLS --> Client
    Switch --> Request Identity --> Client
    Switch --> Request Identity --> Client
    Switch --> Request Identity --> Client
    What is missing ist the Switch <-- Response EAP-TLS <-- Client
    Any ideas what is going wrong ? Maybe someone had this error before ?
    Any suggestions how to debug this ?
    Thank you very much for your help!
    Mathias

    Hi @all,
    I have this issue too. It occurs in our wireless environment. The problem for me is that I don't know which client (or clients) causes the error. The error occur many times per day.
    Logged At RADIUS
    Status NAS
    Failure Details Username MAC/IP
    Address Access Service Authentication
    Method Network Device NAS IP Address NAS Port ID CTS
    Security Group ACS Instance Failure  Reason
    Sep 7,10 11:50:36.143 PM
    dot1x wireless
    PEAP
    bfnetacs01
    5411 EAP session timed out
    Kind regards,
    Michael

  • Wired 802.1x Continouos Authentication Restart in Win 7

    Hi,
    I'm trying to implement 802.1x authenticaion with HP switches and NPS 2008/R2.
    Seems like the switch is configured properly and a 802.1x policy was created and configured to grant network access to domain users and computers. Clients are Win 7 computers, configured to enable 802.1x authentication in PEAP method with secured password
    (EAP-MSCHAP v2) and not required to validate the server's (certificate (although the server has an issued certificate.
    The problem is that the client seems to be authenticated, and immediately restarts the authentication, which eventually fails - as I see in the logs under Wired-AutoConfig.
    I'd be thrilled to get any assistance with that issue.
    Thanks a lot,
    Lena. 

    Solved it! 
    Apparently there is an option in the port-level on the switch to enable/disable triggering of a 802.1x client to perform authentication - it is called "multicast/unicast-triggering".
    Disabling the multicast-triggering stopped the client from authenticating every 30 seconds!
    From system view of an HP v1910 switch:
    int GigabitEthernet1/0/x
    undo dot1x multicast-trigger
    Hope that it will maybe help someone in the future.
    Lena. 

  • Iphone 5 finds wifi network but cant connect after putting in password

    hi, i have tried all day to get my iphone to connect to my wifi by resetting network settings, entering wifi password again and turning off router etc. after typing in password the wifi tab in settings says that i am connected to this wifi but in the tab at the top of my phone where it says your network/service carrier and battery percentage, the 3 bars that tell how strong my connection is does not appear at all

    Hello tomof1998
    There are a few things to try for troubleshooting your issue and they are detailed in the article below.
    iOS: Troubleshooting Wi-Fi networks and connections
    http://support.apple.com/kb/TS1398
    Thanks for using Apple Support Communities.
    Regards,
    -Norm G.

  • WiFi signal full - but drops connectivity after 8 to 9 hours - MBP 5,4

    While using MBP switched on continuously @ office for 8 to 9 hours, I cannot access internet or any local network resource, while other Linux and Windows machines still can.
    But when I turn the Airport off and again on, it can connect. Again after sometime the same problem comes.
    Should I remove OSX and install Linux on this?

    Welcome to Apple Discussions!
    It would prove whether or not you are suffering some problem with the software on the Mac. It might be some damaged preference or cache file. You could also backup your data twice, and selectively restore data after testing whether or not a simple basic Mac OS X install still has the same problem. If two separate operating systems are erase and installed have issues with the router, the router setup may not have the right setup for three machines. If only one erase and installed system has an issue, then it is perhaps a firmware issue with the router. If no erase and installed system has an issue, monitor what you install after the erase and install to determine if a specific installation triggers the issue.

  • FlexConnect Access Point - Wired 802.1X or MAB Authentication

    Hi all,
    We are piloting wired 802.1X but have hit a snag - FlexConnect AP switchport configuration requires the port be configured as trunk, with the native VLAN for management and access VLAN(s) for client data.
    I know 802.1X cannot be configured on trunk port, but how can we configure MAB on trunk ports such as these?
    Otherwise, is there another way we can authenticate these FlexConnect APs on a switch using ISE?
    Thanks in advance.
    Regards,
    Stephen.

    Hi Stephen. You are correct, 802.1x should not be configured on a trunk port. Moreover, you would run into an issue with clients if you are running local switching mode. Here is the flow:
    1. AP, authenticates via MAB and profiling
    2. Client authenticates via PEAP/EAP-TLS, etc
    3. Now the client's traffic is locally switched, thus, the client mac address is showing on the same port where the AP is connected. The NAD (Switch) sees this new mac address and it is expecting it to perform 802.1x or MAB based authentication. The supplicant, however, does not know that and as far it is concerned it was already authenticated.
    So I have ran into this issue in my deployments and you have the following options (listed in preference order):
    1. Eliminate FlexConnect :)
    2. Utilize AutoSmartPorts where:
    - If an AP is connected, then 802.1x configuration is removed, port-security is enabled and locked to a single MAC address and trunk configuration is enabled
    - If the AP is removed, then port is configured as standard access port, port-security is removed and 802.1x is configured
    More info on auto smart ports:
    http://www.cisco.com/c/en/us/td/docs/switches/lan/auto_smartports/15-0_1_se/configuration/guide/asp_cg.html
    3. You can configure the port in a "multi-host" mode where after the first device is authenticated all subsequent devices are allowed on the network.
    Hope this helps!
    Thank you for rating helpful posts!

  • Configuring Wired 802.1x Authentication step-by-step guide

    Hello All
    I don't have a question at the moment, but I wrote a step-by-step guide on how to configure Wired 802.1x Authentication on Windows Server 2012 using Cisco switches.
    You can find the document on my website http://www.accessdenied.be/blog
    regards
    Johan Loos CISSP,MCT,ISO 27001 and others

    Hi Johan,
    Thanks for your sharing.
    As this post is not a question, I will change it to Discussion. In addition, I would recommend that you to publish guide at TechNet Wiki.
    http://social.technet.microsoft.com/wiki
    Best Regards,
    Aiden
    Aiden Cao
    TechNet Community Support

  • Wired 802.1x with PEAP

    I have manage to get wired 802.1x working using Windows Active Directory as the database. With machine authentication, single-signon can be achieved.
    Setup:
    C3750 switch - Cisco ACS 3.2 - Windows AD
    Sequence of events:
    1. 802.1x machine authentication
    2. User logs in to domain
    3. 802.1x with user credentials
    But, I have the following issues:
    i. If user logs in using local account, it takes 3 minutes (default dot1x switch timers) for the port to turn unauthorized. Is it possible to place the port in unauthorized state immediately?
    ii. If the user 802.1x login has dynamic VLAN assignment, the AD scripts do not run. It seems that the AD scripts can't run if there is a change of IP address upon login (difference in VLAN for 'machine authentication' and 'user login').
    Any solution for this?
    Tks

    2 issues here:
    *Cached credentials for Microsoft supplicannts. Microsoft's authentication strategy in general reflects, and WLAN roaming would be difficult without the use of cached credentials. If cached credentials are not desired, would recommend another supplicant.
    * Falied Authentication for a local account. It should try to dot1x authenticate this user. For PEAP as an example, you would see the username as \. Now, a port will only be placed into a HELD state if a RADIUS-Reject is sent to the switch. A RADIUS-Reject will only be sent to the switch if the attempt is actually "failed" as opposed to silently discarded, packet lost in transit, etc. Taking 3 minutes to actually fail an attempt is indeed way too long, but the switch is probably doing what RADIUS is telling it to do. (this can be verified by a sniffer trace or debugs). Correspinding logs on RADIUS would help as well.

  • Eap-tls wired 802.1x - certificate issue?

    I have configured ACS 4.0 and an 2003 Enterprise root CA on the same server, successfully applied the GPO to auto-enroll machines with Computer certificates, and then enabled 802.1x security on Catalyst 3750s. Note this is for wired 802.1x.
    If I reboot the machine, the EAP packets go through and you can see a successful authentication in the "Passed Authentications" log. However, if you disconnect the wire and then plug it back in, Windows gets stuck in "Validatiny Identity", and eventually a balloon pops up saying: "Windows was unable to find a certificate to log you on". Doing a 'sh dot1x interface ...' shows it is CONNECTING until the auth timeout is reached then it dumps the workstation into the guest vlan. Nothing is logged to Passed Authentications or Failed Attempts on the ACS server.
    Basically, the only time the EAP-TLS machine authentication works is when you reboot the machine. And if you change the state of the port either by diabling/enabling from the workstation or switch, or unplug the cable and plug it back in, Windows does not seem to pass the certificate information along to the PAE.
    This does not seem to happen when a user/client certificate is issued, only when it is a machine/computer certificate
    Has anybody seen this before and have any solutions why Windows cannot recogonize the machine certificate properly?

    We solved our WIRELESS problem by editing the following entrees. I sure this can be applied to the wired side somehow.
    The information about the correct settings can be found in this Microsoft document:
    http://technet2.microsoft.com/WindowsServer/en/library/8e74974f-c951-48ce-8235-02f4ed8e74921033.mspx?mfr=true
    The areas of interest are the SupplicantMode (EAPOL-Start Message) and AuthMode (what type of authentication to use) registry entries. These can be configured manually in the registry or applied via Group Policy.
    This allows just the machine to authenticate (using a Cert all ready on the Machine) then we use our ACS server to auth the user via AD.
    I am doing this wirelessly and using as long as you are using a WDS the following will be the result.
    Roaming AP to AP I only lost 1 packet.
    Roaming from Vlan to other Vlan I lost 5 packets (Different ip address)
    Shutting the wireless off and back on I only lost 8 packets.
    I thought this was a very good result. We will be launching our lab with 35 plus laptops in a classroom with 2 radios.

  • Mac & 802.1x Machine Authentication to Microsoft AD using PEAP

    We are having trouble successfully connecting wirelessly our Active Directory-bound Macs to our internal 802.1x wireless network using EAP-PEAP with machine authentication. All of our Windows machines work fine. We have a network profile built out of JAMF, with some generic payloads configured, including Use Directory Authentication and the appropriate Verisign certificate attached to authenticate to the Cisco Radius Server onsite. We are able to connect to this wireless network when we also have the machine directly connected via Ethernet. Somehow this causes the Mac to pass the correct domainhost\machinename. When we aren't connected directly, the Mac attempts to authenticate with the incorrect domainhost in front of the correct \machinename. The logs from Console are attached below:
    Apr 22 13:37:28 MACHINENAME eapolclient[****]: System Mode Using AD Account '(wrongdomain)\machinenameinAD$'
    Apr 22 13:37:28 MACHINENAME eapolclient[****]: en0 PEAP: authentication failed with status 1
    Apr 22 13:37:28 MACHINENAME eapolclient[****]: peap_request: ignoring non PEAP start frame
    Apr 22 13:37:31 MACHINENAME eapolclient[****]: en0 STOP
    Apr 22 13:37:52 MACHINENAME eapolclient[****]: opened log file '/var/log/eapolclient.en0.log'
    Apr 22 13:37:52 MACHINENAME eapolclient[****]: System Mode Using AD Account '(correctdomain)\machinenameinAD$'
    Apr 22 13:37:52 MACHINENAME eapolclient[****]: en0 START
    Apr 22 13:37:53 MACHINENAME eapolclient[****]: eapmschapv2_success_request: successfully authenticated
    The first, unsuccessful attempt above is when we are attempting to authenticate and connect wirelessly without a connection to ethernet. The 2nd, successful attempt is when are also connected to Ethernet, which passes the correct domain name, properly authenticating the domain\machinename. After reboot, we have to again plug in directly to Ethernet to reauthenticate to this wirelss network. Any idea(s) why plugging into Ethernet would cause the Mac to send the correct domainhost? Thanks.

    Hi Danny. Older thread here, but I can confirm 10.8.4 did indeed resolve a very specific bug in circumstances where the netbios name did not match the domain name. We worked with Apple's engineers on resolution for this fix and can confirm that until we got our Macs to 10.8.4, we experienced similar issues with machine-based configuration profiles failing to authenticate as a result of incorrectly passing the wrong domain.
    Glad you found resolution with a later version of the OS.
    Reference: http://lists.psu.edu/cgi-bin/wa?A2=MACENTERPRISE;Zrq7fg;201303271647570400

  • ISE : error on wired 802.1x deployment

    Hi,
    i got this error message once i try to do wired 802.1x, identity source is from Active Directory
    I just curious i already enable 802.1x on the pc LAN port, but i just found the authentication method shown on ISE is using MAB !!!
    any clue?
    Thanks
    Noel

    Hello,
    Please check this link for "802.1x using Cisco ISE", it may help you in this.
    https://supportforums.cisco.com/docs/DOC-29409

  • 802.1x & windows Authentication

    Hi There, Any body has implemented 802.1x port authentication with ACS & windows AD. which authentication is supported in this kind of setup ms-chap or MD5 or PEAP (on the clients).
    and what are the challenges if windows user accounts password changed frequently..
    can any body explain adv & dis adv of 802.1x before I deploy it in network..

    There's a decent guide in the ACS 4.2 documentation on enabling machine access (chapter 12). Basically, you just enable it on the client and the ACS server, and POOF! On the client side, you should have a "Authenticate as computer..." option on your wireless networks tab. Wired is the same, unless you are running XP SP3, Vista, or Windows 7 where machine auth is enabled when you enable user auth.
    MAB with Guest VLAN *should* work, but I have not configured/tested it. Just be aware that MAF on the ACS side is just another form of auth where the user id and password is the MAC address of the client. For this reason, I recommend you put the MAC "users" in your ACS database, not in AD. Otherwise, you'll probably need to create an AD password group policy object for the user group holding your "mac address user accounts" so that they can have a password that matches their user name.
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/ACSug.pdf

  • ISE Wired 802.1x with Foundry access switch ,not show "Device Port"

    Our customer wanna enable wired 802.1x for user and machine authentication on Foundry Switch.
    They want to use ISE as radius server.We try it ,but the ISE report can't show which port the client is connectd on the switch.
    We get the tcp dump packets from ISE.It shows that the "nas-port-id" radius attribute is not sent out by  foundry switch,but it sends "nas-port".
    Is it possible to let foundry switch send "nas-port-id" attribute in the radius request packet ?
    Or is it possible to let ISE show "nas-port" attribute value on the authentication report ?
    Thanks.

    Our customer wanna enable wired 802.1x for user and machine authentication on Foundry Switch.
    They want to use ISE as radius server.We try it ,but the ISE report can't show which port the client is connectd on the switch.
    We get the tcp dump packets from ISE.It shows that the "nas-port-id" radius attribute is not sent out by  foundry switch,but it sends "nas-port".
    Is it possible to let foundry switch send "nas-port-id" attribute in the radius request packet ?
    Or is it possible to let ISE show "nas-port" attribute value on the authentication report ?
    Thanks.

  • ISE 1.3 Why are Windows endpoints defaulting to 802.1x machine authentication in wireless profile and not User or User&Computer

    We are running ISE 1.3 tied to AD with WLC 7.6.130.0.  Our ISE has a GoDaddy (none wildcard) certificate loaded for https and EAP.  We are just running PEAP.  We have a mix of IOS, Android, and Windows 7/8 devices.  IOS and Android devices can self create a wireless profile and after entering credentials can connect without issue.  Our Windows 7/8 devices, when auto creating a wireless profile are selecting 802.1x machine authentication instead of User authentication or the best option which is machine or user authentication.  This is problematic as we do allow for machine authentication but have an authorization rule limiting machine auth to domain controller and ISE connectivity only.  This is to allow domain Windows 7/8 devices to have domain connectivity prior to user sign-in but force user auth to get true network connectivity.  The problem is why are the Windows devices not auto setting to user authentication (as I think they did when we ran ISE1.2), or the best option which is to allow both types of authentication?  I have limited authentication protocols to just EAP CHAP and moved the machine auth profile to the bottom of the list.  Neither have helped.  I also notice that the Windows 7/8 endpoints have to say allow connectivity several times even though we are using a global and should be trusted certificate authority (probably a separate issue).
    Thank you for any help or ideas,

    When connecting a windows device to the ISE enabled SSID when there is not a saved wireless profile on that machine, it will connect and auto create the profile.  In that profile, 802.1x computer authentication option is chosen by windows.  That has to be changed to computer or user for the machine to function correctly on the network.
    On 1.2, this behavior was different.  The Windows device would auto select user authentication by default.  At other customer sites, windows devices auto select user authentication.  This of course needs  to be changed to user or computer in order to support machine auth, but at least the default behavior of user authentication would allow machines to get on the network and functional easily to begin with.

Maybe you are looking for