Wired 802.1x With Static IP on endopoints

Hi all
Someone know if a 802.1x implementation with Cisco ISE, works with static IP in the endpoints or there are any issue in this deployment?
I have a lab deployment but does not work fine with a static IP in the client (laptop) but when i work with DHCP works fine.
The authentication and authorization process in ISE is successfull, and the port status in switch is AUTHORIZED, the VLAN assignment is right.
Thanks

I have deployed ISE in the past with static IPs and did not have any issues as long as the VLAN that was being assigned to the port matches the VLAN that the subnet of the static IP resides in. 
What is the behavior of the endpoint and what issues are you seeing?
Thank you for rating helpful posts!

Similar Messages

  • Wired 802.1x with PEAP

    I have manage to get wired 802.1x working using Windows Active Directory as the database. With machine authentication, single-signon can be achieved.
    Setup:
    C3750 switch - Cisco ACS 3.2 - Windows AD
    Sequence of events:
    1. 802.1x machine authentication
    2. User logs in to domain
    3. 802.1x with user credentials
    But, I have the following issues:
    i. If user logs in using local account, it takes 3 minutes (default dot1x switch timers) for the port to turn unauthorized. Is it possible to place the port in unauthorized state immediately?
    ii. If the user 802.1x login has dynamic VLAN assignment, the AD scripts do not run. It seems that the AD scripts can't run if there is a change of IP address upon login (difference in VLAN for 'machine authentication' and 'user login').
    Any solution for this?
    Tks

    2 issues here:
    *Cached credentials for Microsoft supplicannts. Microsoft's authentication strategy in general reflects, and WLAN roaming would be difficult without the use of cached credentials. If cached credentials are not desired, would recommend another supplicant.
    * Falied Authentication for a local account. It should try to dot1x authenticate this user. For PEAP as an example, you would see the username as \. Now, a port will only be placed into a HELD state if a RADIUS-Reject is sent to the switch. A RADIUS-Reject will only be sent to the switch if the attempt is actually "failed" as opposed to silently discarded, packet lost in transit, etc. Taking 3 minutes to actually fail an attempt is indeed way too long, but the switch is probably doing what RADIUS is telling it to do. (this can be verified by a sniffer trace or debugs). Correspinding logs on RADIUS would help as well.

  • ISE Wired 802.1x with Foundry access switch ,not show "Device Port"

    Our customer wanna enable wired 802.1x for user and machine authentication on Foundry Switch.
    They want to use ISE as radius server.We try it ,but the ISE report can't show which port the client is connectd on the switch.
    We get the tcp dump packets from ISE.It shows that the "nas-port-id" radius attribute is not sent out by  foundry switch,but it sends "nas-port".
    Is it possible to let foundry switch send "nas-port-id" attribute in the radius request packet ?
    Or is it possible to let ISE show "nas-port" attribute value on the authentication report ?
    Thanks.

    Our customer wanna enable wired 802.1x for user and machine authentication on Foundry Switch.
    They want to use ISE as radius server.We try it ,but the ISE report can't show which port the client is connectd on the switch.
    We get the tcp dump packets from ISE.It shows that the "nas-port-id" radius attribute is not sent out by  foundry switch,but it sends "nas-port".
    Is it possible to let foundry switch send "nas-port-id" attribute in the radius request packet ?
    Or is it possible to let ISE show "nas-port" attribute value on the authentication report ?
    Thanks.

  • Configuring wired 802.1x with Cisco 2950 and NPS 2012 problem

    Hi,
    I am trying to setup wired authentication on my corporate network. For testing purposes, I have setup a Cisco 2950 switch for RADIUS authentication.
    On the first day of the test, access messages were appearing on the event log of the 2012 Server and  we were trying to address the issues with EAP and policy.(Network Policy and Access services)
    Then, suddenly no events are written to the event log for the wired authentication. Accounting data is written to the log file at c:\windows\system32\logfiles, but nothing happens on the event log as if the NPS is not answering. We are using the same server for wireless 802.1x and all is working fine.
    Checking the wired autoconfig log on the client, Restart Reason : Onex Auth Timeout appears.
    Logging seems to be configured properly, there are no entries in event log. Below is the debug information from the 2950 switch;
    KAT2-BATISW1#
    00:18:28: dot1x-registry:dot1x_port_linkchange invoked on interface FastEthernet
    0/17
    00:18:28: dot1x-registry:dot1x_port_linkcomingup invoked on interface FastEthern
    et0/17
    00:18:28: dot1x-ev:dot1x_port_enable: set dot1x ask handler on interface FastEth
    ernet0/17
    00:18:28: dot1x-ev:dot1x_update_port_direction: Updating oper direction for Fa0/
    17 (admin=Both, current oper=Both)
    00:18:28: dot1x-ev:dot1x_update_port_direction: New oper direction for Fa0/17 is
     Both
    00:18:28:     dot1x_auth Fa0/17: initial state auth_initialize has enter
    00:18:28: dot1x-sm:Fa0/17:0000.0000.0000:auth_initialize_enter called
    00:18:28: dot1x-ev:auth_initialize_enter:0000.0000.0000: Current ID=0
    00:18:28:     dot1x_auth Fa0/17: during state auth_initialize, got event 0(cfg_a
    uto)
    00:18:28: @@@ dot1x_auth Fa0/17: auth_initialize -> auth_disconnected
    00:18:28: dot1x-sm:Fa0/17:0000.0000.0000:auth_disconnected_enter_action called
    00:18:28: dot1x-sm:
    dot1x_update_port_status called with port_status = DOT1X_PORT_STATUS_UNAUTHORIZE
    D
    00:18:28: dot1x-ev:dot1x_update_port_direction: Updating oper direction for Fa0/
    17 (admin=Both, current oper=Both)
    00:18:28: dot1x-ev:dot1x_update_port_direction: New oper direction for Fa0/17 is
     Both
    00:18:28: dot1x-ev:dot1x_port_cleanup_author: cleanup author on interface FastEt
    hernet0/17
    00:18:28: dot1x-ev:dot1x_update_port_status: Called with host_mode=0 state UNAUT
    HORIZED
    00:18:28: dot1x-ev:dot1x_update_port_status: using mac 0000.0000.0000 to send po
    rt to unauthorized on vlan 0
    00:18:28: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:18:28: dot1x-ev:dot1x_port_unauthorized: Host-mode=0 radius/guest vlan=0 on F
    astEthernet0/17
    00:18:28: dot1x-ev:    GuestVlan configured=0
    00:18:28: dot1x-ev:supplicant 0000.0000.0000 is default
    00:18:28: dot1x-ev:supplicant 0000.0000.0000 is last
    00:18:28: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:18:28: dot1x-ev:0000.0000.0000 is now unauthorized on port FastEthernet0/17
    00:18:28: dot1x-ev:dot1x_port_cleanup_author: cleanup author on interface FastEt
    hernet0/17
    00:18:28: dot1x-ev:Enter function dot1x_aaa_acct_end
    00:18:28: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:18:28: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:18:28:     dot1x_auth Fa0/17: idle during state auth_disconnected
    00:18:28: @@@ dot1x_auth Fa0/17: auth_disconnected -> auth_connecting
    00:18:28: dot1x-sm:Fa0/17:0000.0000.0000:auth_connecting_enter called
    00:18:28:     dot1x_bend Fa0/17: initial state dot1x_bend_initialize has enter
    00:18:28: dot1x-sm:Dot1x Initialize State Entered
    00:18:28:     dot1x_bend Fa0/17: initial state dot1x_bend_initialize has idle
    00:18:28:     dot1x_bend Fa0/17: during state dot1x_bend_initialize, got event 1
    6383(idle)
    00:18:28: @@@ dot1x_bend Fa0/17: dot1x_bend_initialize -> dot1x_bend_idle
    00:18:28: dot1x-sm:Dot1x Idle State Entered
    00:18:28: dot1x-ev:Created port supplicant block 0000.0000.0000 expected_id=0 cu
    rrent_id=0
    00:18:28: dot1x-ev:dot1x_init_sb_oper_info:Default port supplicant at memloc 80D
    71C74
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm: cleanup author from interface
    FastEthernet0/17
    00:18:28: dot1x-ev:
    dot1x_post_message_to_auth_sm:0000.0000.0000: Sending TX_FAIL
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm:0000.0000.0000: Current ID=1
    00:18:28: dot1x-ev:Transmitting an EAPOL frame on FastEthernet0/17
    00:18:28: dot1x-packet:Tx EAP-Failure, id 0, ver 1, len 4 (Fa0/17)
    00:18:28: dot1x-registry:registry:dot1x_ether_macaddr called
    00:18:28: dot1x-packet:Tx sa=000f.24e9.72d1, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm: cleanup author from interface
    FastEthernet0/17
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm: Tx for req_id for supplicant 0
    000.0000.0000
    00:18:28: dot1x-ev:Transmitting an EAPOL frame on FastEthernet0/17
    00:18:28: dot1x-packet:Tx EAP-Request(Id), id 1, ver 1, len 5 (Fa0/17)
    00:18:28: dot1x-registry:registry:dot1x_ether_macaddr called
    00:18:28: dot1x-packet:Tx sa=000f.24e9.72d1, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:28: dot1x-ev:Received an EAPOL frame on interface FastEthernet0/17
    00:18:28: dot1x-packet:Rx EAP-Response(Id), id 1, ver 1, len 21 (Fa0/17)
    00:18:28: dot1x-packet:Rx sa=0024.1d10.d7c5, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:28: dot1x-ev:Couldn't find a supplicant block for mac 0024.1d10.d7c5
    00:18:28: dot1x-ev:Couldn't find a supplicant block for mac 0024.1d10.d7c5
    00:18:28: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:18:28:     dot1x_auth Fa0/17: initial state auth_initialize has enter
    00:18:28: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_initialize_enter called
    00:18:28: dot1x-ev:auth_initialize_enter:0024.1d10.d7c5: Current ID=0
    00:18:28:     dot1x_auth Fa0/17: during state auth_initialize, got event 0(cfg_a
    uto)
    00:18:28: @@@ dot1x_auth Fa0/17: auth_initialize -> auth_disconnected
    00:18:28: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_disconnected_enter_action called
    00:18:28: dot1x-sm:
    dot1x_update_port_status called with port_status = DOT1X_PORT_STATUS_UNAUTHORIZE
    D
    00:18:28: dot1x-ev:dot1x_update_port_direction: Updating oper direction for Fa0/
    17 (admin=Both, current oper=Both)
    00:18:28: dot1x-ev:dot1x_update_port_direction: New oper direction for Fa0/17 is
     Both
    00:18:28: dot1x-ev:dot1x_port_cleanup_author: cleanup author on interface FastEt
    hernet0/17
    00:18:28: dot1x-ev:dot1x_update_port_status: Called with host_mode=0 state UNAUT
    HORIZED
    00:18:28: dot1x-ev:dot1x_update_port_status: using mac 0024.1d10.d7c5 to send po
    rt to unauthorized on vlan 0
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28: dot1x-ev:dot1x_port_unauthorized: Host-mode=0 radius/guest vlan=0 on F
    astEthernet0/17
    00:18:28: dot1x-ev:    GuestVlan configured=0
    00:18:28: dot1x-ev:supplicant 0024.1d10.d7c5 is last
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28: dot1x-ev:0024.1d10.d7c5 is now unauthorized on port FastEthernet0/17
    00:18:28: dot1x-ev:dot1x_port_cleanup_author: cleanup author on interface FastEt
    hernet0/17
    00:18:28: dot1x-ev:Enter function dot1x_aaa_acct_end
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28:     dot1x_auth Fa0/17: idle during state auth_disconnected
    00:18:28: @@@ dot1x_auth Fa0/17: auth_disconnected -> auth_connecting
    00:18:28: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_enter called
    00:18:28:     dot1x_bend Fa0/17: initial state dot1x_bend_initialize has enter
    00:18:28: dot1x-sm:Dot1x Initialize State Entered
    00:18:28:     dot1x_bend Fa0/17: initial state dot1x_bend_initialize has idle
    00:18:28:     dot1x_bend Fa0/17: during state dot1x_bend_initialize, got event 1
    6383(idle)
    00:18:28: @@@ dot1x_bend Fa0/17: dot1x_bend_initialize -> dot1x_bend_idle
    00:18:28: dot1x-sm:Dot1x Idle State Entered
    00:18:28: dot1x-ev:Created port supplicant block 0024.1d10.d7c5 expected_id=1 cu
    rrent_id=1
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm: cleanup author from interface
    FastEthernet0/17
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm: cleanup author from interface
    FastEthernet0/17
    00:18:28: dot1x-ev:dot1x_post_message_to_auth_sm: Tx for req_id for supplicant 0
    024.1d10.d7c5
    00:18:28: dot1x-ev:Transmitting an EAPOL frame on FastEthernet0/17
    00:18:28: dot1x-packet:Tx EAP-Request(Id), id 0, ver 1, len 5 (Fa0/17)
    00:18:28: dot1x-registry:registry:dot1x_ether_macaddr called
    00:18:28: dot1x-packet:Tx sa=000f.24e9.72d1, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:28: dot1x-ev:Received an EAPOL frame on interface FastEthernet0/17
    00:18:28: dot1x-packet:Rx EAP-Response(Id), id 0, ver 1, len 21 (Fa0/17)
    00:18:28: dot1x-packet:Rx sa=0024.1d10.d7c5, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28:     dot1x_auth Fa0/17: during state auth_connecting, got event 7(rxRes
    pId)
    00:18:28: @@@ dot1x_auth Fa0/17: auth_connecting -> auth_authenticating
    00:18:28: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_exit alled
    00:18:28: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_authenticating_enter called
    00:18:28: dot1x-ev:sending AUTH_START to BEND for supp_info=80D7E584
    00:18:28: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_authenticating_action c
    alled
    00:18:28: dot1x-ev:Received AuthStart from Authenticator for supp_info=80D7E584
    00:18:28:     dot1x_bend Fa0/17: during state dot1x_bend_idle, got event 1(auth_
    start)
    00:18:28: @@@ dot1x_bend Fa0/17: dot1x_bend_idle -> dot1x_bend_response
    00:18:28: dot1x-sm:Dot1x Response State Entered for supp_info=80D7E584 hwidb=807
    D353C, swidb=807D4898 on intf=Fa0/17
    00:18:28: dot1x-ev:Managed Timer in sub-block attached as leaf to master
    00:18:28: dot1x-sm:Started the ServerTimeout Timer
    00:18:28: dot1x-ev:Going to Send Request to AAA Client on RP for id = 0 and leng
    th = 21
    00:18:28: dot1x-ev:Got a Request from SP to send it to Radius with id 4294967283
    00:18:28: dot1x-ev:Couldn't Find a process thats already handling the request fo
    r this id 0
    00:18:28: dot1x-ev:Inserted AAA request for interface FastEthernet0/17, MAC 0024
    .1d10.d7c5, VLAN 0 on pending request queue
    00:18:28: dot1x-ev:Found a free slot at slot 0
    00:18:28: dot1x-ev:Found a free slot at slot 0
    00:18:28: dot1x-ev:Processing AAA request for interface FastEthernet0/17, MAC 00
    24.1d10.d7c5, VLAN 0 from pending request queue
    00:18:28: dot1x-ev:Request id = -13 and length = 21
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28: dot1x-ev:The Interface on which we got this AAA Request is FastEtherne
    t0/17
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:28: dot1x-ev:Username is DUZEY\SAYTAMANER
    00:18:28: dot1x-ev:MAC Address is 0024.1d10.d7c5
    00:18:28: dot1x-ev:RemAddr is 00-24-1D-10-D7-C5/00-0F-24-E9-72-D1
    00:18:28: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:30: %LINK-3-UPDOWN: Interface FastEthernet0/17, changed state to up
    00:18:46: dot1x-ev:Received an EAPOL frame on interface FastEthernet0/17
    00:18:46: dot1x-packet:Rx EAPOL-Start, ver 1, len 0 (Fa0/17)
    00:18:46: dot1x-packet:Rx sa=0024.1d10.d7c5, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:46: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:46: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:46: dot1x-ev:RECEIVED mac =0024.1d10.d7c5 and Stored MAC =0024.1d10.d7c5
    00:18:46:     dot1x_auth Fa0/17: during state auth_authenticating, got event 4(e
    apStart)
    00:18:46: @@@ dot1x_auth Fa0/17: auth_authenticating -> auth_aborting
    00:18:46: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_aborting_enter called
    00:18:46: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_authenticating_aborting_action cal
    led
    00:18:46: dot1x-ev:Received DOT1X_MSG_AUTH_ABORT: setting msg_id = 0
    00:18:46:     dot1x_bend Fa0/17: during state dot1x_bend_response, got event 5(i
    nitialize)
    00:18:46: @@@ dot1x_bend Fa0/17: dot1x_bend_response -> dot1x_bend_initialize
    00:18:46: dot1x-sm:Dot1x Initialize State Entered
    00:18:46:     dot1x_bend Fa0/17: idle during state dot1x_bend_initialize
    00:18:46: @@@ dot1x_bend Fa0/17: dot1x_bend_initialize -> dot1x_bend_idle
    00:18:46: dot1x-sm:Dot1x Idle State Entered
    00:18:46:     dot1x_auth Fa0/17: during state auth_aborting, got event 16(noauth
    Abort_noeapLogoff)
    00:18:46: @@@ dot1x_auth Fa0/17: auth_aborting -> auth_connecting
    00:18:46: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_enter called
    00:18:46: dot1x-ev:dot1x_post_message_to_auth_sm: Tx for req_id for supplicant 0
    024.1d10.d7c5
    00:18:46: dot1x-ev:Transmitting an EAPOL frame on FastEthernet0/17
    00:18:46: dot1x-packet:Tx EAP-Request(Id), id 1, ver 1, len 5 (Fa0/17)
    00:18:46: dot1x-registry:registry:dot1x_ether_macaddr called
    00:18:46: dot1x-packet:Tx sa=000f.24e9.72d1, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:46: dot1x-ev:Received an EAPOL frame on interface FastEthernet0/17
    00:18:46: dot1x-packet:Rx EAP-Response(Id), id 1, ver 1, len 21 (Fa0/17)
    00:18:46: dot1x-packet:Rx sa=0024.1d10.d7c5, da=0180.c200.0003, et 888E (Fa0/17)
    00:18:46: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:46: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:46: dot1x-ev:RECEIVED mac =0024.1d10.d7c5 and Stored MAC =0024.1d10.d7c5
    00:18:46:     dot1x_auth Fa0/17: during state auth_connecting, got event 7(rxRes
    pId)
    00:18:46: @@@ dot1x_auth Fa0/17: auth_connecting -> auth_authenticating
    00:18:46: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_exit alled
    00:18:46: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_authenticating_enter called
    00:18:46: dot1x-ev:sending AUTH_START to BEND for supp_info=80D7E584
    00:18:46: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_authenticating_action c
    alled
    00:18:46: dot1x-ev:Received AuthStart from Authenticator for supp_info=80D7E584
    00:18:46:     dot1x_bend Fa0/17: during state dot1x_bend_idle, got event 1(auth_
    start)
    00:18:46: @@@ dot1x_bend Fa0/17: dot1x_bend_idle -> dot1x_bend_response
    00:18:46: dot1x-sm:Dot1x Response State Entered for supp_info=80D7E584 hwidb=807
    D353C, swidb=807D4898 on intf=Fa0/17
    00:18:46: dot1x-ev:Managed Timer in sub-block attached as leaf to master
    00:18:46: dot1x-sm:Started the ServerTimeout Timer
    00:18:46: dot1x-ev:Going to Send Request to AAA Client on RP for id = 1 and leng
    th = 21
    00:18:46: dot1x-ev:Got a Request from SP to send it to Radius with id 4294967284
    00:18:46: dot1x-ev:Found a process thats already handling therequest for this id
     1
    00:18:48: dot1x-err:Dot1x Authentication failed (AAA_AUTHEN_STATUS_ERROR)
    00:18:48: dot1x-ev:Received VLAN is No Vlan
    00:18:48: dot1x-ev:Enqueued the response to BackEnd
    00:18:48: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:48: dot1x-ev:Enter function dot1x_aaa_acct_end
    00:18:48: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:48: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:48: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:18:48: dot1x-ev:Received QUEUE EVENT in response to AAA Request
    00:18:58: dot1x-sm:Fa0/17:0000.0000.0000:dot1x_process_txWhen_expire called
    00:18:58:     dot1x_auth Fa0/17: during state auth_connecting, got event 19(txWh
    en_expire)
    00:18:58: @@@ dot1x_auth Fa0/17: auth_connecting -> auth_connecting
    00:18:58: dot1x-sm:Fa0/17:0000.0000.0000:auth_connecting_connecting_action calle
    d
    00:18:58: dot1x-ev:dot1x_post_message_to_auth_sm: Skipping tx for req_id for def
    ault supplicant
    00:19:07: dot1x-ev:Received an EAPOL frame on interface FastEthernet0/17
    00:19:07: dot1x-packet:Rx EAPOL-Start, ver 1, len 0 (Fa0/17)
    00:19:07: dot1x-packet:Rx sa=0024.1d10.d7c5, da=0180.c200.0003, et 888E (Fa0/17)
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:07: dot1x-ev:RECEIVED mac =0024.1d10.d7c5 and Stored MAC =0024.1d10.d7c5
    00:19:07:     dot1x_auth Fa0/17: during state auth_authenticating, got event 4(e
    apStart)
    00:19:07: @@@ dot1x_auth Fa0/17: auth_authenticating -> auth_aborting
    00:19:07: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_aborting_enter called
    00:19:07: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_authenticating_aborting_action cal
    led
    00:19:07: dot1x-ev:Received DOT1X_MSG_AUTH_ABORT: setting msg_id = 0
    00:19:07:     dot1x_bend Fa0/17: during state dot1x_bend_response, got event 5(i
    nitialize)
    00:19:07: @@@ dot1x_bend Fa0/17: dot1x_bend_response -> dot1x_bend_initialize
    00:19:07: dot1x-sm:Dot1x Initialize State Entered
    00:19:07:     dot1x_bend Fa0/17: idle during state dot1x_bend_initialize
    00:19:07: @@@ dot1x_bend Fa0/17: dot1x_bend_initialize -> dot1x_bend_idle
    00:19:07: dot1x-sm:Dot1x Idle State Entered
    00:19:07:     dot1x_auth Fa0/17: during state auth_aborting, got event 16(noauth
    Abort_noeapLogoff)
    00:19:07: @@@ dot1x_auth Fa0/17: auth_aborting -> auth_connecting
    00:19:07: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_enter called
    00:19:07: dot1x-ev:dot1x_post_message_to_auth_sm: Tx for req_id for supplicant 0
    024.1d10.d7c5
    00:19:07: dot1x-ev:Transmitting an EAPOL frame on FastEthernet0/17
    00:19:07: dot1x-packet:Tx EAP-Request(Id), id 2, ver 1, len 5 (Fa0/17)
    00:19:07: dot1x-registry:registry:dot1x_ether_macaddr called
    00:19:07: dot1x-packet:Tx sa=000f.24e9.72d1, da=0180.c200.0003, et 888E (Fa0/17)
    00:19:07: dot1x-ev:Received an EAPOL frame on interface FastEthernet0/17
    00:19:07: dot1x-packet:Rx EAP-Response(Id), id 2, ver 1, len 21 (Fa0/17)
    00:19:07: dot1x-packet:Rx sa=0024.1d10.d7c5, da=0180.c200.0003, et 888E (Fa0/17)
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:07: dot1x-ev:RECEIVED mac =0024.1d10.d7c5 and Stored MAC =0024.1d10.d7c5
    00:19:07:     dot1x_auth Fa0/17: during state auth_connecting, got event 7(rxRes
    pId)
    00:19:07: @@@ dot1x_auth Fa0/17: auth_connecting -> auth_authenticating
    00:19:07: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_exit alled
    00:19:07: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_authenticating_enter called
    00:19:07: dot1x-ev:sending AUTH_START to BEND for supp_info=80D7E584
    00:19:07: dot1x-sm:Fa0/17:0024.1d10.d7c5:auth_connecting_authenticating_action c
    alled
    00:19:07: dot1x-ev:Received AuthStart from Authenticator for supp_info=80D7E584
    00:19:07:     dot1x_bend Fa0/17: during state dot1x_bend_idle, got event 1(auth_
    start)
    00:19:07: @@@ dot1x_bend Fa0/17: dot1x_bend_idle -> dot1x_bend_response
    00:19:07: dot1x-sm:Dot1x Response State Entered for supp_info=80D7E584 hwidb=807
    D353C, swidb=807D4898 on intf=Fa0/17
    00:19:07: dot1x-ev:Managed Timer in sub-block attached as leaf to master
    00:19:07: dot1x-sm:Started the ServerTimeout Timer
    00:19:07: dot1x-ev:Going to Send Request to AAA Client on RP for id = 2 and leng
    th = 21
    00:19:07: dot1x-ev:Got a Request from SP to send it to Radius with id 4294967285
    00:19:07: dot1x-ev:Couldn't Find a process thats already handling the request fo
    r this id 2
    00:19:07: dot1x-ev:Inserted AAA request for interface FastEthernet0/17, MAC 0024
    .1d10.d7c5, VLAN 0 on pending request queue
    00:19:07: dot1x-ev:Found a free slot at slot 0
    00:19:07: dot1x-ev:Found a free slot at slot 0
    00:19:07: dot1x-ev:Processing AAA request for interface FastEthernet0/17, MAC 00
    24.1d10.d7c5, VLAN 0 from pending request queue
    00:19:07: dot1x-ev:Request id = -11 and length = 21
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:07: dot1x-ev:The Interface on which we got this AAA Request is FastEtherne
    t0/17
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:07: dot1x-ev:Username is DUZEY\SAYTAMANER
    00:19:07: dot1x-ev:MAC Address is 0024.1d10.d7c5
    00:19:07: dot1x-ev:RemAddr is 00-24-1D-10-D7-C5/00-0F-24-E9-72-D1
    00:19:07: dot1x-ev:Found a supplicant block for mac 0024.1d10.d7c5 80D7E584
    00:19:19: dot1x-registry:dot1x_port_linkchange invoked on interface FastEthernet
    0/17
    00:19:19: dot1x-ev:supp_info=80D7E584 txWhen_timer=80D7E5D4 quietWhile_timer=80D
    7E594reAuthWhen_timer=80D7E5B4 awhile_timer=80D7E5F4
    00:19:19: dot1x-ev:destroy supplicant block for 0024.1d10.d7c5
    00:19:19: dot1x-ev:supp_info=80D71C74 txWhen_timer=80D71CC4 quietWhile_timer=80D
    71C84reAuthWhen_timer=80D71CA4 awhile_timer=80D71CE4
    00:19:19: dot1x-ev:destroy supplicant block for 0000.0000.0000
    00:19:19: dot1x-ev:Enter function dot1x_aaa_acct_end
    00:19:19: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:19:19: dot1x-ev:Found a supplicant block for mac 0000.0000.0000 80D71C74
    00:19:19: dot1x-ev:dot1x_port_cleanup_author: cleanup author on interface FastEt
    hernet0/17
    00:19:19: dot1x-ev:dot1x_post_message_to_auth_sm: cleanup author from interface
    This is driving me crazy, working on it for a whole week and no results..
    Thank you..

    Hi again,
    I have put the config on 2960. Now as soon as the authentication starts, this is the message on debug;
    dot1x authentication unable to start - authenticator not enabled..
    Any ideas?
    regards,
    onur

  • Wired 802.1X with ISE | Some computers cannot be authenticated

    Hi,
    We have a customer which is using ISE with 802.1X in order to authenticate computers. All the computers have their own certificate and most of them can be authenticated fine! The issue is that some computers cannot be authenticated.
    The port configuration the authenticator (Cisco WS-C4510R+E IOS 151-1) are configured exactly the same:
    interface GigabitEthernet2/19
    switchport access vlan 999
    switchport mode access
    authentication event no-response action authorize vlan 111
    authentication host-mode multi-domain
    authentication port-control auto
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 5
    But for some reason some PC cannot be authenticated. A wireshark capture on the computer not working shows that the computer receives a EAP Request Identity and also send a Response Identity to the switch but then nothing happens more:
    So the process is stucked in the EAP-Response/identity. I attach a debug capture on the switch for one of the computer which cannot be authenticated.
    It is really wired as most of the computer can be authenticated without any issues.
    Thanks in advance for your help.
    /Laurent

    I continued the debugging with the following debugs:
    debug dotx1 all
    debug authentication events
    And now I see the following interesting difference between the 2 clients:
    This one works:
    Aug 30 09:12:06.245: dot1x-ev(Gi3/34): New client detected, issuing Start Request to AuthMgr
    Aug 30 09:12:06.245: AUTH-EVENT (Gi3/34) Received 'START_REQUEST', current method is dot1x (handle 0x00000003)
    Aug 30 09:12:06.245: AUTH-EVENT (Gi3/34) Start request by method "dot1x" for bc5f.f439.21ca
    Aug 30 09:12:06.245: AUTH-EVENT: auth_mgr_idc_insert_key_in_record: update mac bc5f.f439.21ca
    Aug 30 09:12:06.245: AUTH-EVENT (Gi3/34) Sending NEW_MAC to dot1x (handle 0x5E0001D2)
    !! output suppressed - results in success
    This one does NOT work:
    Aug 30 09:14:22.247: dot1x-ev(Gi3/34): New client detected, issuing Start Request to AuthMgr
    Aug 30 09:14:22.247: AUTH-EVENT (Gi3/34) Received 'START_REQUEST', current method is dot1x (handle 0x00000003)
    Aug 30 09:14:22.247: AUTH-EVENT (Gi3/34) Start request by method "dot1x" for 3860.775d.cf06
    Aug 30 09:14:22.247: AUTH-EVENT (Gi3/34) MAC 3860.775d.cf06 moved from Gi1/2
    Aug 30 09:14:22.247: AUTH-EVENT (Gi3/34) MAC move action is deny
    !! output supressed - results in failure
    Both clients are testet one at a time on interface Gi3/34.
    The inteface that denies the MAC move action is Gi1/2. This is an interface connected to another network that both of the clients was previously connected to, before connecting them to the Dot1X network (In this case, interface Gi3/34)
    So now the question is what the MAC move action tries to do, and why it is denied...
    If i do a MAC-address table lookup of the affected address, it gives nothing! The MAC is not associated to interface Gi1/2 int the MAC table, even though this is where the auth-manager tries to move it from:
    SW_3.sal#sh mac add add 3860.775d.cf06     
    No entries present.
    If the MAC is not present in the address-table, how can it be associated to Gi1/2 ?
    I found out that the following command clear "whatever state" is inconsistent:
    clear authentication sessions mac xxxx.xxxx.xxxx
    And now the client can access the network!

  • ACS 5.1 Failure: 5411 EAP session timed out -- Wired 802.1X, machine-authentication

    Hi guys,
    I have a strange error here and I`m really disappointed.
    We currently try to do "Wired-802.1X" with our Windows XP SP3 Clients with EAP-TLS and "machine-only" authentication.
    We use ACS5.1 to authenticate the clients. At about 50% of the clients authentication works fine.
    At the other clients we can see a strange error at the ACS.
    At the Reports page --> "Authentications - RADIUS - Today" we see that a client is trying to authenticate, but this fails with the Failure Code: 5411 EAP session timed out.
    Logged At RADIUS
    Status NAS
    Failure Details Username MAC/IP
    Address Access Service Authentication
    Method Network Device NAS IP Address NAS Port ID CTS
    Security Group ACS Instance Failure  Reason
    Sep 2,10 3:37:46.916 PM
    Wired_802.1X_EAP-TLS
    EAP-TLS
    svacs01
    5411 EAP session timed out
    Steps
    11001  Received RADIUS Access-Request
    11017  RADIUS created a new session
    Evaluating Service Selection Policy
    15004  Matched rule
    15012  Selected Access Service - Wired_802.1X_EAP-TLS
    11507  Extracted EAP-Response/Identity
    12500  Prepared EAP-Request proposing EAP-TLS with challenge
    11006  Returned RADIUS Access-Challenge
    5411  EAP session timed out
    At the switch I used "Authentication Open" to get the client working and capture traffic with wireshark.
    Switch --> Request Identity --> Client
    Switch <-- Response Identity <-- Client
    Switch --> Request EAP-TLS --> Client
    Switch --> Request EAP-TLS --> Client
    Switch --> Request EAP-TLS --> Client
    Switch --> Request Identity --> Client
    Switch --> Request Identity --> Client
    Switch --> Request Identity --> Client
    What is missing ist the Switch <-- Response EAP-TLS <-- Client
    Any ideas what is going wrong ? Maybe someone had this error before ?
    Any suggestions how to debug this ?
    Thank you very much for your help!
    Mathias

    Hi @all,
    I have this issue too. It occurs in our wireless environment. The problem for me is that I don't know which client (or clients) causes the error. The error occur many times per day.
    Logged At RADIUS
    Status NAS
    Failure Details Username MAC/IP
    Address Access Service Authentication
    Method Network Device NAS IP Address NAS Port ID CTS
    Security Group ACS Instance Failure  Reason
    Sep 7,10 11:50:36.143 PM
    dot1x wireless
    PEAP
    bfnetacs01
    5411 EAP session timed out
    Kind regards,
    Michael

  • Wired 802.1x re-authentication passes but no connectivity after 1 hour

    I am testing wired 802.1x with the desired behavior of machine auth with user auth. I have a 6509 CAT OS 8.3(5) using the dot1x global defaults, 2 laptops one is XP SP1 and XP SP2 both with AuthMode=1 and SupplicantMode=3 with windows update as of 02mar2005. Active Directory. ACS SE 3.2 using vlan assignment. Have tested PC and user in different vlans and it works fine.
    1st observation:
    The initial EAP authentication is good. Every hour there is an EAP request with a final result of success in the packet trace. The switch shows connected dot1x-123. The ACS log shows the passed re-authentication. Everything looks good but both laptops lose connectivity 1 hour after the first authorization. If I issue "set port dot1x initialize" or enable/disable the port the process starts over.
    2nd observation:
    I can connect with Remote Desktop. There are 2 EAP start frames then the port becomes unauthorized about a minute later.
    Any ideas?

    No. I am still waiting on Cisco to address the 1st observation. Does it occur on your 6506 8.4(2). I see it also in my 6509 with 8.4(2). I find it interesting that it works in my end of life 2948g switch 8.2(1)GLX.
    The MS supplicant defaults for WIRED are authmode=1 and supplicantmode=2. Remote Desktop works in their default WIRED mode.
    At this point I am content controlling machine access until dot1x matures. Cisco ACS has a machine access restriction feature that authorizes the port after a successful User Auth. I have found if enabled, a successful Machine Auth will be unauthorized when logged in with a local account. If disable the local account is authorized b/c MA has only occurred.

  • How to use both wired and wireless connection with static addresses

    Now that I have setup my home network with static addresses (router, mini1, mini2 and PC) in the way I want, (big thanks to BDAqua http://discussions.apple.com/thread.jspa?threadID=1271635&tstart=0) I would like to understand some more advanced network concepts.
    I would like to change the network so that I use both the wireless connection and the built-in ethernet connection at the same time in my Mac mini1. I would like to connect my PC to my Mac mini by using the wired ethernet connection so that I reach the Internet from my PC as well. I would also like to be in control of all the addresses therefore I want to assign the addresses manually.
    The question: What addresses should I use between mini1 and PC? Should I use the same wireless address space as I already use between the wireless router and the other computers (router: 192.168.1.1, mini1: 192.168.1.101, mini2: 192.168.1.103) or should I use something totally different like 10.X.X.X? What should I put in ethernet connection "Router"-field, the same as in Airport (192.168.1.1)? What about DNS, same as in Airport?

    If I understand this correctly, you wish your Mini to perform Internet Sharing for your PC, correct!?
    If so you'll pretty much have to let the Mini handle DHCP & NAT on the Ethernet port. You also want to be sure Airport is dragged to the top of Network>Show:>Network Port Configurations, that's what position the Mini will use 1st for Internet itself.
    On the Mini turn on both Web Sharing & Internet Sharing. The PC once connected will have the Mini's Ethernet IP as it's Gateway addy.

  • OEAP600 with Wired 802.1X

    Hello everybody,
    I'm trying to find out if the Wired 802.1X capabilities associated with the OEAP-600 extend so far as including the dynamic assignment of attributes to the User's session? VLAN assignment would probably be the most useful, but QoS, Rate Limiting and ACL would also be handy.  These features all work on a standard switch and on a normal WLAN, but I can't find anything that discusses how the OEAP600 fits in to this?
    Any pointers greatly appreciated!
    Rich

    Hi Dan,
    thank you for your reply. I've already done this in the second place using the SDK and winrm ($8021XProfileInstance.GetProperty("Domain")). I've no idea were SCCM is getting this domain name from. Its cutting off the top level domain extension,
    may be SCCM is assuming that this equals the NETBIOS domain name but that is not the case. This is only a guess, in detail I need to know in fact on what basis SCCM is choosing the domain name, then i can fix this...
    Intels SCS putting the correct NETBIOS domain name in the amt config, used certificates are the same...

  • Airport Express and wired network with static IPs

    I have a wired network with static IPs. I have a block of free IPs I can use to connect to this network. Manually setting any of one IP from this block on my MacBook Pro via ethernet works great - full network connectivity including internet.
    What I wish to do is add an Airport Express in between my MBP and the network, so that I may have greater freedom (wireless opposed to wired). Is the AX capable of this? If yes, what are the correct settings? Keep in mind there is no DHCP server on the network.
    I have tried giving the AX an IP manually and then accessing it from the MBP having the AX share IP (effectively becoming it's own DHCP server?). This gives internet connectivity, but I can't see any of the servers on the network. I assume because I'm now on a new subnet.
    So I then changed the AX settings to not distribute an IP and gave the MBP another IP from the block (different from the AX). This gives me the network, but no internet.
    What am I doing wrong?

    Okay, I made a mistake and forgot to set the DNS servers manually. It seems the second method works fine. I've set up WPA2 security as well - I'm assuming this is okay in this situation. What is the correct term for this setup? A wireless access point bridge? Is there anything more I should know about this setup? TIA

  • Eap-tls wired 802.1x - certificate issue?

    I have configured ACS 4.0 and an 2003 Enterprise root CA on the same server, successfully applied the GPO to auto-enroll machines with Computer certificates, and then enabled 802.1x security on Catalyst 3750s. Note this is for wired 802.1x.
    If I reboot the machine, the EAP packets go through and you can see a successful authentication in the "Passed Authentications" log. However, if you disconnect the wire and then plug it back in, Windows gets stuck in "Validatiny Identity", and eventually a balloon pops up saying: "Windows was unable to find a certificate to log you on". Doing a 'sh dot1x interface ...' shows it is CONNECTING until the auth timeout is reached then it dumps the workstation into the guest vlan. Nothing is logged to Passed Authentications or Failed Attempts on the ACS server.
    Basically, the only time the EAP-TLS machine authentication works is when you reboot the machine. And if you change the state of the port either by diabling/enabling from the workstation or switch, or unplug the cable and plug it back in, Windows does not seem to pass the certificate information along to the PAE.
    This does not seem to happen when a user/client certificate is issued, only when it is a machine/computer certificate
    Has anybody seen this before and have any solutions why Windows cannot recogonize the machine certificate properly?

    We solved our WIRELESS problem by editing the following entrees. I sure this can be applied to the wired side somehow.
    The information about the correct settings can be found in this Microsoft document:
    http://technet2.microsoft.com/WindowsServer/en/library/8e74974f-c951-48ce-8235-02f4ed8e74921033.mspx?mfr=true
    The areas of interest are the SupplicantMode (EAPOL-Start Message) and AuthMode (what type of authentication to use) registry entries. These can be configured manually in the registry or applied via Group Policy.
    This allows just the machine to authenticate (using a Cert all ready on the Machine) then we use our ACS server to auth the user via AD.
    I am doing this wirelessly and using as long as you are using a WDS the following will be the result.
    Roaming AP to AP I only lost 1 packet.
    Roaming from Vlan to other Vlan I lost 5 packets (Different ip address)
    Shutting the wireless off and back on I only lost 8 packets.
    I thought this was a very good result. We will be launching our lab with 35 plus laptops in a classroom with 2 radios.

  • Wired 802.1x EAP-TLS Server Certificate Problem

    I have setup wired 802.1x authentication using EAP-TLS with ACS 3.3 and backend link to Active Directory. Root CA certificates are installed on the ACS and Client PC. Machine certificates and user certificates are also installed on Client PC. A Server certificate is installed on the ACS. All has been configured as detailed on the Cisco Web Site (numerous documents).
    If I set the client to authenticate the Servers certificate I get a failure. The clients log (Cisco Secure Services Client) states:
    11:48:53.088 Validating the server.
    11:48:53.088 Server list is empty, trusted server can not be validated.
    11:48:53.088 Server list is empty, trusted server can not be validated.
    11:48:53.088 The server certificate is invalid, the common name ACS-One.rotherham.gov.uk does not match.
    11:48:54.776 Port state transition to AC_PORT_STATE_UNAUTHENTICATED(AC_PORT_STATUS_ERR_SERVER_TLS_CERTIFICATE_REJECTED)
    11:48:54.776 The authentication process has failed.
    If I look at the Auth log on ACS (set to full logging) it states:
    AUTH 08/27/2008 14:09:04 I 0701 1492 AuthenProcessResponse: process response for 'paul.kyte@domain' against Windows NT/2000
    AUTH 08/27/2008 14:09:04 E 0350 1492 EAP: TLS: ProcessResponse: SSL handshake failed, status = 3 (SSL alert fatal:bad certificate)
    If I configure the client to not check the servers certificate it all works ok.
    Can anyone tell me why my server certificate is getting rejected?
    Thanks,
    Paul

    If Cisco Secure ACS runs on a member server and any user is to be authenticated using EAP-TLS, you must complete additional configuration in Active Directory of the domain containing Cisco Secure ACS. The username that you configured to run all Cisco Secure ACS services must also have permission to read user properties in Active Directory, else EAP-TLS authentication fails.

  • RADIUS failover not working in wired 802.1x (CATOS switch)

    I am setting up a pilot group for wired 802.1x testing. I have it working correctly on a C2950 and C3550s. I am having trouble with the RADIUS failover on my CATOS C4006 series switches. When I disable the primary RADIUS Server to test failover, the switch never fails over to the backup RADIUS server and thus wired 802.1x fails. Am I missing something?
    Any help is appreciated. Here is my config:
    #version 8.4(7)GLX
    #radius
    set radius server 10.30.XX.XX auth-port 1812 primary
    set radius server 10.18.XX.XX auth-port 1812
    set radius timeout 30
    set radius key EE08361
    Set dot1x system-auth-control enable
    set port dot1x 5/27 port-control auto
    all radius and dot1x settings are at their default values
    Any takers??!

    I have the same setup as yours. I use Steelbelt
    radius 6.0.1 on Linux and I have Cisco 2960
    catalyst. I use 802.1x over Ethernet with
    PEAP, as seen below:
    C2960#sh run int g0/23
    Building configuration...
    Current configuration : 133 bytes
    interface GigabitEthernet0/23
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x guest-vlan 668
    end
    C2960#
    C2960#sh run | inc dot
    aaa authentication dot1x default group radius
    dot1x system-auth-control
    dot1x guest-vlan supplicant
    C2960#sh run | inc radius-
    radius-server host 192.168.15.10 auth-port 1812 acct-port 1813 key xxx
    radius-server host 10.250.97.26 auth-port 1812 acct-port 1813 key xxx
    C2960#
    Everything works and when I shutdown the
    radius server process on host 192.168.15.10,
    "sbrd stop", it still works with the secondary
    radius server 10.250.97.26.
    The difference between yours and mine is that
    I am running IOS instead of CatOS.
    System image file is "flash:c2960-lanbasek9-mz.122-25.SEE4.bin"
    David

  • FlexConnect Access Point - Wired 802.1X or MAB Authentication

    Hi all,
    We are piloting wired 802.1X but have hit a snag - FlexConnect AP switchport configuration requires the port be configured as trunk, with the native VLAN for management and access VLAN(s) for client data.
    I know 802.1X cannot be configured on trunk port, but how can we configure MAB on trunk ports such as these?
    Otherwise, is there another way we can authenticate these FlexConnect APs on a switch using ISE?
    Thanks in advance.
    Regards,
    Stephen.

    Hi Stephen. You are correct, 802.1x should not be configured on a trunk port. Moreover, you would run into an issue with clients if you are running local switching mode. Here is the flow:
    1. AP, authenticates via MAB and profiling
    2. Client authenticates via PEAP/EAP-TLS, etc
    3. Now the client's traffic is locally switched, thus, the client mac address is showing on the same port where the AP is connected. The NAD (Switch) sees this new mac address and it is expecting it to perform 802.1x or MAB based authentication. The supplicant, however, does not know that and as far it is concerned it was already authenticated.
    So I have ran into this issue in my deployments and you have the following options (listed in preference order):
    1. Eliminate FlexConnect :)
    2. Utilize AutoSmartPorts where:
    - If an AP is connected, then 802.1x configuration is removed, port-security is enabled and locked to a single MAC address and trunk configuration is enabled
    - If the AP is removed, then port is configured as standard access port, port-security is removed and 802.1x is configured
    More info on auto smart ports:
    http://www.cisco.com/c/en/us/td/docs/switches/lan/auto_smartports/15-0_1_se/configuration/guide/asp_cg.html
    3. You can configure the port in a "multi-host" mode where after the first device is authenticated all subsequent devices are allowed on the network.
    Hope this helps!
    Thank you for rating helpful posts!

  • WoL over 802.1X with Vlan Assignement

    Hello
    I have a switch 3560, and an ACS v4
    In phase of test i have an infrastructure with 802.1X PEAP with automatic VLAN assignation by the ACS according to the Machine.
    My question is:
    it possible to implement Wake One Lan on 802.1x with a assigantion of vlan not statics (i.e. without use of command Switchport access vlan XXX)
    PS: if I do in statics the VLAN on a port Wake one Lan work without Pb with 802.1X

    Ok, on interface 0/19 :
    Switchport mode access
    speed 100
    duplex Full
    dot1x pae authenticator
    dot1x port-control auto
    dot1x control-direction in
    spanning-tree portfast
    The software use is like "wolcmd" with configuration of
    MAC address of the PC
    IP of the PC (give by DHCP reservation)
    Subnet mask
    Remote port Number : 7
    The authentication on ACS work fine and on ACS whe have this field
    [064] Tunnel-Type
    value : VLAN
    [065] Tunnel-Medium-Type
    Value : 802.
    [Tunnel-Private-Group-ID]
    Value : 69
    In fact, the only difference between config is assignation static or dynamic of VLAN
    I don't know if this what you wan't
    thanks

Maybe you are looking for

  • Error occured while transforming payload using XSL

    Hi, When i deployed the SOAOrderBooking BPEL process, an instance created successfully in BPEL console (after submitting orders successfully), but when i clicked the instance window in ESB control to confirm that the service instance successfully rec

  • NAKISA Authorizations - How does it work?

    Hi all, How does NAKISA authorization works? Does it all depend on the SAP backend authorizations or is there another level of authorization in NAKISA? I am currently using structural authorization  and AOR to control authorization in SAP portal but

  • ODBC driver hangs for two table joining

    Hi, I was trying to access two tables with the following statements. I used Oracle 8 ODBC driver to access Oracle 9 database. Statement 1 and 2 are working fine but executing Statement 3 will hangs the program. Statement1: SELECT (fields from two tab

  • Quantity upto Four decimal points

    Hi, In Easy cost planning , I want to put quantity upto 4 decimal places but system allowing only upto 3 decimal. Pl suggest. It is very urgent. rgds

  • Scrolling bug ?

    import javax.swing.*; import java.awt.BorderLayout; public class Scroll extends JDialog {      Box box = Box.createVerticalBox();      public void kuku() {           setTitle("Test scrolling");           box.add( new JLabel("Hello"));           box.a