dot1x EAP authenticator

Similar Questions

• ACS + Wired dot1x machine authentication

  Hello

  I'm trying to configure computer authentication wired in function. I followed this guide

  http://www.Cisco.com/en/us/products/sw/secursw/ps2086/products_configuration_example09186a00805e7a18.shtml#req

  However I simply get the same error all the time on ACS.

  Authenticator of invalid message in the request of the EAP

  Switch configuration;

  interface GigabitEthernet0/46

  switchport access vlan 20

  switchport mode access

  media type rj45

  dot1x EAP authenticator

  self control-port dot1x

  dot1x re-authentication

  dot1x comments - vlan 20

  I am trying to corresponding installation group to make the assignment of vlan however, I walked just under the strategy of the unknown user at the min with no configuration of vlan assignment.

  No matter which shed some light on this, all I want to do is authenticate a machine by issuing certificates an id vlan based on the computer name and AD Group. No authentication of the user, this can be done via the PDC.

  Purely using machine auth.

  See you soon

  Scott

  Scott,

  I recommend you to change/retype the secret shared on the ACS server and the switch for the

  AAA Client and AAA server.

  Kind regards

  ~ JG

  Note the useful messages

• Dot1x question: authentication MAB will never be failure or timeout

  Hello

  I have a problem when the switch will try to authenticate a device with MAB and it will never, or timeout.

  Here's the situation: where a device has 802 authentication. 1 x active but not a invalid parameters (or missing certificate).

  The switch will start dot1x for the customer and it will not be (a). He will switch to dot1x to MAB and... silence.

  I use a WS-C2960-24LT-L with IOS 15.0 (2) SE.

  Config:

   interface FastEthernet0/16 switchport access vlan 155 switchport mode access authentication event fail action authorize vlan 550 authentication event server dead action authorize vlan 550 authentication event no-response action authorize vlan 550 authentication port-control auto mab dot1x pae authenticator dot1x timeout quiet-period 3 dot1x timeout tx-period 1 spanning-tree portfast spanning-tree bpduguard enable end

  Newspapers:

   Dec 4 17:34:51.064 GMT: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to up Dec 4 17:34:51.147 GMT: %AUTHMGR-5-START: Starting 'dot1x' for client (e89a.8fb0.67c3) on Interface Fa0/16 AuditSessionID 0A011246000001187AA1F62B Dec 4 17:34:52.070 GMT: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to up Dec 4 17:34:54.234 GMT: %DOT1X-5-FAIL: Authentication failed for client (e89a.8fb0.67c3) on Interface Fa0/16 AuditSessionID 0A011246000001187AA1F62B Dec 4 17:34:54.234 GMT: %AUTHMGR-7-RESULT: Authentication result 'timeout' from 'dot1x' for client (e89a.8fb0.67c3) on Interface Fa0/16 AuditSessionID 0A011246000001187AA1F62B Dec 4 17:34:57.321 GMT: %DOT1X-5-FAIL: Authentication failed for client (e89a.8fb0.67c3) on Interface Fa0/16 AuditSessionID 0A011246000001187AA1F62B Dec 4 17:34:57.321 GMT: %AUTHMGR-7-RESULT: Authentication result 'timeout' from 'dot1x' for client (e89a.8fb0.67c3) on Interface Fa0/16 AuditSessionID 0A011246000001187AA1F62B Dec 4 17:35:00.601 GMT: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/16 AuditSessionID 0A011246000001197AA21094 Dec 4 17:35:00.601 GMT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Fa0/16 AuditSessionID 0A011246000001197AA21094 Dec 4 17:35:00.601 GMT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Fa0/16 AuditSessionID 0A011246000001197AA21094

  SH int fa0/16 session auth

   Interface: FastEthernet0/16 MAC Address: Unknown IP Address: Unknown Status: Running Domain: UNKNOWN Oper host mode: single-host Oper control dir: both Session timeout: N/A Idle timeout: N/A Common Session ID: 0A011246000001197AA21094 Acct Session ID: 0x00000380 Handle: 0x1700011A Runnable methods list: Method State dot1x Failed over mab Running

  You can see above that is still running MAB but this device is not listed on the local store ID sequence or any where. If I run the command 'No mab', the switch will respond will be unavailable methods more and nothing more.

   Interface MAC Address Method Domain Status Session ID Fa0/16 (unknown) N/A UNKNOWN No Methods 0A011246000001197AA21094

  However, when I remove the command MAB; reset the port; He eventually fail to dot1x and move to restricted VLAN.

  It is this value by default design or the drop between the switch and the ACS authentication? Should I just use MAB where it is needed?

  Thank you in advance.

  On your configuration of the interface, I normally expect to see flex active thus auth:

   authentication priority dot1x mab authentication order dot1x mab authentication event fail action next-method

• Certificate based with chaining of EAP authentication

  Hello world

  My question is about EAP - TLS and EAP chaining. I know that EAP - TLS is used for certificate based authentication. I think using EAP chaining which employees computer and user authentication. So if you use EAP - TLS with chaining EAP, this would mean that ISE will validate the computer certificate and user certificate? I do not know if there is something called user certificate. Not a guy from Microsoft.

  My second question is that it is a way we could use the certificate and the name of user and password for authentication at the same time?

  I would strongly appreciate an explanation or a reference document which could help to clarify my concept on this subject.

  Thank you

  Quesnel

  Yes, with EAP-chaining, you can make user and computer certificate authentication at the same time.

  Yes, you can also use EAP - TLS and PEAP/MSCHAPv2 authentication even in, what's special on EAP-chaining, and therefore requires anyconnect nam. When you set your anyconnect configuration, you will be asked if you wan't do user, computer, or user and machine authentication, and you will get two separate configuration settings, one for the user and the other for the machine and you can select any EAP method in those, they are not the same.

  http://www.Cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-...

• ISE / IBNS 2.0 - open authentication

  Anyone travelling IBNS 2.0, or everyone stick w / the legacy "authentication" of orders that have been available as forever?

  We seek in IBNS 2.0 to take advantage of its critical ACL functionality that is not available in the type of inheritance auth - manager.

  When I made a conversion of an existing style, legacy to the new style 2.0 on a 3850 IBNS, I can't tell which line is the equivalent of the command "open authentication".
  Can someone please report it to me?

  How can we make "open authentication" in the new style IBNS 2.0?
  This is important for our phases of deployment of the MONITOR & LOW - IMPACT ISE.

  ===============

  New style:

  Subscriber control policy-map type POLICY_Gi1/0/21
  event started the match-all session
  10-class until the failure
  10 authenticate using dot1x attempts 2 time try again 0 priority 10
  first game event-one authentication failure
  DOT1X_FAILED - until the failure of class 5
  10. put end dot1x
  20 authenticate using mab priority 20
  class 10 AAA_SVR_DOWN_UNAUTHD_HOST - until the failure
  10 activate service-model CRITICAL_AUTH_VLAN_Gi1/0/21
  20 activate service-model DEFAULT_CRITICAL_VOICE_TEMPLATE
  25 turn CRITICISM-ACCESS service models
  30 allow
  reauthentication 40 break
  class 20 AAA_SVR_DOWN_AUTHD_HOST - until the failure
  break 10 reauthentication
  20 allow
  DOT1X_NO_RESP - until the failure of class 30
  10. put end dot1x
  20 authenticate using mab priority 20
  class 40 MAB_FAILED - until the failure
  10 complete mab
  20 40 authentication restart
  class 60 still - until the failure
  10. put end dot1x
  20 terminate mab
  authentication-restart 30 40
  event agent found match-all
  10-class until the failure
  10 complete mab
  20 authenticate using dot1x attempts 2 time try again 0 priority 10
  AAA-available game - all of the event
  class 10 IN_CRITICAL_AUTH - until the failure
  clear-session 10
  class 20 NOT_IN_CRITICAL_AUTH - until the failure
  10 take a reauthentication
  match-all successful authentication event
  10-class until the failure
  10 activate service-model DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
  violation of correspondence event
  10-class until the failure
  10 restrict

  ================

  The old:

  interface GigabitEthernet1/0/21
  TEST-ISE description
  IP access-group ACL by DEFAULT in
  authentication event fail following action method
  action of death event authentication server allow vlan 1
  action of death event authentication server allow voice
  the host-mode multi-auth authentication
   open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  authentication timer restart 40
  restrict the authentication violation
  MAB
  added mac-SNMP trap notification change
  deleted mac-SNMP trap notification change
  dot1x EAP authenticator
  dot1x tx-time 10

  It seems that "open authentication" is now default and as such are not not in the new configuration of style.

  Access-session closed Example: Device(config-if)# access-session closed

  Prevents access preauthentication on this port. The port is set to open access by default.

  http://www.Cisco.com/en/us/docs/iOS-XML/iOS/San/configuration/XE-3SE/3850/San-Cntrl-pol.html

• 802. 1 x authentication with Radius and win7 Mab

  Good afternoon!

  I have a question about 802.1 x I've set up a laboratory in which I have configured authentication mab with 802. 1 x, but I have a weird behavior of my network controller. On the switch (4948e), I see that the user is authenticated and authorized, and I can see my switch these outputs:

  21 April 15:13:30.263: % AUTHMGR-5-START: start "mab" for the customer (a01d.48ac.b7f
  (5) on the Interface item in gi1/11 AuditSessionID C0A8DF9C0000002E002F3DAC
  * Apr 21 15:13:30.267: % MAB-5-SUCCESS: authentication successful for the client (a01d
  . 48AC.B7F5) on the Interface item in gi1/11 AuditSessionID C0A8DF9C0000002E002F3DAC
  * April 21 15:13:30.267: % AUTHMGR-7-RESULT: authentication result 'success' of me
  ab' for the client (a01d.48ac.b7f5) on the Interface item in gi1/11 AuditSessionID C0A8DF9C00000
  02E002F3DAC
  * Apr 21 15:13:31.299: % AUTHMGR-5-SUCCESS: authorization succeeds in for the customer (a0
  1d.48AC.B7F5) on the Interface item in gi1/11 AuditSessionID C0A8DF9C0000002E002F3DAC

  If I type "see the authentication session", the corresponding output.

  Switch #show authentication sessions

  Interface MAC address method ID of Session of field status
  Item in gi1/11 a01d.48ac.b7f5 mab DATA Authz success C0A8DF9C0000002E002F3DAC

  The thing is that when I check my network controller, it said "authentication failure". That's what I've done so far:

  1. I restarted my pc, the same behavior.

  2. I disabled and enabled my network controller, the same behavior.

  3. I rebooted the switch and re-configured. Same behavior.

  4. I tried with another PC configuration. Same behavior.

  5. I changed the configuration of "user authentication" using dot1x EAP authenticator and it worked.

  This is the configuration I have on my switch:

  AAA new-model
  Group AAA dot1x default authentication RADIUS
  Group AAA authorization network default RADIUS
  start-stop radius group AAA accounting dot1x default
  AAA - the id of the joint session

  !

  control-dot1x system-auth

  !

  Switch #show run gigabitEthernet int 1/11
  Building configuration...

  Current configuration: 128 bytes
  !
  interface GigabitEthernet1/11

  Cx-to-Host description
  switchport access vlan 223
  switchport mode access
  Auto control of the port of authentication
  MAB
  end

  This is the first time I'll put up a configuration 802. 1 x. I'm doing something wrong?

  I really hope that I am not the only one with this kind of behavior!

  Thank you for any assistance you can give me!

  Status: Authz success

  This means that the port is open. Is this permanent? Keep looking at the output of the show a few minutes see if it tries to dot1x too. Can you ping from the PC?

  As authentication of 802. 1 X is enabled in the properties of the map NETWORK PC that you can expect dot1x method runs on the switch and eventually respond to the computer with auth fail. Authentication in the PC box is not necessary for MAB.

  What type of RADIUS server you use and there 802.1 policy X in addition to MAB policy?

  IP address: unknown

  This means that the switch did not recognize the IP address of the host, probably due to the lack of

  analysis of IP device

  command. But it is not necessary for the plain MAB or dot1x.

• 802. 1 x authentication fail - packages keep discarded

  Hi all

  I implement 802. 1 x using Catalyst 3560 and MS IAS as a radius server. The plan is, each PC must authenticate using PEAP with RADIUS and assigned to a VLAN. Fail authentication will be assigned to comments VLAN.

  The problem is when I test a PC, set the PC withouth 802. 1 x enabled, plug it into the port of 3560, maintains the port that PC packets rejected forever. I remove dot1x configuration on the interface, but he keep throwing all packages (can not ping anywhere). When I connected the PC to the other port with the same configuration (not dot1x), it works. I tried closed and no closure of the interface, disable - enable devices, remove config and etc but the PC can't ping anywhere.

  I'm glad paste the config. Could someone please explain to me why it happens and what is the solution? Thank you very much.

  Here is an example config which should work:

  interface GigabitEthernet1/0/5

  switchport access vlan 31

  switchport mode access

  dot1x EAP authenticator

  self control-port dot1x

  dot1x comments - vlan 35

  LAN virtual auth failure of dot1x 35

  end

  This should NOT prevent a non-1 x machine to access the network forever. With the foregoing and time by default, it is a waiting period of 90 s of 802. 1 X. You can change the time of the tx and the maz-reauth-req variable to achieve up to 2 sec, if you wish. If you remove 802. 1 X, then that should also not packages. If the above 2 items are produced, then you hit a software bug, and a case of TACS must be opened immediately. Are you sure that something like just DHCP has not expired on you well?

  NOTE: The above configuration has vlan 35 for the comments - vlan being equal to the auth-fail-vlan based on you indicating the need of this above. It might be different from that of the vlan-comments, if you want it to be. Some could be the same vlan as what is configured statically on both port [31].

  Hope this helps,

• 802. 1 x authentication and phones

  I have just begun to roll authentication of 802. 1 x and found that although I got the authentication for the PC the data VLAN to work, phones on the VOICE VLAN are not unless I put 'host-mode authentication' to 'stream '.

  We did turn not authenticated for 7 years with phones and both work of the PC.

  What I want to do (i.e. what management told me to move), is to have phones connect not authenticated (CDP agreeing to handle correct assignment of VLANS) but require PC to authenticate.

  I guess the simple question is; is it still possible? If this is the case, any advice is greatly appreciated.  (config switch is below).

  Thank you

  Arch

  !
  version 12.2
  no service button
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  !
  switch to hostname
  !
  boot-start-marker
  boot-end-marker
  !
  emergency logging console
  emergency logging monitor
  enable secret 5 *.
  !
  AAA new-model
  !
  !
  Group AAA dot1x default authentication RADIUS
  !
  !
  !
  AAA - the id of the joint session
  clock timezone cst - 6
  clock to summer time recurring cdt
  1 supply ws-c3750g-24ps switch
  mtu 1500 routing system
  VTP transparent mode
  no ip domain-lookup
  !
  !
  interface ip igmp snooping mrouter vlan 41 item in gi1/0/27
  interface ip igmp snooping mrouter vlan 41 item in gi1/0/28
  !
  QoS omitted MLS
  !

  pvst spanning-tree mode
  spanning tree extend id-system
  !
  internal allocation policy of VLAN ascendant
  !
  VLAN 13
  name data - VLAN
  !
  VLAN 857
  name - VLAN VoIP
  !
  VLAN 1611
  name comments - VLAN
  LLDP run
  !
  !
  class-map correspondence AutoQoS-VoIP-RTP-Trust
  match ip dscp ef
  class-map correspondence AutoQoS-VoIP-control-Trust
  match ip dscp cs3 af31
  !
  !
  Policy-map AutoQoS-Police-CiscoPhone
  class AutoQoS-VoIP-RTP-Trust
  DSCP ef Set
  320000 8000 exceed-action of the police controlled-dscp-transmit
  class AutoQoS-VoIP-control-Trust
  DSCP Set cs3
  32000 8000 exceed-action of the police controlled-dscp-transmit
  !
  !
  !
  GigabitEthernet1/0/1 interface
  switchport access vlan 13
  switchport mode access
  switchport voice vlan 857
  security breach port switchport protect
  bandwidth share SRR-queue 10 10 60 20
  form of bandwidth SRR-queue 10 0 0 0
  queue-series 2
  priority queue
  authentication-sense in
  no response from the authentication event action allow vlan 1611
  stream of host-authentication mode
  Auto control of the port of authentication
  protect the violation of authentication
  MLS qos trust device cisco-phone
  MLS qos trust cos
  Auto qos voip cisco-phone
  dot1x EAP authenticator
  spanning tree portfast
  service-policy input AutoQoS-Police-CiscoPhone
  !
  interface GigabitEthernet1/0/2
  !
  interface GigabitEthernet1/0/3
  !
  interface GigabitEthernet1/0/4
  !
  interface GigabitEthernet1/0/5
  !
  interface GigabitEthernet1/0/6
  !
  interface GigabitEthernet1/0/7
  !
  interface GigabitEthernet1/0/8
  !
  interface GigabitEthernet1/0/9
  !
  interface GigabitEthernet1/0/10
  !
  interface GigabitEthernet1/0/11
  !
  interface GigabitEthernet1/0/12
  !
  interface GigabitEthernet1/0/13
  !
  interface GigabitEthernet1/0/14
  !
  interface GigabitEthernet1/0/15
  !
  interface GigabitEthernet1/0/16
  !
  interface GigabitEthernet1/0/17
  !
  interface GigabitEthernet1/0/18
  !
  interface GigabitEthernet1/0/19
  !
  interface GigabitEthernet1/0/20
  !
  interface GigabitEthernet1/0/21
  !
  interface GigabitEthernet1/0/22
  !
  interface GigabitEthernet1/0/23
  !
  interface GigabitEthernet1/0/24
  !
  interface GigabitEthernet1/0/25
  !
  interface GigabitEthernet1/0/26
  !
  interface GigabitEthernet1/0/27
  !
  interface GigabitEthernet1/0/28
  switchport trunk encapsulation dot1q
  switchport trunk allowed vlan 13,857,1611
  switchport mode trunk
  bandwidth share SRR-queue 10 10 60 20
  form of bandwidth SRR-queue 10 0 0 0
  queue-series 2
  MLS qos trust cos
  Auto qos voip trust
  !
  RADIUS-server host 10.1.2.10 auth-port 1645 acct-port 1646
  Server RADIUS 7 key *.
  RADIUS vsa server send authentication
  end

  Hello

  authentication with PC and phone needs "multi-domain of authentication host mode. You con use MAC address or 802. 1 X (username & password) for authentication of IP phone.

  Profile authenticatipo must send "device-traffic-class = voice" to the switch. PC fits the DATA cross-domain and phone VOICE-field.

  See attachment:

• dot1x auth-fail vlanX does not

  Hello

  I have configured 802. 1 x on a fas0/3 and works very well.

  I'm testing to set up a restricted VLAN on that port, and it does not work.

  This is the configuration:

  interface FastEthernet0/3
  switchport access vlan 11
  switchport mode access
  dot1x EAP authenticator
  self control-port dot1x
  LAN virtual auth failure of dot1x 30
  dot1x max-authentication failure 2 attempts
  

  When the PC connected to the Fas0/3 authentication failed twice, he should go to 30 of VLAN, but this isn't the case (port fas0/3 remains 11 VLAN in down state)

  VLANS SHOW:

  11 active VLAN0011 Fa0/2, Fa0/3, Fa0/4
  30 active LIMITED

  SW1 #sh dot1x interface FAS 0/3
  Dot1x FastEthernet0/3 information
  -----------------------------------
  EAP AUTHENTICATOR =
  PortControl = AUTO
  ControlDirection = both
  HostMode = SINGLE_HOST
  A re-authentication = off
  QuietPeriod = 60
  ServerTimeout = 30
  SuppTimeout = 30
  ReAuthPeriod = 3600 (configured locally)
  ReAuthMax = 2
  MaxReq = 2
  TxPeriod = 30
  RateLimitPeriod = 0
  AUTH-Fail-Vlan = 30
  Fail-Max-des authentication attempts = 2

  It is a 2960 running c2960-lanbase - mz.122 - 35.SE5, what Miss me?

  Federico.

  Ferderico,

  How do you test the VLAN Auth failure?  If you test with a bad password and using the PEAP Protocol it is considerred a reproducible error which should not cause a rejection of the RADIUS server, instead the password can be retried without ripping first in the tunnel TLS via an Access-Reject.  As long as it is configured, it should be 3 access - reject the server RADIUS must be filed in the VLAN auth failure.  If I remember correctly a bad username is also reproducible.

  If you use DCC 5 you can lower the number of retries PEAP 1 in which case you will have failed connection 6 times with a wrong password to hit the VLAN auth failure.

  -Jesse

• some computers are not authenticated successfully with ISE and join comments vlan

  Hello

  We have deployed ISE in a company and set the workstations for authentication of the computer. When jobs are authentication, they are placed in the VLAN Data (5), if they fail, then they must be placed in the VLAN (50). WiredAutoConfig service as supplicant is set with gpo to all the workstations have the same settings.

  Certificate of the ISE is signed by our internal CA and workstations have also imported CA in their trusted CA list.

  The problem is that few jobs are placed in the VLAN. Previously on these workstations, we got a pop-up as below. When you click on 'connect' work stations have been placed properly in the data VLAN (5). We do not get this security alert more on these machines and they just join them VLAN that is don't want we want.

  However, most of the workstations is authenticated successfully.

  

  switchports configuration:

  switchport access vlan 5
  switchport mode access
  switchport voice vlan 6
  authentication event fail following action method
  action of death event authentication server allow vlan 5
  action of death event authentication server allow voice
  no response from the authentication event action allow vlan 50
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  MLS qos trust dscp
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  Journal of ISE authentication;

  auth1.PNG

  

  authen2.PNG

  

  Everyone is in a similar situation?

  I guess that the machines in the domain have the root CA certificate checked under the 'Protected EAP Properties' window?

• "authentication control-direction in" CLOSED authentication mode

  Switch: 4510R-E, running a DEV version 3.6.0-based

  ISE: 1.2.0.899 patch 7

  Hi, I worked on a weird issue where some of my clients would pass through their IP address and the only way I could get it back was to spend their open port in authentication mode. I need to run in closed mode, because I change VLAN via MAB.

  I worked with TAC, and they suggested that add the command "authentication control direction in" in my config switchport (below). Couple tests Ive done, this seems to help. But I understand why. Isn't the direction-control a little command reduce to naught the principle of closed mode operation? That is, it allows a communication until the device is allowed. Thank you.

  interface GigabitEthernet2/18
  switchport access vlan 34
  switchport mode access
  switchport voice vlan 66
  events-the link status logging
  authentication event fail following action method
  action of death server authentication of the event allowed vlan 34
  action of death event authentication server allow voice
  living action of the server reset the authentication event
  the host-mode multi-auth authentication
  authentication order mab dot1x
  authentication priority dot1x mab
  Auto control of the port of authentication
  restrict the authentication violation
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  service-policy input QoS-entry-policy
  Service-politique-accueil-port-sortie-strategie output QoS
  end

  I also need to use this command to preserve the authenticated devices. He was going on with a video surveillance system, which was an embedded Linux operating system. It's the MAB and because there was no transmission all noisy traffic (unlike a windows box) then the switch would not be able to reauth it as it had no mac address to auth, so show up with an 'unknown' in the MAC field.

  It allows essentially traffic flow out of the port. This active unit to receive HTTP traffic and respond, then the switch could auth it again once the device sent a frame.

  When you do a Show authentication sessions you will notice a Oper control dir: the two will pass to Oper control dir: in

• 802. 1 x authentication with Linux clients on C2960S-48TS-L problem

  Hello

  Due to implementing Wired 802. 1 x in my business I have fased with authentication problem some computers to Linux (Ubuntu) 13.10 + via mab as my switches(C2960S-48TS-L) of access. The problem exists on IOS 12.55 and 15.0 (2) SE6.

  It seems that the authenticator cannot detect the supplicant MAC address. In debugging, the MAC address is (unknown MAC) or (0000.0000.0000).

  Before I could see the registered authentication MAC address on the switchport interface (no parameters of 802.1 x on the port):

  SH-mac address table interface 0/g1/2 "prior to authentication of 802. 1 x '.
  VLAN Mac Address Type Ports
  ----    -----------       --------    -----
  Article IG1 2 STATIC 0015.990f.60d9/0/2

  The host must obtain to Vlan 2 after the failure of authentication (according to the parameters of the port). But in reality the after attempting to authenticate the host on this port

  loses connection with the network and does not get into 2 VLANs

  SH - g1/0/2 interface mac address table 'after authentication 802. 1 x »
  VLAN Mac Address Type Ports
  ----    -----------       --------    -----

  SH authentication sessions

  Interface MAC address method ID of Session of field status
  6A7D1FAF0000000000023E32 DATA Authz success dot1x item in gi1/0/24 (unknown)
  6A7D1FAF0000000200024193 DATA Authz success dot1x item in gi1/0/25 (unknown)
  Item in gi1/0/2 (unknown) UNKNOWN mab 6A7D1FAF000000280011BA1A running

  SH dot1x interface details g1/0/2

  Info Dot1x for GigabitEthernet1/0/2
  -----------------------------------
  EAP AUTHENTICATOR =
  QuietPeriod = 5
  ServerTimeout = 0
  SuppTimeout = 30
  ReAuthMax = 2
  MaxReq = 2
  TxPeriod = 3

  SH run int g1/0/2

  interface GigabitEthernet1/0/2
  Description # user Port #.
  switchport access vlan 2
  switchport mode access
  switchport voice vlan 5
  switchport port-security maximum 5
  switchport port-security
  aging of the switchport port security 2
  inactivity of aging switchport port-security type
  IP arp inspection 120 deadline
  action retry authentication event 0 failure allow vlan 2
  action of death event authentication server allow vlan 2
  no response from the authentication event action allow vlan 2
  stream of host-authentication mode
  Auto control of the port of authentication
  periodic authentication
  Timer of authentication be re-authenticated 3900
  inactivity timer authentication 300
  restrict the authentication violation
  MAB
  dot1x EAP authenticator
  dot1x quiet-period 5
  dot1x tx-timeout 3
  Storm-control broadcasts 1.00
  multicast storm-control level 1.00
  Storm-control action trap
  No cdp enable
  spanning tree portfast
  spanning tree enable bpduguard
  spanning tree guard root
  end

  I tried to change host-mode of authentication in many areas, but the problem remains.

  "debug dot1x all" in the attached file.

  Please help me solve this problem

  You must delete all port security settings before you enable dot1x on a port, these two functions do not work well together.

  Jan.

• order of the authentication and authorization air ISE

  Hello

  I am looking to configure ISE to authenticate joined AD PC (Anyconnect NAM help for user authentication and the machine with the EAP chaining) and profile Cisco IP phones. The Pc and phones connect on the same switchport. The switchport configuration was:

  switchport
  switchport access vlan 102
  switchport mode access
  switchport voice vlan 101
  authentication event fail following action method
  multi-domain of host-mode authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  MAB
  added mac-SNMP trap notification change
  deleted mac-SNMP trap notification change
  dot1x EAP authenticator

  The configuration above worked well with authentication sessions 'show' of the switch showing dot1x as the method to the field of DATA and mab for VOICE. I decided to reverse the order of authentication/priority on the interface of the switch so that the phone would be authenticated first by mab. As a result, the authentication sessions 'show' of the switch showing mab as a method for both VOICE and DATA.

  To avoid this I created a permission policy on ISE to respond with an "Access-Reject" when the "UseCase = Lookup host" and the endpoint identity group was unknown (the group that contains the PC AD). This worked well worked - the switch would attempt to authenticate the PC and phone with mab. When an "Access-Reject" has been received for the PC, the switch would pass to the next method and the PC would be authenticated using dot1x.

  The only problem with this is that newspapers soon filled ISE with denys caused by the authorization policy - is possible to realize the scenario above without affecting the newspapers?

  Thank you
  Andy

  Hi Andy -.

  Have you tried to have the config in the following way:

   authentication order mab dot1x authentication priority dot1x mab

  This "order" will tell the switchport always start with mab , but the keyword 'priority' will allow the switchport to accept the authentications of dot1x to dot1x devices.

  For more information see this link:

  http://www.Cisco.com/c/en/us/products/collateral/iOS-NX-OS-software/identity-based-networking-service/application_note_c27-573287.html

  Thank you for evaluating useful messages!

• Users wireless with peap authentication problem

  Good afternoon

  I am currently trying to authenticate users wireless using PEAP and an external RADIUS server. The problem is when I try to authenticate that I get this error:

  AAA/AUTHENTIC/PPP: List of selection method "permanent premises.

  Dot11-7-AUTH_FAILED: Station... Failed authentication

  Should not use local authentication, but the aaa server that I set up.

  I looked on the internet but have not found a working solution.

  Does anyone know why it does not work?

  Here is my configuration running:

  Current configuration: 4276 bytes
  !
  ! Last modification of the configuration at 00:45:40 UTC Monday, March 1, 1993
  ! NVRAM config update at 16:38:23 UTC Thursday, July 24, 2014
  ! NVRAM config update at 16:38:23 UTC Thursday, July 24, 2014
  version 15.2
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  host ap name
  !
  !
  Pulse 9 logging console
  enable secret 5 $1$ QVC3$ dIVAarlXOo52rN3ceZm1k0
  !
  AAA new-model
  !
  !
  AAA rad_eap radius server group
  192.168.2.2 Server ACCT-port auth-port 1812 1813
  !
  AAA rad_mac radius server group
  !
  AAA rad_acct radius server group
  !
  AAA rad_admin radius server group
  !
  AAA server Ganymede group + tac_admin
  !
  AAA rad_pmip radius server group
  !
  RADIUS server AAA dummy group
  !
  AAA authentication login eap_methods group rad_eap
  AAA authentication login mac_methods local
  AAA authorization exec default local
  AAA accounting network acct_methods power group rad_acct
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  no ip Routing
  no ip cef
  !
  !
  !
  dot11 syslog
  !
  ssid dot11 test
  authentication open eap eap_list
  authentication-key wpa version2 management
  Comments-mode
  !
  !
  EAP peap profile
  peap method
  !
  Crypto pki token removal timeout default 0
  !
  ...
  !
  !
  Bridge IRB
  !
  !
  !
  interface Dot11Radio0
  no ip address
  no ip route cache
  !
  encryption ciphers aes - ccm mode
  !
  SSID test
  !
  gain of antenna 0
  STBC
  beamform ofdm
  root of station-role
  Bridge-Group 1
  Bridge-group subscriber-loop-control 1
  Bridge-Group 1 covering-disabled people
  Bridge-Group 1 block-unknown-source
  No source of bridge-Group 1-learning
  unicast bridge-Group 1-floods
  !
  interface Dot11Radio1
  no ip address
  no ip route cache
  Shutdown
  gain of antenna 0
  no block of dfs
  channel SFR
  root of station-role
  Bridge-Group 1
  Bridge-group subscriber-loop-control 1
  Bridge-Group 1 covering-disabled people
  Bridge-Group 1 block-unknown-source
  No source of bridge-Group 1-learning
  unicast bridge-Group 1-floods
  !
  interface GigabitEthernet0
  no ip address
  no ip route cache
  automatic duplex
  automatic speed
  dot1x EAP authenticator
  Bridge-Group 1
  Bridge-Group 1 covering-disabled people
  No source of bridge-Group 1-learning
  !
  interface BVI1
  192.168.3.10 IP address 255.255.255.0
  no ip route cache
  !
  The default gateway IP
  IP forward-Protocol ND
  IP http server
  IP http secure server
  IP http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
  radius of the IP source-interface BVI1
  !
  format of server RADIUS attribute 32 include-in-access-req hour
  RADIUS-server host 192.168.2.2 auth-port 1812 acct-port 1813 borders 7 140441081E501F0B7D
  RADIUS vsa server send accounting
  !
  1 channel ip bridge
  !
  !
  !
  Line con 0
  line vty 0 4
  transport of entry all
  !
  end

  Thank you

  I don't have installation autonomous APs before but I think I see the problem. You define a list of authentication , called "eap_methods" but you never call for it in the settings of your SSID. Instead he call you a list named "eap_list" in addition, I think that you might miss one order more. So maybe try this:

   dot11 ssid test authentication open eap eap_methods authentication network-eap eap_methods authentication key-management wpa version 2 guest-mode

  I hope this helps!

  Thank you for evaluating useful messages!

• Dot1x multidomain on Catalyst 2960

  Hello

  I improved my 2960 with the latest basic version of LAN 12.2 (46) which includes the authentication of domain Multi (MDA) and I tried to configure what is described here:

  http://www.Cisco.com/en/us/Tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml

  I have the following exceptions in my configuration:

  (1) SE - cat 2960 with the latest version of IOS 12.2 (46) that supports the MDA;

  (2) using the Win2K IAS as a server radius. and

  (3) third party (Avaya) with active begging dot1x IP phone. I have a PC with ability to dot1x connected to the second port of the IP phone.

  That's what I set up on the phone IP port:

  interface FastEthernet0/9

  switchport access vlan 221

  switchport mode access

  switchport voice vlan 222

  dot1x EAP authenticator

  self control-port dot1x

  multi-domain host-mode dot1x

  protect the dot1x violation-mode

  dot1x reauth-deadline 30

  dot1x re-authentication

  spanning tree portfast

  I also configured the server Radius IAS Win2K to send RADIUS 'cisco-av-pair attribute' tell the authenticator (Cisco Catalyst 2960) that a supplicant (IP phone) is authorized on the voice VLAN as described in config-notes above link.

  When the supplicant IP phone starts to authenticate, he succeeds, but that the port does not allow the field of VOICE, even though the 2960 receives the attribute "cisco-av-pair" of the Radius Server RADIUS. I confirmed the reception of this attribute of debugging on the switch.

  RADIUS: Receipt of id 160.2.100.74:1645 1645/64, Access-Accept, len

  110

  17:02:38: RADIUS: authenticator 7 d AC 50 FE 14 B4 FC DC - 3A A4 E5 3F 1E 76 62

  C3

  17:02:38: RADIUS: EAP-Message [79] 6

  17:02:38: RADIUS: 03 05 00 04

  17:02:38: RADIUS: [25] in class 32

  17:02:38: RADIUS: 44 05 05 A2 00 00 01 37 00 01 A0 02 64 4A C9 01 1 33 79 52

  D8 58 00 00 00 00 00 00 1 b E7 [D7dJ3yRX]

  17:02:38: RADIUS: seller, Cisco [26] 34

  17:02:38: RAY: Cisco-AVpair [1] 28 'device-traffic-class = voice.

  17:02:38: RADIUS: Message-Authenticato [80] 18

  17:02:38: RADIUS: D9 42 78 88 26 5A 65 83 68 B0 E0 C7 AF 5TH 0F 51 [B

  [x & Zeh ^ Q]

  17:02:38: RADIUS (00000009): receipt of id 1645/64

  17:02:38: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes

  Cat2960 #show dot1x int fa0/9 details

  Dot1x FastEthernet0/9 information

  -----------------------------------

  EAP AUTHENTICATOR =

  PortControl = AUTO

  ControlDirection = both

  HostMode = MULTI_DOMAIN

  Violation mode = PROTECT

  A re-authentication = on

  QuietPeriod = 60

  ServerTimeout = 0

  SuppTimeout = 30

  ReAuthPeriod = 30 (configured locally)

  ReAuthMax = 2

  MaxReq = 2

  TxPeriod = 30

  RateLimitPeriod = 0

  Dot1x authenticator customer list

  -------------------------------

  Domain = DATA

  "Supplicant" = 0004.0d9b.46d8

  AUTH State = AUTHENTICATED SM

  AUTH BEND State IDLE = SM

  Port status = AUTHORIZED

  ReAuthPeriod = 30

  ReAuthAction = is re-authenticated

  TimeToNextReauth = 20

  Authentication method = Dot1x

  Authorized by = authentication server

  Policy of VLAN = n/a

  I don't think I need CDP to allow the field of voice, if the Radius server sends the attribute "cisco-av-pair".

  Have I misunderstood the concept?

  Thank you!

  You can share the config switch?

  Missing for example aaa authorization network default radius group?