topic dot1x failing on certain clients after upgrade to 150-2.SE in Network Access Control

dot1x failing on certain clients after upgrade to 150-2.SE

Aaron D — Mon, 11 Mar 2019 02:52:05 GMT

We upgraded our switches recently from the 12 train to 150 train. We are now getting this error message on some clients which is forcing us to bypass authentication. Other ports are working just fine. It seems to happen most when users move there laptops to different locations.

%DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Gi0/5

88 1803.73xx.xxxx DYNAMIC Drop

notice above the MAC address is listed as DROP....

any ideas?

Aaron

dot1x failing on certain clients after upgrade to 150-2.SE

jan.nielsen — Thu, 06 Dec 2012 23:44:54 GMT

Could you show us the interface config for port Gi0/5 ?

dot1x failing on certain clients after upgrade to 150-2.SE

Aaron D — Fri, 07 Dec 2012 17:47:03 GMT

sure

aaa authentication dot1x default group radius

interface gigabitethernet0/30

switchport access vlan 1

switchport mode host

authentication port-control auto

dot1x pae authenticator

spanning-tree portfast

dot1x failing on certain clients after upgrade to 150-2.SE

nspasov — Sat, 08 Dec 2012 04:39:19 GMT

How is the client supposed to be authenticated? (EAP, PEAP, etc)? Also, can you post a screen shot of the detailed screen from the live authentication screen?

dot1x failing on certain clients after upgrade to 150-2.SE

Aaron D — Mon, 10 Dec 2012 15:47:34 GMT

Clients are authenticating using PEAP. I don't know what you mean by a detailed screen from live authentication screen? On the switch, we are getting this error in the logs %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Gi0/5. We are using MS NAP for Radius. The request isn't even arriving to the NAP, as its getting denied from the Switch before it gets to NAP so there is no event results-

Aaron

dot1x failing on certain clients after upgrade to 150-2.SE

jan.nielsen — Mon, 10 Dec 2012 16:38:24 GMT

Unknown mac means the switch is not seeing any mac address on the port, but there is link, so dot1x is just running, but there is no radius request sent to your radius server.

Try to do a show mac-address-table interface x/x, and see if any macs are known on the port. If yes, try to shut/no shut the port, and see if that triggers the dot1x process.

dot1x failing on certain clients after upgrade to 150-2.SE

Peter Koltl — Tue, 11 Dec 2012 21:03:54 GMT

debug authentication all

debug radius

show authentication sessions

Did you ever get this

nspasov — Fri, 26 Jun 2015 15:17:21 GMT

Did you ever get this resolved?