topic ACS 4.2 Authentication with Certificates in Network Access Control

ACS 4.2 Authentication with Certificates

Sebastian Mueller — Mon, 11 Mar 2019 02:10:55 GMT

Hello Community!

I have a Cisco 4506 With IOS 12.2 54SG1

Iam new on Acs 4.2 and i want to use Certificates to authenticate my windows XP Client and Igels.

On Windows Xp i selected :

IEEE 802.1X Authentication enable EAP (Peap)

But i dont understand the Certification of ACS 4.2.

I generated a Self-Signed Certificate. Is this right ? and under installed Certificates the Certificate Status is okay.

Do i have to create for each windows Machine one user Account under user-Setup to authenticate the Machine?

Where do Windows Xp know whitch Certificate he have to take ?

I configures the Switch on Global Configuration like this:

aaa authentication login default group tacacs+ enable

aaa authentication enable default group tacacs+ enable

aaa authentication dot1x default group radius

aaa authorization exec default group tacacs+

aaa authorization commands 15 default group tacacs+

aaa authorization network default group radius

aaa accounting dot1x default start-stop group radius

aaa accounting commands 15 default start-stop group tacacs+

dot1x system-auth-control

tacacs-server host 192.168.10.10

tacacs-server directed-request

tacacs-server key cisco

radius-server host 192.168.10.10 auth-port 1645 acct-port 1646

radius-server key cisco

radius-server vsa send accounting

radius-server vsa send authentication

i configured the ACCess port like this:

interface GigabitEthernet2/1

description PEAP

switchport access vlan 5

switchport mode access

authentication host-mode multi-domain

authentication order mab dot1x

authentication priority mab dot1x

authentication port-control auto

mab

no snmp trap link-status

dot1x pae authenticator

dot1x timeout quiet-period 50

spanning-tree portfast

spanning-tree bpduguard enable

Iam triying to configure ist szenario till 4 days and it still dont work.. On Windows i Only get the Error" authentication failed"

on the Switch the same : dot1x : Authfailed

What do i wrong ?

Can someone help me.

THX

ACS 4.2 Authentication with Certificates

Jatin Katyal — Fri, 08 Jun 2012 14:41:14 GMT

With Peap, machine and user certificates are not required so you don't need to install it on the machines.

Self-signed Certificate Setup (only if you do not use an external CA)

http://www.cisco.com/en/US/partner/products/sw/secursw/ps2086/products_configuration_example09186a0080545a29.shtml#t14

Self-signed certificates are certificates you create without a root or the intermediate involvement of the CA. They have the same value in both the subject and issuer fields like a Root CA Certificate. Do not use a key size greater than 1024 for compatibility with PEAP and EAP-TLS. If you use a self-signed certificate, the certificate also acts in the capacity of the Root CA Certificate and must be installed in the Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates folder of the client when you use the Microsoft EAP supplicant. It automatically installs in the trusted root certificates store on the server. However, it must still be trusted in the Certificate Trust List in ACS Certificate Setup. See the Root CA Certificates section for more information.

Because self-signed certificates are used as the Root CA Certificate for Server Certificate validation when you use the Microsoft EAP supplicant, and because the validity period cannot be increased from the default of one year

Could you please turn on debugs;

debug dot1x all

debug radius

term mon

Regards,

Jatin

Do rate helpful posts-

Re: ACS 4.2 Authentication with Certificates

Sebastian Mueller — Fri, 08 Jun 2012 15:10:55 GMT

Hello Jatin,

thanks for your replay.... do i have to install the Self made certificate local on the ACS 4.2 Server =?

Do i have to add this zertificate with Group Policy to the "Trusted Root Certification Autorities" ? do Windows Xp user can enable this from the "Trusted Root Certification Autorities ?

Do i have to create user Accounts on the ACS Server ?

The Link that u posted is forbbiden for me.

**********************************************************************************

07:26:39: AUTH-EVENT (Gi2/32): 'restart' timer expired for client 0000.0000.0000

07:26:39: AUTH-EVENT (Gi2/32): Client 0000.0000.0000, Initialising Method dot1x state to 'Not run'

07:26:39: AUTH-EVENT (Gi2/32): Adding method dot1x to runnable list for Auth Mgr context 0xE200002F

07:26:39: AUTH-EVENT (Gi2/32): Sending START to dot1x (handle 0xE200002F)

07:26:39: dot1x_auth Gi2/32: initial state auth_initialize has enter

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_initialize_enter called

07:26:39: dot1x_auth Gi2/32: during state auth_initialize, got event 0(cfg_auto)

07:26:39: @@@ dot1x_auth Gi2/32: auth_initialize -> auth_disconnected

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_disconnected_enter called

07:26:39: dot1x_auth Gi2/32: idle during state auth_disconnected

07:26:39: @@@ dot1x_auth Gi2/32: auth_disconnected -> auth_restart

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_restart_enter called

07:26:39: dot1x-ev(Gi2/32): Sending create new context event to EAP for 0xEB000032 (0000.0000.0000)

07:26:39: dot1x_auth_bend Gi2/32: initial state auth_bend_initialize has enter

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_bend_initialize_enter called

07:26:39: dot1x_auth_bend Gi2/32: initial state auth_bend_initialize has idle

07:26:39: dot1x_auth_bend Gi2/32: during state auth_bend_initialize, got event 16383(idle)

07:26:39: @@@ dot1x_auth_bend Gi2/32: auth_bend_initialize -> auth_bend_idle

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_bend_idle_enter called

07:26:39: dot1x-ev(Gi2/32): Created a client entry (0xEB000032)

07:26:39: dot1x-ev(Gi2/32): Dot1x authentication started for 0xEB000032 (0000.0000.0000)

07:26:39: AUTH-EVENT (Gi2/32): Received handle 0xEB000032 from method

07:26:39: AUTH-EVENT (Gi2/32): Client 0000.0000.0000, Context changing state from 'Authz Failed' to 'Running'

07:26:39: AUTH-EVENT (Gi2/32): Client 0000.0000.0000, Method dot1x changing state from 'Not run' to 'Running'

07:26:39: dot1x-sm(Gi2/32): Posting !EAP_RESTART on Client 0xEB000032

07:26:39: dot1x_auth Gi2/32: during state auth_restart, got event 6(no_eapRestart)

07:26:39: @@@ dot1x_auth Gi2/32: auth_restart -> auth_connecting

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_connecting_enter called

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_restart_connecting_action called

07:26:39: dot1x-sm(Gi2/32): Posting RX_REQ on Client 0xEB000032

07:26:39: dot1x_auth Gi2/32: during state auth_connecting, got event 10(eapReq_no_reAuthMax)

07:26:39: @@@ dot1x_auth Gi2/32: auth_connecting -> auth_authenticating

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_authenticating_enter called

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_connecting_authenticating_action called

07:26:39: dot1x-sm(Gi2/32): Posting AUTH_START for 0xEB000032

07:26:39: dot1x_auth_bend Gi2/32: during state auth_bend_idle, got event 4(eapReq_authStart)

07:26:39: @@@ dot1x_auth_bend Gi2/32: auth_bend_idle -> auth_bend_request

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_bend_request_enter called

07:26:39: dot1x-ev(Gi2/32): Sending EAPOL packet to group PAE address

07:26:39: dot1x-ev(Gi2/32): Role determination not required

07:26:39: dot1x-registry:registry:dot1x_ether_macaddr called

07:26:39: dot1x-ev(Gi2/32): Sending out EAPOL packet

07:26:39: EAPOL pak dump Tx

07:26:39: EAPOL Version: 0x3 type: 0x0 length: 0x0005

07:26:39: EAP code: 0x1 id: 0x1 length: 0x0005 type: 0x1

07:26:39: dot1x-packet(Gi2/32): EAPOL packet sent to client 0xEB000032 (0000.0000.0000)

07:26:39: dot1x-sm(Gi2/32): 0xEB000032:auth_bend_idle_request_action called

07:26:40: AUTH-EVENT: Stopped Auth Manager tick timer

07:27:03: dot1x-ev(Gi2/32): Interface state changed to DOWN

07:27:03: AUTH-EVENT (Gi2/32): Link DOWN

07:27:03: AUTH-EVENT (Gi2/32): Signalling "pre" delete for client 0000.0000.0000

07:27:03: AUTH-EVENT: Enter auth_mgr_idc_client_deleted

07:27:03: AUTH-EVENT: Enter auth_mgr_idc_remove_record

07:27:03: AUTH-SYNC (Gi2/32): Syncing delete for context (0000.0000.0000)

07:27:03: AUTH-EVENT (Gi2/32): Sending DELETE to dot1x (handle 0xE200002F)

07:27:03: dot1x-ev(Gi2/32): Deleting client 0xEB000032 (0000.0000.0000)

07:27:03: AUTH-EVENT (Gi2/32): Signalling "post" delete for client 0000.0000.0000 in domain DATA

07:27:03: AUTH-EVENT (Gi2/32): Authorized client count: 0

07:27:03: AUTH-EVENT (Gi2/32): Setting vlan to 0 on DATA Vlan

07:27:03: AUTH-EVENT (Gi2/32): Unauthorizing interface in shim

07:27:03: AUTH-EVENT (Gi2/32): dot1x_switch_get_default_host_access: Host access set to deny GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): host access set to 2 on GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): dot1x_switch_get_default_host_access: Host access set to deny GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): host access set to 2 on GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): Authorized client count: 0

07:27:03: AUTH-EVENT (Gi2/32): Setting vlan to 0 on DATA Vlan

07:27:03: AUTH-EVENT (Gi2/32): Unauthorizing interface in shim

07:27:03: AUTH-EVENT (Gi2/32): dot1x_switch_get_default_host_access: Host access set to deny GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): host access set to 2 on GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): dot1x_switch_get_default_host_access: Host access set to deny GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): host access set to 2 on GigabitEthernet2/32

07:27:03: AUTH-EVENT (Gi2/32): Queued START

07:27:03: dot1x-ev:dot1x_supp_port_down: No DOT1X subblock found on GigabitEthernet2/32

07:27:03: dot1x-ev:Delete auth client (0xEB000032) message

07:27:03: dot1x-ev:Auth client ctx destroyed

07:27:03: AUTH-EVENT (Gi2/32): Freed Auth Manager context

07:27:03: AUTH-EVENT (Gi2/32): Received internal event START

de-ret-core001#

07:31:41: AUTH-EVENT (Gi2/32): dot1x_pm_mda_port_link_linkcomingup: voice VLAN 4096, data VLAN 198

07:31:41: dot1x-ev(Gi2/32): Interface state changed to UP

07:31:41: AUTH-EVENT (Gi2/32): Enabling dot1x in switch shim

07:31:41: AUTH-EVENT (Gi2/32): dot1x_switch_get_default_host_access: Host access set to deny GigabitEthernet2/32

07:31:41: AUTH-EVENT (Gi2/32): host access set to 2 on GigabitEthernet2/32

07:31:41: AUTH-EVENT (Gi2/32): dot1x_switch_get_default_host_access: Host access set to deny GigabitEthernet2/32

07:31:41: AUTH-EVENT (Gi2/32): host access set to 2 on GigabitEthernet2/32

07:31:41: AUTH-EVENT (Gi2/32): Link UP

07:31:41: AUTH-EVENT (Gi2/32): Assigned AAA ID 0x0000004A

07:31:41: AUTH-EVENT (Gi2/32): Retrieved Accounting Session ID 0x0000012C

07:31:41: AUTH-EVENT (Gi2/32): Allocated new Auth Manager context (handle 0xFE000030)

07:31:41: AUTH-EVENT (Gi2/32): Client 0000.0000.0000, Initialising Method dot1x state to 'Not run'

07:31:41: AUTH-EVENT (Gi2/32): Adding method dot1x to runnable list for Auth Mgr context 0xFE000030

07:31:41: AUTH-EVENT: auth_mgr_idc_add_record: Recv audit_sid=C0A8C6C90000002F019D87A3

07:31:41: AUTH-EVENT (Gi2/32): Sending START to dot1x (handle 0xFE000030)

07:31:41: dot1x_auth Gi2/32: initial state auth_initialize has enter

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_initialize_enter called

07:31:41: dot1x_auth Gi2/32: during state auth_initialize, got event 0(cfg_auto)

07:31:41: @@@ dot1x_auth Gi2/32: auth_initialize -> auth_disconnected

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_disconnected_enter called

07:31:41: dot1x_auth Gi2/32: idle during state auth_disconnected

07:31:41: @@@ dot1x_auth Gi2/32: auth_disconnected -> auth_restart

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_restart_enter called

07:31:41: dot1x-ev(Gi2/32): Sending create new context event to EAP for 0x2F000033 (0000.0000.0000)

07:31:41: dot1x_auth_bend Gi2/32: initial state auth_bend_initialize has enter

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_initialize_enter called

07:31:41: dot1x_auth_bend Gi2/32: initial state auth_bend_initialize has idle

07:31:41: dot1x_auth_bend Gi2/32: during state auth_bend_initialize, got event 16383(idle)

07:31:41: @@@ dot1x_auth_bend Gi2/32: auth_bend_initialize -> auth_bend_idle

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_idle_enter called

07:31:41: dot1x-ev(Gi2/32): Created a client entry (0x2F000033)

07:31:41: dot1x-ev(Gi2/32): Dot1x authentication started for 0x2F000033 (0000.0000.0000)

07:31:41: AUTH-EVENT (Gi2/32): Received handle 0x2F000033 from method

07:31:41: AUTH-EVENT (Gi2/32): Client 0000.0000.0000, Context changing state from 'Idle' to 'Running'

07:31:41: AUTH-EVENT (Gi2/32): Client 0000.0000.0000, Method dot1x changing state from 'Not run' to 'Running'

07:31:41: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet2/32

07:31:41: dot1x-sm(Gi2/32): Posting !EAP_RESTART on Client 0x2F000033

07:31:41: dot1x_auth Gi2/32: during state auth_restart, got event 6(no_eapRestart)

07:31:41: @@@ dot1x_auth Gi2/32: auth_restart -> auth_connecting

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_connecting_enter called

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_restart_connecting_action called

07:31:41: dot1x-sm(Gi2/32): Posting RX_REQ on Client 0x2F000033

07:31:41: dot1x_auth Gi2/32: during state auth_connecting, got event 10(eapReq_no_reAuthMax)

07:31:41: @@@ dot1x_auth Gi2/32: auth_connecting -> auth_authenticating

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_authenticating_enter called

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_connecting_authenticating_action called

07:31:41: dot1x-sm(Gi2/32): Posting AUTH_START for 0x2F000033

07:31:41: dot1x_auth_bend Gi2/32: during state auth_bend_idle, got event 4(eapReq_authStart)

07:31:41: @@@ dot1x_auth_bend Gi2/32: auth_bend_idle -> auth_bend_request

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_request_enter called

07:31:41: dot1x-ev(Gi2/32): Sending EAPOL packet to group PAE address

07:31:41: dot1x-ev(Gi2/32): Role determination not required

07:31:41: dot1x-registry:registry:dot1x_ether_macaddr called

07:31:41: dot1x-ev(Gi2/32): Sending out EAPOL packet

07:31:41: EAPOL pak dump Tx

07:31:41: EAPOL Version: 0x3 type: 0x0 length: 0x0005

07:31:41: EAP code: 0x1 id: 0x1 length: 0x0005 type: 0x1

07:31:41: dot1x-packet(Gi2/32): EAPOL packet sent to client 0x2F000033 (0000.0000.0000)

07:31:41: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_idle_request_action called

07:31:52: dot1x-ev(Gi2/32): Role determination not required

07:31:52: dot1x-packet(Gi2/32): queuing an EAPOL pkt on Auth Q

07:31:52: dot1x-ev:Enqueued the eapol packet to the global authenticator queue

07:31:52: EAPOL pak dump rx

07:31:52: EAPOL Version: 0x1 type: 0x1 length: 0x0000

07:31:52: dot1x-ev:

dot1x_auth_queue_event: Int Gi2/32 CODE= 0,TYPE= 0,LEN= 0

07:31:52: dot1x-packet(Gi2/32): Received an EAPOL frame

07:31:52: dot1x-ev(Gi2/32): Received pkt saddr =000b.5d4f.2ecf , daddr = 0180.c200.0003,

pae-ether-type = 888e.0101.0000

07:31:52: dot1x-ev(Gi2/32): Couldn't find the supplicant in the list

07:31:52: dot1x-ev(Gi2/32): New client detected, notifying AuthMgr

07:31:52: dot1x-ev(Gi2/32): Sending event (0) to Auth Mgr for 000b.5d4f.2ecf

07:31:52: dot1x-packet(Gi2/32): Received an EAPOL-Start packet

07:31:52: EAPOL pak dump rx

07:31:52: EAPOL Version: 0x1 type: 0x1 length: 0x0000

07:31:52: dot1x-sm(Gi2/32): Posting EAPOL_START on Client 0x2F000033

07:31:52: dot1x_auth Gi2/32: during state auth_authenticating, got event 4(eapolStart)

07:31:52: @@@ dot1x_auth Gi2/32: auth_authenticating -> auth_aborting

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_authenticating_exit called

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_aborting_enter called

07:31:52: AUTH-EVENT (Gi2/32): Received 'NEW_MAC', current method is dot1x (handle 0xFE000030)

07:31:52: AUTH-EVENT (Gi2/32): New Method MAC: 000b.5d4f.2ecf 1B60E2D4

07:31:52: AUTH-EVENT: auth_mgr_idc_insert_key_in_record: update mac 000b.5d4f.2ecf

07:31:52: AUTH-EVENT (Gi2/32): Sending NEW_MAC to dot1x (handle 0xFE000030)

07:31:52: dot1x-ev(Gi2/32): 802.1x method gets the go ahead from Auth Mgr for 0x2F000033 (000b.5d4f.2ecf)

07:31:52: %AUTHMGR-5-START: Starting 'dot1x' for client (000b.5d4f.2ecf) on Interface Gi2/32 AuditSessionID C0A8C6C90000002F019D87A3

07:31:52: dot1x-sm(Gi2/32): Posting AUTH_ABORT for 0x2F000033

07:31:52: dot1x_auth_bend Gi2/32: during state auth_bend_request, got event 1(authAbort)

07:31:52: @@@ dot1x_auth_bend Gi2/32: auth_bend_request -> auth_bend_initialize

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_initialize_enter called

07:31:52: dot1x_auth_bend Gi2/32: idle during state auth_bend_initialize

07:31:52: @@@ dot1x_auth_bend Gi2/32: auth_bend_initialize -> auth_bend_idle

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_idle_enter called

07:31:52: dot1x-sm(Gi2/32): Posting !AUTH_ABORT on Client 0x2F000033

07:31:52: dot1x_auth Gi2/32: during state auth_aborting, got event 20(no_eapolLogoff_no_authAbort)

07:31:52: @@@ dot1x_auth Gi2/32: auth_aborting -> auth_restart

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_aborting_exit called

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_restart_enter called

07:31:52: dot1x-ev(Gi2/32): Resetting the client 0x2F000033 (000b.5d4f.2ecf)

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_aborting_restart_action called

07:31:52: dot1x-sm(Gi2/32): Posting !EAP_RESTART on Client 0x2F000033

07:31:52: dot1x_auth Gi2/32: during state auth_restart, got event 6(no_eapRestart)

07:31:52: @@@ dot1x_auth Gi2/32: auth_restart -> auth_connecting

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_connecting_enter called

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_restart_connecting_action called

07:31:52: dot1x-sm(Gi2/32): Posting RX_REQ on Client 0x2F000033

07:31:52: dot1x_auth Gi2/32: during state auth_connecting, got event 10(eapReq_no_reAuthMax)

07:31:52: @@@ dot1x_auth Gi2/32: auth_connecting -> auth_authenticating

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_authenticating_enter called

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_connecting_authenticating_action called

07:31:52: dot1x-sm(Gi2/32): Posting AUTH_START for 0x2F000033

07:31:52: dot1x_auth_bend Gi2/32: during state auth_bend_idle, got event 4(eapReq_authStart)

07:31:52: @@@ dot1x_auth_bend Gi2/32: auth_bend_idle -> auth_bend_request

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_request_enter called

07:31:52: dot1x-ev(Gi2/32): Sending EAPOL packet to group PAE address

07:31:52: dot1x-ev(Gi2/32): Role determination not required

07:31:52: dot1x-registry:registry:dot1x_ether_macaddr called

07:31:52: dot1x-ev(Gi2/32): Sending out EAPOL packet

07:31:52: EAPOL pak dump Tx

07:31:52: EAPOL Version: 0x3 type: 0x0 length: 0x0005

07:31:52: EAP code: 0x1 id: 0x1 length: 0x0005 type: 0x1

07:31:52: dot1x-packet(Gi2/32): EAPOL packet sent to client 0x2F000033 (000b.5d4f.2ecf)

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_idle_request_action called

07:31:52: dot1x-ev(Gi2/32): Role determination not required

07:31:52: dot1x-packet(Gi2/32): Queuing an EAPOL pkt on Authenticator Q

07:31:52: dot1x-ev:Enqueued the eapol packet to the global authenticator queue

07:31:52: EAPOL pak dump rx

07:31:52: EAPOL Version: 0x1 type: 0x0 length: 0x000F

07:31:52: dot1x-ev:

dot1x_auth_queue_event: Int Gi2/32 CODE= 2,TYPE= 1,LEN= 15

07:31:52: dot1x-packet(Gi2/32): Received an EAPOL frame

07:31:52: dot1x-ev(Gi2/32): Received pkt saddr =000b.5d4f.2ecf , daddr = 0180.c200.0003,

pae-ether-type = 888e.0100.000f

07:31:52: dot1x-packet(Gi2/32): Received an EAP packet

07:31:52: EAPOL pak dump rx

07:31:52: EAPOL Version: 0x1 type: 0x0 length: 0x000F

07:31:52: dot1x-packet(Gi2/32): Received an EAP packet from 000b.5d4f.2ecf

07:31:52: dot1x-sm(Gi2/32): Posting EAPOL_EAP for 0x2F000033

07:31:52: dot1x_auth_bend Gi2/32: during state auth_bend_request, got event 6(eapolEap)

07:31:52: @@@ dot1x_auth_bend Gi2/32: auth_bend_request -> auth_bend_response

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_response_enter called

07:31:52: dot1x-ev(Gi2/32): dot1x_sendRespToServer: Response sent to the server from 0x2F000033 (000b.5d4f.2ecf)

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_request_response_action called

07:31:52: RADIUS/ENCODE(0000004A):Orig. component type = DOT1X

07:31:52: RADIUS(0000004A): Config NAS IP: 0.0.0.0

07:31:52: RADIUS/ENCODE(0000004A): acct_session_id: 300

07:31:52: RADIUS(0000004A): sending

07:31:52: RADIUS/ENCODE: Best Local IP-Address 192.168.10.10 for Radius-Server 192.168.10.10

07:31:52: RADIUS(0000004A): Send Access-Request to 192.168.10.10:1645 id 1645/116, len 207

07:31:52: RADIUS: authenticator E9 13 EC CA 3B E8 3A 59 - 23 AE CE F8 7E 7C 0C B0

07:31:52: RADIUS: User-Name [1] 12 "Test\snoop"

07:31:52: RADIUS: Service-Type [6] 6 Framed [2]

07:31:52: RADIUS: Framed-MTU [12] 6 1500

07:31:52: RADIUS: Called-Station-Id [30] 19 "00-15-62-CE-3C-4F"

07:31:52: RADIUS: Calling-Station-Id [31] 19 "00-0B-5D-4F-2E-CF"

07:31:52: RADIUS: EAP-Message [79] 17

07:31:52: RADIUS: 02 01 00 0F 01 56 4C 41 42 5C 73 6E 6F 6F 70 [ Test\snoop]

07:31:52: RADIUS: Message-Authenticato[80] 18

07:31:52: RADIUS: A1 7B C4 BD 44 08 5D 69 EA 4E 4D 21 6B D1 9A 1C [ {D]iNM!k]

07:31:52: RADIUS: EAP-Key-Name [102] 2 *

07:31:52: RADIUS: Vendor, Cisco [26] 49

07:31:52: RADIUS: Cisco AVpair [1] 43 "audit-session-id=C0A8C6C90000002F019D87A3"

07:31:52: RADIUS: NAS-Port-Type [61] 6 Ethernet [15]

07:31:52: RADIUS: NAS-Port [5] 6 50232

07:31:52: RADIUS: NAS-Port-Id [87] 21 "GigabitEthernet2/32"

07:31:52: RADIUS: NAS-IP-Address [4] 6 192.168.10.10

07:31:52: RADIUS: Received from id 1645/116 192.168.10.10:1645, Access-Challenge, len 72

07:31:52: RADIUS: authenticator FC B5 8D 47 17 BE 3F 1D - 06 62 E9 8F EF 75 77 38

07:31:52: RADIUS: EAP-Message [79] 8

07:31:52: RADIUS: 01 1B 00 06 19 21 [ !]

07:31:52: RADIUS: State [24] 26

07:31:52: RADIUS: 45 41 50 3D 30 2E 32 30 34 2E 38 37 2E 31 3B 53 [EAP=0.204.87.1;S]

07:31:52: RADIUS: 56 43 3D 30 2E 32 35 3B [ VC=0.25;]

07:31:52: RADIUS: Message-Authenticato[80] 18

07:31:52: RADIUS: 9E D2 63 9A 57 A2 73 65 A8 29 AC 5A C8 6F 78 2F [ cWse)Zox/]

07:31:52: RADIUS(0000004A): Received from id 1645/116

07:31:52: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes

07:31:52: dot1x-sm(Gi2/32): Posting EAP_REQ for 0x2F000033

07:31:52: dot1x_auth_bend Gi2/32: during state auth_bend_response, got event 7(eapReq)

07:31:52: @@@ dot1x_auth_bend Gi2/32: auth_bend_response -> auth_bend_request

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_response_exit called

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_request_enter called

07:31:52: dot1x-ev(Gi2/32): Sending EAPOL packet to group PAE address

07:31:52: dot1x-ev(Gi2/32): Role determination not required

07:31:52: dot1x-registry:registry:dot1x_ether_macaddr called

07:31:52: dot1x-ev(Gi2/32): Sending out EAPOL packet

07:31:52: EAPOL pak dump Tx

07:31:52: EAPOL Version: 0x3 type: 0x0 length: 0x0006

07:31:52: EAP code: 0x1 id: 0x1B length: 0x0006 type: 0x19

07:31:52: dot1x-packet(Gi2/32): EAPOL packet sent to client 0x2F000033 (000b.5d4f.2ecf)

07:31:52: dot1x-sm(Gi2/32): 0x2F000033:auth_bend_response_request_action called

07:31:52: dot1x-ev(Gi2/32): Role determination not required

07:31:52: dot1x-packet(Gi2/32): Queuing an EAPOL pkt on Authenticator Q

07:31:52: dot1x-ev:Enqueued the eapol packet to the global authenticator queue

07:31:52: EAPOL pak dump rx

07:31:52: EAPOL Version: 0x1 type: 0x0 length: 0x0057

07:31:52: dot1x-ev:

dot1x_auth_queue_event: Int Gi2/32 CODE= 2,TYPE= 25,LEN= 87

07:31:52: dot1x-packet(Gi2/32): Received an EAPOL frame

07:31:52: dot1x-ev(Gi2/32): Received pkt saddr =000b.5d4f.2ecf , daddr = 0180.c200.0003,

pae-ether-type = 888e.0100.0057