Webauth Failed Over

fouzan.work — Mon, 11 Mar 2019 01:17:39 GMT

I'm attempting to use webauth as a fallback method for 802.1x for wired clients. I've configured the switchport as recommened in the documentation. Here's the snipped for the interface:

interface FastEthernet0/4

switchport access vlan 141

switchport mode access

authentication order dot1x webauth

authentication port-control auto

authentication fallback PROFILE-WEBAUTH

dot1x pae authenticator

dot1x timeout tx-period 5

end

The debugs seem to show that webauth fails over too quickly for it to be effective. Any ideas why this may be the case? Thanks.

Aug 9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

AHQSWTC02#

Aug 9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug 9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

AHQSWTC02#

Webauth Failed Over

Nicolas Darchis — Wed, 10 Aug 2011 06:50:56 GMT

if my memory serves me well, you configure "dot1x timeout tx-period 5". So it means that the switch will send dot1x probes every 5 seconds, 3 times.

So after 15 seconds,it declares there is no dot1x capable laptop and it fails over.

I would suggest to increase the amount of dot1x retries or to increase the tx period.

topic Webauth Failed Over in Network Access Control

Webauth Failed Over

Webauth Failed Over