Cisco ACS 5.3 and ProCurve 2510 with 802.1X and Mac-auth

CSCO10235167 — Mon, 11 Mar 2019 02:00:46 GMT

Hey!

I am having difficulties implementing Mac-auth on selected ports between an HP ProCurve 2510 and Cisco ACS 5.3.The 802.1x works just fine, but for selected ports I need to implement port-access with MAC-based authentication instead of regular 802.1X (yeah, I know, but this line of ProCurve switches only support one auth-mechanism per port!).

The switch successfully forwards interesting MAC-auth requests for authentication to the ACS with CHAP/MD5, but the ACS reports this:

Logged At:	April 16,2012 1:20:48.080 PM
RADIUS Status:	Authentication failed : 22056 Subject not found in the applicable identity store(s).
NAS Failure:
Username:	002655886b3d
MAC/IP Address:	00-26-55-88-6b-3d
Network Device:	HP2510 : 192.168.0.51 : 5
Access Service:	MAB Access Service
Identity Store:
Authorization Profiles:
CTS Security Group:
Authentication Method:	CHAP/MD5

Evaluating Service Selection Policy

15004 Matched rule

15012 Selected Access Service - MAB Access Service

Evaluating Identity Policy

15006 Matched Default Rule

15013 Selected Identity Store -

22043 Current Identity Store does not support the authentication method; Skipping it.

22056 Subject not found in the applicable identity store(s).

22058 The advanced option that is configured for an unknown user is used.

22061 The 'Reject' advanced option is configured in case of a failed authentication request.

11003 Returned RADIUS Access-Reject

The ACS is configured to use the Internal Hosts database, where the client computer is configured like this;

MAC-address: 00-26-55-88-6B-3D

Anyone encountered this, or has any suggestions?

Cisco ACS 5.3 and ProCurve 2510 with 802.1X and Mac-auth

jrabinow — Mon, 16 Apr 2012 19:29:33 GMT

I think it is as it says. CHAP/MD5 is not supported on the identity store. Can you try with PAP?

Hello CSCO10235167, i have

Sebastian Mueller — Thu, 08 Jan 2015 09:15:27 GMT

Hello CSCO10235167,

i have the same exact problem, how do you solve the problem ?

Hi,with MAB you need "host

hdussa — Thu, 08 Jan 2015 10:13:13 GMT

Hi,

with MAB you need "host-lookup". Nothing else.

Hey, host-lookup ist already

Sebastian Mueller — Thu, 08 Jan 2015 12:27:37 GMT

Hey,

host-lookup ist already activated.. the Problem is the Switch.. the switch is sending CHA/MD5 pakets to the acs...

i installed a newer firmware on my hp switches and now it works

topic Cisco ACS 5.3 and ProCurve 2510 with 802.1X and Mac-auth in Network Access Control

Cisco ACS 5.3 and ProCurve 2510 with 802.1X and Mac-auth

Cisco ACS 5.3 and ProCurve 2510 with 802.1X and Mac-auth

Hello CSCO10235167, i have

Hi,with MAB you need "host

Hey, host-lookup ist already