ACS 5.1 EAP-TLS

willgraham — Mon, 11 Mar 2019 00:51:06 GMT

EAP-TLS is failing.

See log below.

Re: ACS 5.1 EAP-TLS

willgraham — Wed, 23 Feb 2011 04:09:22 GMT

Below are the steps and attached is the doc containing all of the info. STUCK!

Steps

11001 Received RADIUS Access-Request

11017 RADIUS created a new session

Evaluating Service Selection Policy

15004 Matched rule

15012 Selected Access Service - WLC

11507 Extracted EAP-Response/Identity

12500 Prepared EAP-Request proposing EAP-TLS with challenge

11006 Returned RADIUS Access-Challenge

11001 Received RADIUS Access-Request

11018 RADIUS is re-using an existing session

12502 Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated

12800 Extracted first TLS record; TLS handshake started.

12805 Extracted TLS ClientHello message.

12806 Prepared TLS ServerHello message.

12807 Prepared TLS Certificate message.

12809 Prepared TLS CertificateRequest message.

12505 Prepared EAP-Request with another EAP-TLS challenge

11006 Returned RADIUS Access-Challenge

11001 Received RADIUS Access-Request

11018 RADIUS is re-using an existing session

12504 Extracted EAP-Response containing EAP-TLS challenge-response

11514 Unexpectedly received empty TLS message; treating as a rejection by the client

12512 Treat the unexpected TLS acknowledge message as a rejection from the client

11504 Prepared EAP-Failure

11003 Returned RADIUS Access-Reject

bradleyordner — Wed, 23 Feb 2011 05:53:20 GMT

I also have this issue. I have done Debugs on Wireless Controllers for dot1x and not seeing anything except a deny after three attempts.

Is the Local ACS Certificate supposed to be the Certificate created by the CA or is it dynamically generated?

Thanks