topic Authentication error eap-tls ACS 5.2 with MS CA in Network Access Control

Authentication error eap-tls ACS 5.2 with MS CA

Eugene Petersen — Mon, 11 Mar 2019 00:49:44 GMT

Unable to authenticate using EAP-TLS Cisco ACS 5.2 , MS CA and Cisco 1250 AP

12752 Failed to negotiate EAP for inner method because EAP-TLS not allowed under PEAP configuration in Access Service.

Generated on:February 15, 2011 5:16:31 PM SAST
Description
The client's supplicant sent an EAP-Response/NAK packet rejecting the EAP-based protocol that was previously proposed for the inner method, and requested to use EAP-TLS instead. However, ACS does not allow EAP-TLS under PEAP configuration in the Allowed Protocols section of the corresponding Access Service.

Resolution Steps
Ensure that the EAP-TLS protocol is allowed by ACS under PEAP configuration in the Allowed Protocols section of the relevant Access Service.

I am a newbie to ACS 5.2. Please need some help..MS AD authentication with ACS works fine. Certificate authentication not successful. Utilised the IBNS guide on Cisco website as well as configuration guide.

Has anybody encountered this problem? Please help

Eugene

Re: Authentication error eap-tls ACS 5.2 with MS CA

ian_banderaz — Tue, 15 Feb 2011 17:49:34 GMT

go to access service -> identity and select allowed protocol tabs.

there , expand PEAP and check the EAP-TLS.

Re: Authentication error eap-tls ACS 5.2 with MS CA

Eugene Petersen — Wed, 16 Feb 2011 09:38:09 GMT

These protocols are selected.

Under the Allowed Protocols TAB

EAP-TLS is a selected protocol on its own

Under PEAP

EAP-MS-CHAPv2 and EAP-GTC is selected for inner methods.

Prefered EAP Method is also EAP-TLS..

Re: Authentication error eap-tls ACS 5.2 with MS CA

c.fonseca — Thu, 08 Sep 2011 19:51:05 GMT

I'm with the same error. When I try to connect to the wi-fi with the certificate acs is the same error.

Does anyone have any idea to solve the problem?

Authentication error eap-tls ACS 5.2 with MS CA

tsutton31 — Thu, 22 Mar 2012 18:42:05 GMT

I'm setting this up in a lab environment and have the same issue as you have documented in this discussion:

12752 Failed to negotiate EAP for inner method because EAP-TLS not allowed under PEAP configuration in Access Service

I don't see a fixed posted here. If you have the fix please post, I would be interested.

Regards,

Tracy

Authentication error eap-tls ACS 5.2 with MS CA

jrabinow — Thu, 22 Mar 2012 18:57:47 GMT

PEAP with inner TLS method is only supported in ACS 5.3. You will need to upgrade to ACS 5.3

Authentication error eap-tls ACS 5.2 with MS CA

antero — Fri, 23 Mar 2012 17:46:44 GMT

HI,

i Have ACS 5.2.0.26.8, configured for 802.1x authentication with Certificates, and no problem.

witch version do you have?

have you configured the Certificate Authentication Profile and activate ir in idetity store sequence?

cheers

Antero

Authentication error eap-tls ACS 5.2 with MS CA

tsutton31 — Fri, 23 Mar 2012 18:55:11 GMT

Antero, thanks for the update. My ACS level is 5.2.0.26.. Could you provide a little more detail on where you tie in your Certificate Authentication Profile. I now have this created but not reallly sure what to apply this, on an Access Policy?

Regards,

Tracy

Authentication error eap-tls ACS 5.2 with MS CA

antero — Mon, 26 Mar 2012 09:31:32 GMT

Hi tracy

after installuing the certificate in you rACS and do the specific config to trust for clients with EAP-TLS

create an identity store sequence aas above.

create a an access Service as this one useing the new sequence

wirh this allowed protocols

under the group you created in access polocie Authorization

here is the match to do with the certificate profile, if the certificate with this sublect was issue from the CA you previuously added to ACS then you are allowed to be authenticated.

hope this help.

Antero