topic Re: 802.1x re authentication problem in Network Access Control

802.1x re authentication problem

ngtransge — Mon, 11 Mar 2019 02:33:46 GMT

Hello,

I have problem with 802.1x authentication on switch ports which are configured in "Multi Session" mode. In Single host mode and Multiple Host mode it works just fine.

The problem is following, when PC is first connected on switch port it authenticates successfully. After about 1-2 minutes windows 7 NIC notifies that its going to authenticate again, and after couple of minutes NIC status is changed to “Authentication Failed”. On ACS I only see first authentication request which is successful. If I unplug PC from port and plug it again. It authenticates successfully and then starts again with same problems.

I was doing packet sniffing on PC, and it seems that after pc first authentication completes successful, switch starting to sent EAP Identity/Request packets to host, for that host is sending EAP Identity/Response to switch, but switch don’t continues authentication process and starts again with new EAP Identity/Request packets.

On Windows 7 host Event viewer I see following log messages:

Reason: 0x70004

Reason Text: The network stopped answering authentication requests

Error Code: 0x0

The ACS version is 5.3. Authentication method is PEAP. Supplicant OS is Windows 7 I also trued with Windows XP, with same result. The Authentication switch is ESW 520 with latest firmware. I also trued with 2960/3560 switches and it works perfectly. On ESW 520 switch if port mode is other than “Multi Session" if works without any issue.

Do you have any Idea how can i fix this ?

802.1x re authentication problem

Mohammad Abualroos — Wed, 19 Sep 2012 01:06:35 GMT

If config is the same as 2960 it sounds more like a bug...

you may need to reach TAC for the same..

802.1x re authentication problem

Anim Saxena — Wed, 19 Sep 2012 02:43:32 GMT

Hi ngtransge,

Have you tried patch the hotfix below for these problematic Windows 7 clients ? Kindly have a look at the below mentioned link that might give you more insight about the same.

http://support.microsoft.com/kb/980295/en-us

Regards

Anim Saxena

*Rate helpful posts*

Re: 802.1x re authentication problem

ngtransge — Wed, 19 Sep 2012 11:02:58 GMT

Hello Anim,

I have tried with this hotfix, but it doesn’t help.

One more detail about case. When host first authenticates, and then supplicant going to authenticate failed state, switch port still stays in authenticate state.

I am attaching sniffed EAP packets.

Re: 802.1x re authentication problem

Anim Saxena — Wed, 19 Sep 2012 11:35:12 GMT

Hi ngtransge,

if you use " user or computer" as the authentication mode, the user wont be authenticated when he logs on as the machine has been authenticated.To meet our business requirements,You may need to reauthenticate each user when they log in the machine ( use "user authentication") ,however you cant make this happen on our windows 7 clients at the moment. It can only authenticates once unless i manually disconnect the network and reconnect it, otherwise the switch times out the dot1x due to no responses from the PC.

You would first like to clarify the authentication mode part, so if we want to make users to re authenticate by using the credentials of current logged user, we’d need to set to use “User re-authentication” . This compact has been explained in the session “Wired authentication modes” in the link below:

Planning for Recommended Wired Security Configurations

http://technet.microsoft.com/en-us/library/dd378927(WS.10).aspx

And could you describe the entries you set in wired network policy ? what is the number you set for “Max Authentication failures” ? and which authentication protocol are using now?

Maybe we should recheck the current settings with following our sample guide below and see if any improvement:

Configure Wired Computers Running Windows Vista for 802.1X Authenticated Access

http://technet.microsoft.com/en-us/library/dd348442(WS.10).aspx

For more information please refer to the link below:

802.1X Authenticated Wired Access

http://technet.microsoft.com/en-us/library/cc753354(WS.10).aspx

Thanks and regards,

Anim Saxena

*Rate helpful post*

Re: 802.1x re authentication problem

ngtransge — Wed, 19 Sep 2012 13:53:25 GMT

Hi Anim,

I am using very default "wired network policy". Authentication method is PEAP, and authentication mode is "User or computer authentication".\

Where can I seen "Max Authentication failures" ?

Re: 802.1x re authentication problem

Anim Saxena — Wed, 19 Sep 2012 16:58:15 GMT

Hi ngtransge,

Thanks for rating the replies. You need to select "User Authentication". I am pasting some screenshots which might help you out.

STEP 2:

STEP 3

STEP 4

Select User Authentication in the Scenario might help out.

Thanks and Regards

Anim Saxena

*Rate helpful posts*

Re: 802.1x re authentication problem

ngtransge — Thu, 20 Sep 2012 06:05:14 GMT

Hello Anim,

As I know only user authentication has problem with Group Updates, because it doesn't authenticate PC when user is not logged in. Also I have tried and it does not helped.

Re: 802.1x re authentication problem

Anim Saxena — Thu, 20 Sep 2012 10:02:03 GMT

Hi Ngtransge,

i am posting a link which might be helpful to you in solving your problem.

https://supportforums.cisco.com/docs/DOC-23117

Thanks and regards

Anim Saxena

*Rate Helpful Posts*

Re: 802.1x re authentication problem

ngtransge — Sun, 23 Sep 2012 09:08:11 GMT

Hello Anim,

Same problem with NAM.