topic Re: Multiple Multiple RADIUS Access-Request in Network Access Control

Multiple Multiple RADIUS Access-Request

fatalXerror — Tue, 15 Dec 2020 10:24:19 GMT

Hi All,

Anyone here encountered seeing multiple EAP Start in a single user endpoint? We are using certificate-based authentication.

I noticed it in the details section of the RADIUS Live logs that one of my user endpoint have multiple "Received RADIUS Access-Request" before it can get fully authenticated.

Is this normal and why is it like that?

Thanks

Re: Multiple Multiple RADIUS Access-Request

thomas — Tue, 15 Dec 2020 22:07:25 GMT

Please provide the relevant Authentication Details. Hard to comment without actual messages.

Also helps to know the actual endpoint type/OS and supplicant configuration if available.

Re: Multiple Multiple RADIUS Access-Request

fatalXerror — Wed, 16 Dec 2020 13:34:10 GMT

Hi @thomas , I attached here the detailed log "steps" from the RADIUS Live Logs. Unfortunately, I cannot post the whole log due to security reasons but this log was a successful authentication but as you can see in files that I attached, it has multiple RADIUS Access-Request entry just for a single endpoint.

I would like to know if this is normal or is there an EAP or RADIUS timeout issue somewhere?

I am currently, using a certificate-based authentication and checked against our AD. I am not sure if this is normal if certificate-based authentication is being used.

Thank you

Re: Multiple Multiple RADIUS Access-Request

thomas — Thu, 17 Dec 2020 00:14:33 GMT

Thank you, that is a start. You should not be receiving so many requests so quickly that they have not had a chance to finish!

Next step is to look at your network device configuration.

Most likely culprit is 802.1X timeout is extremely low (1 second ?) which is obviously bad.

Our best practice recommendation is described under Authentication Timer Settings:

c9300-Sw(config-if)#dot1x timeout tx-period 7
c9300-Sw(config-if)#dot1x max-reauth-req 3

If that is not it then what endpoint type?

What are the supplicant settings?

Are all of your endpoints of this type doing this or just this one?

Re: Multiple Multiple RADIUS Access-Request

fatalXerror — Thu, 17 Dec 2020 16:42:39 GMT

Hi @thomas , thank you for your feedback. By the way, my NAD is a WLC. What would be the best practice EAP timeout settings for WLC to use?

Re: Multiple Multiple RADIUS Access-Request

Greg Gibbs — Fri, 18 Dec 2020 00:45:44 GMT

See the post for Top Six Important Cisco WLC settings for ISE integration

Re: Multiple Multiple RADIUS Access-Request

Arne Bier — Tue, 05 Jan 2021 22:01:33 GMT

Hi @fatalXerror

That's normal EAP behaviour I thought - it's a very chatty protocol- each time the Radius server sends the suppliant an EAP Challenge, the supplicant responds with an Access-Request packet.

The RFCs are not that easy to digest as Rasika's excellent posting here https://mrncciew.com/2013/03/03/eap-overview/