topic Re: Can not authenticate Cisco Access Point with EAP-FAST in Network Access Control

Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Fri, 03 Jun 2022 05:55:09 GMT

Hi,

I try to authenticate Access Point using EAP-FAST. I did everything that is described here:
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-fixed/107946-LAP-802-1x.html

Although username and password are the same in Cisco ISE local database and AP I have an error:

5400 Authentication failed
22063 Wrong password

Could you please help me with that issue?

Re: Can not authenticate Cisco Access Point with EAP-FAST

Marius Gunnerud — Fri, 03 Jun 2022 06:55:25 GMT

When troubleshooting this type of issue you need to provide all configuration that you have done for this particular solution on ISE, WLC and switch.

By the sounds of it you are trying to authenticate the AP to the network and not users connecting to the AP, is that correct? If not then please provide a much better description of your problem and what you want the expected result to be.

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Fri, 03 Jun 2022 07:00:10 GMT

Hi Marius,

I try to authenticate the cisco access point as an 802.1x supplicant. All my configurations are mentioned in the link above.

Although the login/password are the same I can not authenticate the access point because of a password mismatch.

Re: Can not authenticate Cisco Access Point with EAP-FAST

Marius Gunnerud — Fri, 03 Jun 2022 07:35:56 GMT

Was the AP already joined to the WLC before you began the process? Also, are you 100% sure there is no space at the beginning or the end of the password on either the ISE or the AP?

Would still be good to see the configuration you have implemented.

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Fri, 03 Jun 2022 08:08:50 GMT

Yes, AP already joined the WLC and it works properly. I ensure that passwords match because I just copied and pasted them.

You can view my configuration using these attachments. I think there is a password problem in WLC because I tried not to use the Cisco ISE local database and used AD. I got the same wrong password error.

Re: Can not authenticate Cisco Access Point with EAP-FAST

hslai — Sun, 05 Jun 2022 22:07:22 GMT

I hope you have confirmed the switch able to authenticate another client using the same credentials against ISE. If it allows you to select another auth method, then it would worth to try that, as well.

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Mon, 06 Jun 2022 07:15:19 GMT

I used the same credentials with the same switch for the windows user and it works properly.

I also tried to authenticate AP using PEAP but there is another error:

Event	5400 Authentication failed
Failure Reason	12851 Received unexpected EAP NAK message. Client rejected the conversation
Resolution	Verify that the client's supplicant does not have any known compatibility issues and that it is properly configured.
Root cause	ISE expects for regular conversation continuation but client sent outer EAP method NAK message. It means that client rejected conversation for some reason that is unknown to ISE. Known issue: CSSC 5.1.1.10 sends outer EAP method NAK during EAP-FAST/EAP-GTC conversation to reject the conversation according to user's input.

Re: Can not authenticate Cisco Access Point with EAP-FAST

Arne Bier — Mon, 06 Jun 2022 07:16:17 GMT

I had this issue just the other day with an old ISE 2.2 system (unpatched) - we found a bug ID and it was fixed in the ISE 2.2 patch 13. The problem started after the AireOS controller we upgraded to 8.10

I have since rebuilt that ISE node as 3.0 and the EAP-FAST is still working happily.

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Mon, 06 Jun 2022 07:20:17 GMT

Could you please share the bug details? How can we work around this issue?

Re: Can not authenticate Cisco Access Point with EAP-FAST

Arne Bier — Mon, 06 Jun 2022 09:50:18 GMT

The bug that matched this problem in ISE 2.2 (unpatched) was CSCvm03681- EAP-FAST doesn't support correct key generation in TLS 1.2

If you can't patch ISE then alternative could be to use EAP-PEAP for the AP's authentication. But I tried that before I had a chance to patch ISE, and the AireOS didn't like the old ISE either. Drastic workaround would be to remove EAP-FAST authentication on the APs when you get a chance to do so.

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Tue, 07 Jun 2022 10:32:19 GMT

When I use EAP-FAST it says:
22063 Wrong password

When I use PEAP it says:
12851 Received unexpected EAP NAK message. Client rejected the conversation.

Recently I installed the latest patch but the problem still exists. Do you know any other resolution?

Re: Can not authenticate Cisco Access Point with EAP-FAST

Arne Bier — Tue, 07 Jun 2022 11:39:33 GMT

What version of ISE are you using and what patch level?

What device is performing the EAP-FAST (I.e. what AP model and WLC software version if applicable)?

If updating the components doesn’t help then perhaps it’s time to get TAC involved.

Also, don’t forget that since the AP is attached to a switch, it’s the switch that is acting as the Authenticator. That means you must ensure that the RADIUS shared secret of the switch must match that configured in ISE. Does the switch perform any other EAP authentication successfully?

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Tue, 07 Jun 2022 12:57:33 GMT

Cisco ISE 3.1 and patch 3 (the latest one)
Cisco Virtual Wireless Controller Software Version 8.8.111.0
APs are in flexconnect mode IOS version 8.8.111.0

Yes, the switch performs other EAP authentication successfully. I have that kind of issue only with APs

Re: Can not authenticate Cisco Access Point with EAP-FAST

andrewswanson — Tue, 07 Jun 2022 13:35:14 GMT

If these are Flexconnect mode APs, what is the connecting switch interface switchport config for them? Is it a trunk or is it in line with the Cisco doc below?

hth
Andy

https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200492-Securing-a-flexconnect-AP-switchport-wit.html

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Wed, 08 Jun 2022 06:43:42 GMT

This is my switch port configuration:

interface GigabitEthernet 1/0/1
switchport access vlan 100
switchport mode access
authentication event server dead action authorize vlan 100
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 3
spanning-tree portfast

I also tried the configuration below that was mentioned in the guide but the same problem still exists:

interface GigabitEthernet1/0/1
switchport trunk allowed vlan all
switchport trunk native vlan 100
switchport mode trunk
authentication host-mode multi-host
authentication order dot1x
authentication port-control auto
dot1x pae authenticator
spanning-tree portfast edge trunk

Re: Can not authenticate Cisco Access Point with EAP-FAST

andrewswanson — Wed, 08 Jun 2022 13:52:44 GMT

The documentation shows a different authentication host-mode for the Flexconnect AP (should be multi-host rather than multi-auth as you have).

Your original switchport config looked ok:

interface GigabitEthernet 1/0/1
switchport access vlan 100
switchport mode access
spanning-tree portfast edge

Once ISE authorizes with RADIUS attribute device-traffic-class=switch it should change to:

interface GigabitEthernet 1/0/1
switchport trunk native vlan 100
switchport mode trunk
spanning-tree portfast trunk

hth
andy

Re: Can not authenticate Cisco Access Point with EAP-FAST

Marius Gunnerud — Sun, 12 Jun 2022 18:47:04 GMT

In what order did you configure this? I mean, did you configure the switch first, and then WLC and ISE? If you configured the switch before the WLC / AP this might be the reason it is failing as the dot1x configuration has not been pushed to the AP

Re: Can not authenticate Cisco Access Point with EAP-FAST

RustamRustamov1023 — Mon, 13 Jun 2022 11:24:50 GMT

Hi All,

There is a bug indicated in this link:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18615

I upgraded my WLC and now I can authenticate APs using EAP-FAST.