topic Re: Zebra Printers EAP-TLS in Network Access Control

Zebra Printers EAP-TLS

Ben Meagher — Mon, 11 Mar 2019 03:44:04 GMT

Having some issues implementing TLS on some zebra printers. Does anyone have any pointers?

User Template

Verified cert on a laptop

OpenSSL to convert to PEM

Renamed as NRD

CACertsv.nrd

certcln.nrd

Privkey.nrd

ACS 5.3 on the backend

Local cert for ACS with trusted intermediaries and of course root

Im getting an EAP timeout, capture shows..

EAPOL start

Controller Identity

Client Identity

Radius Access Request

Radius Access Challenge

Controller request EAP TLS

Client crickets.....

Zebra Printers EAP-TLS

Amjad Abdullah — Tue, 06 Aug 2013 10:02:14 GMT

What do the logs on the ACS say? EAP timeout? this is usually issue with the client.

Tried to contact Zebra support? They may provide useful info.

Rating useful replies is more useful than saying "Thank you"

Re: Zebra Printers EAP-TLS

Chris Illsley — Mon, 06 Feb 2023 08:46:34 GMT

Hi,

Did you have any luck with this? We're having issues connecting Zebra Label Printers with EAP-TLS as well.

Thanks
Chris

Re: Zebra Printers EAP-TLS

ahollifield — Mon, 06 Feb 2023 17:48:34 GMT

This topic is 10 years old and references ACS (all versions of ACS are now EOL). I would suggest making a new topic on this.

https://community.cisco.com/t5/security-knowledge-base/how-to-ask-the-community-for-help/ta-p/3704356

Re: Zebra Printers EAP-TLS

Andrew Woolman — Tue, 18 Feb 2025 03:05:12 GMT

100% this is a certificate issue on the printer - except no one knows what the answer is. It seems I found the other 2 people in the world who are trying to do this. My bet is that it's an issue with the certificate chain.
I have a support call with Zebra and will post the answer if I find it.
This is not an ACS (or now ISE) issue

Re: Zebra Printers EAP-TLS

Sheraz.Salim — Tue, 18 Feb 2025 08:12:23 GMT

I had this classic issue in my previous job. our issue was resloved later by changing the RSSI value of the zebra printer. these printer are really hard guys some time give you a hard time.

our issue was they working fine and all of sudden lost the connection to wireless. even most of the time these printer were sitting next around to the AP not far at all.

Re: Zebra Printers EAP-TLS

Jagermeister — Tue, 18 Feb 2025 14:24:59 GMT

I have tried to do this with wired zebra printers, using eap-tls to authenticate them against ISE. I had a range of different models of Zebra printers and my observation was that that some models (mainly the newer ones) worked but that the older ones were behaving like you are saying right now. Sometimes I had a newer model that also didn't work with the exact same config as the working ones, upgrading the firmware helped in that case.

In the end I never managed to get the older ones working and also decided to move away from eap-tls with these printers since it was such a pain to manage these settings. Not sure if you're using some MDM for them but I had to send commands to them using the Zebra tool.

Re: Zebra Printers EAP-TLS

Andrew Woolman — Wed, 26 Feb 2025 02:15:42 GMT

OK. Problem solved.

The CERTCLN.nrd file needs to be a chain of the Client Cert and the Root Cert. The signing Cert doesn't seem to be required. Now I kind of knew that. What I didn't know was that you can't concatenate the certs in Notepad or using "cat" in Linux. You have to use openssl
openssl x509 -inform PEM -in "hostcert.pem" -text > CertChain.pem
openssl x509 -inform PEM -in "rootCert.pem" -text >> CertChain.pem
You can then rename CertChain to CLNCERT.nrd and upload it to your printer.