topic Port-Authentication (dot1x) not working in Network Access Control

Port-Authentication (dot1x) not working

Thomas Schaefer — Mon, 11 Mar 2019 05:27:18 GMT

Hello,

Windows send EAPOL and there is no answer from the switch.

This has work for feew weeks.
What can I do?

show auth sess int Gi121/1/0/9
Interface: GigabitEthernet121/1/0/9
MAC Address: Unknown
IP Address: Unknown
User-Name: UNRESPONSIVE
Status: Running
Domain: DATA
Oper host mode: single-host
Oper control dir: both
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0A0EXXXXXXXXXXXXXX
Acct Session ID: 0x000XXXXX
Handle: 0x2XXXXX

Runnable methods list:
Method State
dot1x Running

We will need more information

nspasov — Mon, 16 Feb 2015 21:08:03 GMT

We will need more information before we can help you troubleshoot this issue:

- Switch configs (Ports and Radius)

- Debug output from (debug radius authentication)

- Type of Radius used

- How is the Windows supplicant configured (EAP-TLS, PEAP, etc)

Thank you for rating helpful posts!

Hi,MAB is working.Dot1x doesn

Thomas Schaefer — Tue, 17 Feb 2015 08:26:37 GMT

Hi,

MAB is working.

Dot1x doesn't work.

Q- Type of Radius used
A- Windows 2008 R2 NPS

Q- How is the Windows supplicant configured (EAP-TLS, PEAP, etc)
A- EAP-TLS

------------------ Version ------------------

Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9-M), Version 15.1(2)SY3, RELEASE SOFTWARE (fc4)

------------------ RADIUS-config ------------------

aaa group server radius rad_admin
server name nps01
server name nps02
cache expiry 1
cache authorization profile admin_cache
cache authentication profile admin_cache
ip vrf forwarding management
ip radius source-interface Loopback0
load-balance method least-outstanding
!
aaa group server radius rad_eap
server name nps01
server name nps02
ip vrf forwarding management
ip radius source-interface Loopback0
load-balance method least-outstanding
!
aaa group server radius rad_acct
server name nps01
server name nps02
ip vrf forwarding management
ip radius source-interface Loopback0
load-balance method least-outstanding
!
aaa authentication login default cache rad_admin group rad_admin local
aaa authentication dot1x default group rad_eap
aaa authorization exec default cache rad_admin group rad_admin local
aaa authorization network default group rad_eap
aaa accounting update periodic 5
aaa accounting dot1x default start-stop group rad_acct
aaa accounting network default start-stop group rad_acct
aaa cache profile admin_cache
all
aaa session-id common

radius-server attribute 32 include-in-access-req format %h
radius-server retry method reorder
radius server nps01
address ipv4 192.168.0.15 auth-port 1645 acct-port 1646
automate-tester username cs1-vi1 idle-time 5
key 7 <removed>
radius server nps02
address ipv4 192.168.0.16 auth-port 1645 acct-port 1646
automate-tester username cs1-vi1 idle-time 5
key 7 <removed>

------------------IA6800 Port-config ------------------

!
interface GigabitEthernet121/1/0/9
switchport
switchport trunk allowed vlan none
switchport mode access
authentication priority dot1x mab
authentication port-control auto
authentication periodic
mab
dot1x pae authenticator
dot1x timeout tx-period 10
storm-control broadcast level 0.05
flowcontrol receive on
!

THX

Can you:

nspasov — Wed, 18 Feb 2015 09:06:26 GMT

Can you:

1. Post the debug output from "Debug radius authentcation" You can use a "condition" for the interface that you are working with so you limit the logs

2. Add the following commands to the switchport you are working with:

 spanning-tree portfast
 spanning-tree bpduguard enable
 authentication control-direction both
 authentication event fail action next-method
 authentication host-mode multi-auth
 authentication order dot1x mab

Thank you for rating helpful posts!

Hi,her is the Output.

Thomas Schaefer — Wed, 18 Feb 2015 09:57:24 GMT

Hi,

her is the Output.

Hello, Glad to see fresh post

Vern Brinkman — Wed, 18 Feb 2015 16:00:34 GMT

Hello,

Glad to see fresh post, usually they years old - not hours.

My dot1x isn't working either - it allows access without any authentication with the configs below.

I am running 12.2(33)SXI13.

interface GigabitEthernet3/34
description c-41 cube 239
switchport
switchport access vlan 903
switchport mode access
authentication port-control auto
dot1x pae authenticator
end

show dot1xall

Dot1x Info for GigabitEthernet3/34
-----------------------------------
PAE                       = AUTHENTICATOR
PortControl               = AUTO
ControlDirection          = Both
HostMode                  = SINGLE_HOST

QuietPeriod               = 60
ServerTimeout             = 0
SuppTimeout               = 30
ReAuthMax                 = 2
MaxReq                    = 2
TxPeriod                  = 30

Thanks for the output. I have

nspasov — Thu, 19 Feb 2015 18:15:59 GMT

Thanks for the output. I have a few more questions:

- What is the switch make/model? I am guessing Cisco 6500 but just making sure

- Did you try enabling the commands that I suggested above

- Do you happen to have any unmanged switches/hubs that would sit between the Cisco 6500 switch and the end station

Thank you for rating helpful posts!

Vern, please read my previous

nspasov — Thu, 19 Feb 2015 18:17:13 GMT

Vern, please read my previous comments and provide answers to the same questions 🙂

Thank you for rating helpful posts!

Q - What is the switch make

Thomas Schaefer — Thu, 19 Feb 2015 18:48:32 GMT

Q - What is the switch make/model? I am guessing Cisco 6500 but just making sure
A - Yes, 6500-E / Sup2T and ia6800.

Q - Did you try enabling the commands that I suggested above
A - Yes, the commands not working.
(On a WS-X6848-GE-TX Port it works)

Q - Do you happen to have any unmanged switches/hubs that would sit between the Cisco 6500 switch and the end station
A - No

----------------

Extender Model: C6800IA-48FPD

FEX version: 15.0(2)EX6

Supervisor Engine 2T

Version 15.1(2)SY3

Hmm, I am out of ideas here.

nspasov — Thu, 19 Feb 2015 23:26:15 GMT

Hmm, I am out of ideas here. I wonder if you are running into some bug because the commands that I listed are mandatory for some 802.1x functionality. I would suggest you open a case with TAC. Let us know how it goes!

Thank you for rating helpful posts!

Re: Port-Authentication (dot1x) not working

chrisdale — Thu, 06 Jul 2023 09:02:57 GMT

From the information above, looks like you are missing a key piece of config.

Have you applied this command? As this globally turns on dot1x

dot1x system-auth-control