topic hello,,,i do confirm that , in Network Access Control

ACS EAP-TLS

Reyad Safi — Mon, 11 Mar 2019 04:39:15 GMT

Hello Experts...

i have a problem when using ACS 5.1 with AP1141 through EAP-TLS authentication method.

when i try to connect my laptop , it's authenticated sucessfully , but when i try to authenticate third party Black Box using EAP-TLS , i have an authentication failure ( 12511 Unexpectedly received TLS alert message; treating as a rejection by the client ).

when i check the debug report at the ACS , i found that the authentication method when i use my laptop is x509_PKI , and it's successfully , but when i use the 3rd party devise , the authentication method in the radius log report is EAP-TLS , and it's failed.

so is there any different between the x509_PKI and EAP-TLS , if yes , how could i check EAP-TLS.

reyad

fyi, EAP TLS involves

Saurav Lodh — Mon, 21 Apr 2014 03:33:49 GMT

fyi, EAP TLS involves exchange of certificate between client and server, where the certificate issued to client is in x.509 format , issued by CA ( part of PKI ). The below could be reason of above mentioned error

The supplicant or client machine is not accepting the certificate from Cisco ISE.The client machine is configured to validate the server certificate, but is not configured to trust the Cisco ISE certificate.

thank you Saldohi install

Reyad Safi — Mon, 21 Apr 2014 23:12:20 GMT

thank you Saldoh

i install wireshark to get the authentications logs , and i compare this log with working ACS....

the only difference is EAP-TLS Flag: 0x00 ,

0... ... = length include false , while its true at the working one.

any recommendation

Reyad

As you have stated that you

Venkatesh Attuluri — Tue, 22 Apr 2014 03:29:17 GMT

As you have stated that you authentication with 3rd party device is failing it may be due to certificate issue.EAP-TLS use certificates for both user and server authentication

check EAP-TLS Deployment Guide for Wireless LAN Networks

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a008009256b.shtml#wp39021

hello,,,i do confirm that ,

Reyad Safi — Wed, 30 Apr 2014 10:44:24 GMT

hello,,,

i do confirm that , the 3rd Party already trust the AAA CA , and the AAA trust the 3rd Party CA.

when i use Cisco 4.1 Radius , the client is connected without any problem.

to clarify the status , this client accept only eap-tls authentication method ,so the only changes which i did on the 4.1 radius , is go to system configuration , global authentication setup , and enable the eap-tls only...and change the AP EAP request timeout to 0

and this what i did also in ACS5.1

any suggestions

reyad