topic dot1x authorization failing in Network Access Control

dot1x authorization failing

AndiMorris — Mon, 11 Mar 2019 04:11:08 GMT

Hi all,

I'm having an issue on my network where intermittently users are being denied access to the network because dot1x authorization is failing (at least that's what it looks like). I'm mainly seeing this on Windows wired clients, but I think that it is happening for all clients, however wireless and mac devices seem to just keep trying with the credentials until they are eventually allowed onto the network.

It started happening across the network simultaneously, so I don't think it is down to a config problem on the endpoint switches, and I'm failry sure that there was no config change on the core switch around the time that this started occuring.

I can see access-accept packets being sent from the radius server, and then received by the switch, but the device is still not allowed onto the network.

To rule it out I setup a new radius server, and mysql database backend, and I'm still seeing the problem, albeit not as often.

I have radius debug snippets from a (C2960-LANBASE-M), Version 12.2(35)SE5 switch below:

1w3d: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down

1w3d: RADIUS(00000078): Storing nasport 50002 in rad_db

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/227, len 152

1w3d: RADIUS: authenticator 6F 64 81 F2 E2 F1 9A 22 - A0 6E A5 6E 6B CC 69 E6

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 14

1w3d: RADIUS: 02 02 00 0C 01 73 6D 31 38 38 31 38 [?????testuser]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: C9 08 3B C0 5B 4F 16 9A F0 77 26 00 4A CA 4C B2 [??;?[O???w&?J?L?]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/227 10.1.3.7:1812, Access-Challenge, len 64

1w3d: RADIUS: authenticator F8 58 D9 B4 CE CB 56 4B - 83 1E A6 2A DD 78 9A FB

1w3d: RADIUS: EAP-Message [79] 8

1w3d: RADIUS: 01 03 00 06 19 20 [????? ]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 56 5C 9F F3 88 CC AF 69 B7 E4 86 08 EE E5 1A D0 [V\?????i????????]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 63 57 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fcW????@?????]

1w3d: RADIUS(00000078): Received from id 1645/227

1w3d: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/228, len 263

1w3d: RADIUS: authenticator DC A6 B7 91 BB 47 41 C5 - 13 2E 8C 9B 24 87 5E 43

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 107

1w3d: RADIUS: 02 03 00 69 19 80 00 00 00 5F 16 03 01 00 5A 01 [???i?????_????Z?]

1w3d: RADIUS: 00 00 56 03 01 52 A9 A8 AF 29 75 C0 12 2D 9C F3 [??V??R???)u??-??]

1w3d: RADIUS: EB E5 BC 0A 0D 73 E4 5D 50 A7 E1 E4 E0 04 18 AB [?????s?]P???????]

1w3d: RADIUS: F8 E6 63 D7 9A 00 00 18 00 2F 00 35 00 05 00 0A [??c??????/?5????]

1w3d: RADIUS: C0 13 C0 14 C0 09 C0 0A 00 32 00 38 00 13 00 04 [?????????2?8????]

1w3d: RADIUS: 01 00 00 15 FF 01 00 01 00 00 0A 00 06 00 04 00 [????????????????]

1w3d: RADIUS: 17 00 18 00 0B 00 02 01 00 [?????????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 0D BC 2B 98 5A 1F 43 CE E5 C1 07 97 69 83 E6 D7 [??+?Z?C?????i???]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 63 57 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fcW????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/228 10.1.3.7:1812, Access-Challenge, len 1090

1w3d: RADIUS: authenticator F6 24 FE 39 36 16 4E 19 - 3E C6 9D E3 C2 F0 89 BB

1w3d: RADIUS: EAP-Message [79] 255

1w3d: RADIUS: 01 04 04 00 19 C0 00 00 04 DF 16 03 01 00 31 02 [??????????????1?]

1w3d: RADIUS: 00 00 2D 03 01 52 A9 A8 9D FE 62 3A 30 5A 48 37 [??-??R????b:0ZH7]

1w3d: RADIUS: 21 EA 47 66 58 3B 82 43 3E BE 53 89 55 2D 22 A4 [!?GfX;?C>?S?U-"?]

1w3d: RADIUS: A9 32 C3 DD 1A 00 00 2F 00 00 05 FF 01 00 01 00 [?2?????/????????]

1w3d: RADIUS: 16 03 01 04 9B 0B 00 04 97 00 04 94 00 04 91 30 [???????????????0]

1w3d: RADIUS: 82 04 8D 30 82 03 75 A0 03 02 01 02 02 09 00 CD [???0??u?????????]

1w3d: RADIUS: 16 44 FD FF A8 E4 68 30 0D 06 09 2A 86 48 86 F7 [?D????h0???*?H??]

1w3d: RADIUS: 0D 01 01 05 05 00 30 76 31 0B 30 09 06 03 55 04 [??????0v1?0???U?]

1w3d: RADIUS: 06 13 02 43 41 31 0B 30 09 06 03 55 04 08 13 02 [???CA1?0???U????]

1w3d: RADIUS: 51 43 31 11 30 0F 06 03 55 04 07 13 08 4D 6F 6E [QC1?0???U????Mon]

1w3d: RADIUS: 74 72 65 61 6C 31 10 30 0E 06 03 55 04 0A 13 07 [treal1?0???U????]

1w3d: RADIUS: 49 6E 76 65 72 73 65 31 12 30 10 06 03 55 04 03 [Inverse1?0???U??]

1w3d: RADIUS: 13 09 31 32 37 2E 30 2E 30 2E 31 31 21 30 1F 06 [??127.0.0.11!0??]

1w3d: RADIUS: 09 2A 86 48 86 F7 0D 01 09 01 16 12 73 75 70 70 [?*?H????????supp]

1w3d: RADIUS: 6F 72 74 40 69 6E 76 65 72 73 65 2E 63 61 30 1E [ort@inverse.ca0?]

1w3d: RADIUS: 17 0D 31 33 31 32 31 31 31 34 32 34 33 [??13121114243]

1w3d: RADIUS: EAP-Message [79] 255

1w3d: RADIUS: 39 5A 17 0D 31 34 31 32 31 31 31 34 32 34 33 39 [9Z??141211142439]

1w3d: RADIUS: 5A 30 76 31 0B 30 09 06 03 55 04 06 13 02 43 41 [Z0v1?0???U????CA]

1w3d: RADIUS: 31 0B 30 09 06 03 55 04 08 13 02 51 43 31 11 30 [1?0???U????QC1?0]

1w3d: RADIUS: 0F 06 03 55 04 07 13 08 4D 6F 6E 74 72 65 61 6C [???U????Montreal]

1w3d: RADIUS: 31 10 30 0E 06 03 55 04 0A 13 07 49 6E 76 65 72 [1?0???U????Inver]

1w3d: RADIUS: 73 65 31 12 30 10 06 03 55 04 03 13 09 31 32 37 [se1?0???U????127]

1w3d: RADIUS: 2E 30 2E 30 2E 31 31 21 30 1F 06 09 2A 86 48 86 [.0.0.11!0???*?H?]

1w3d: RADIUS: F7 0D 01 09 01 16 12 73 75 70 70 6F 72 74 40 69 [???????support@i]

1w3d: RADIUS: 6E 76 65 72 73 65 2E 63 61 30 82 01 22 30 0D 06 [nverse.ca0??"0??]

1w3d: RADIUS: 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F [?*?H????????????]

1w3d: RADIUS: 00 30 82 01 0A 02 82 01 01 00 B9 83 DC 55 26 33 [?0???????????U&3]

1w3d: RADIUS: F9 EC 71 64 75 13 6B 95 8E 2A DC E1 5F A5 F8 89 [??qdu?k??*??_???]

1w3d: RADIUS: 4D 2C 4B 88 F1 9F F5 B1 59 B2 22 50 B1 A0 C5 D5 [M,K?????Y?"P????]

1w3d: RADIUS: 21 6D 0E 66 FF 87 1A 0B 39 3A 23 1A 16 40 15 BC [!m?f????9:#??@??]

1w3d: RADIUS: 15 2A 62 E1 F5 C1 D8 82 99 91 4F F2 6C 30 79 86 [?*b???????O?l0y?]

1w3d: RADIUS: 3C EA 2F 48 B4 6C 8D 31 A0 3E 62 BF 1C [<?/H?l?1?>b??]

1w3d: RADIUS: EAP-Message [79] 255

1w3d: RADIUS: 09 43 B5 17 69 27 52 F5 10 12 92 B0 B7 9E 50 8C [?C??i'R???????P?]

1w3d: RADIUS: 67 99 4A 18 D4 DE 6B 3E 1E 1D D4 D4 DF 6A 25 24 [g?J???k>?????j?$]

1w3d: RADIUS: 58 9B C2 9F 9C 4B E2 22 22 45 5E 54 BD E2 E2 A3 [X????K?""E^T????]

1w3d: RADIUS: 36 95 5C D6 35 15 03 21 B6 55 44 85 5A 27 01 A3 [6?\?5??!?UD?Z'??]

1w3d: RADIUS: B9 17 FB 02 E9 1B EB AF DD A0 A4 93 C6 C4 F6 7D [???????????????}]

1w3d: RADIUS: FB 12 EE 14 DD 09 FA 55 0C 8E F1 53 61 58 9C CC [???????U???SaX??]

1w3d: RADIUS: 25 D4 85 84 4C 5B 1F 25 36 E2 2B 98 4E 2E AD A0 [????L[??6?+?N.??]

1w3d: RADIUS: 97 0F 97 44 0B 84 22 B0 5C F5 35 35 8F 18 9A 91 [???D??"?\?55????]

1w3d: RADIUS: FA 00 E9 26 6B A0 1B D6 A0 0B 49 95 2A E1 62 A1 [???&k?????I?*?b?]

1w3d: RADIUS: A9 3A 58 9C 3B C3 8C 9E 26 58 E9 85 D4 81 06 EC [?:X?;???&X??????]

1w3d: RADIUS: C2 C0 8E 8C AD D8 4E 8A 5C 95 9A D1 0D 02 03 01 [??????N?\???????]

1w3d: RADIUS: 00 01 A3 82 01 1C 30 82 01 18 30 1D 06 03 55 1D [??????0???0???U?]

1w3d: RADIUS: 0E 04 16 04 14 4B 4A 18 31 6E EA 51 1A D1 0B C9 [?????KJ?1n?Q????]

1w3d: RADIUS: F3 38 80 42 86 73 6C 10 BC 30 81 A8 06 03 55 1D [?8?B?sl??0????U?]

1w3d: RADIUS: 23 04 81 A0 30 81 9D 80 14 4B 4A 18 31 6E EA 51 [#???0????KJ?1n?Q]

1w3d: RADIUS: 1A D1 0B C9 F3 38 80 42 86 73 6C 10 BC [?????8?B?sl??]

1w3d: RADIUS: EAP-Message [79] 255

1w3d: RADIUS: A1 7A A4 78 30 76 31 0B 30 09 06 03 55 04 06 13 [?z?x0v1?0???U???]

1w3d: RADIUS: 02 43 41 31 0B 30 09 06 03 55 04 08 13 02 51 43 [?CA1?0???U????QC]

1w3d: RADIUS: 31 11 30 0F 06 03 55 04 07 13 08 4D 6F 6E 74 72 [1?0???U????Montr]

1w3d: RADIUS: 65 61 6C 31 10 30 0E 06 03 55 04 0A 13 07 49 6E [eal1?0???U????In]

1w3d: RADIUS: 76 65 72 73 65 31 12 30 10 06 03 55 04 03 13 09 [verse1?0???U????]

1w3d: RADIUS: 31 32 37 2E 30 2E 30 2E 31 31 21 30 1F 06 09 2A [127.0.0.11!0???*]

1w3d: RADIUS: 86 48 86 F7 0D 01 09 01 16 12 73 75 70 70 6F 72 [?H????????suppor]

1w3d: RADIUS: 74 40 69 6E 76 65 72 73 65 2E 63 61 82 09 00 CD [t@inverse.ca????]

1w3d: RADIUS: 16 44 FD FF A8 E4 68 30 0C 06 03 55 1D 13 01 01 [?D????h0???U????]

1w3d: RADIUS: FF 04 02 30 00 30 09 06 03 55 1D 12 04 02 30 00 [???0?0???U????0?]

1w3d: RADIUS: 30 0B 06 03 55 1D 0F 04 04 03 02 05 E0 30 13 06 [0???U????????0??]

1w3d: RADIUS: 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 [?U????0???+?????]

1w3d: RADIUS: 03 01 30 11 06 09 60 86 48 01 86 F8 42 01 01 04 [??0???`?H???B???]

1w3d: RADIUS: 04 03 02 06 40 30 0D 06 09 2A 86 48 86 F7 0D 01 [????@0???*?H????]

1w3d: RADIUS: 01 05 05 00 03 82 01 01 00 19 18 51 11 82 81 E4 [???????????Q????]

1w3d: RADIUS: D6 A5 D6 77 5F C3 FF 06 3C 3C F7 F0 22 [???w_???<<??"]

1w3d: RADIUS: EAP-Message [79] 14

1w3d: RADIUS: 5E 1E DB 98 27 61 5D DD 5D 78 0D F0 [^???'a]?]x??]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: C1 8F 24 FA 11 52 8B 39 69 51 14 C0 41 C3 9D DA [??$??R?9iQ??A???]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 62 50 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fbP????@?????]

1w3d: RADIUS(00000078): Received from id 1645/228

1w3d: RADIUS/DECODE: EAP-Message fragments, 253+253+253+253+12, total 1024 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/229, len 164

1w3d: RADIUS: authenticator C9 1C 11 60 1D 24 81 FF - 52 88 BB 53 9F 41 D5 E8

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 8

1w3d: RADIUS: 02 04 00 06 19 00 [??????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 55 7E 93 2E 8E 0B 22 8F 28 ED 55 5C 14 74 D4 3B [U~?.??"?(?U\?t?;]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 62 50 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fbP????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/229 10.1.3.7:1812, Access-Challenge, len 297

1w3d: RADIUS: authenticator 6E 3F 5A 98 E4 F8 FF D4 - 50 AC 85 77 22 97 76 82

1w3d: RADIUS: EAP-Message [79] 241

1w3d: RADIUS: 01 05 00 EF 19 00 B0 BA 30 BE ED 4D 88 C6 62 66 [????????0??M??bf]

1w3d: RADIUS: 95 20 57 A7 D4 AE 5D 3A C4 B3 77 D9 F6 72 BA AF [? W???]:??w??r??]

1w3d: RADIUS: 3D 25 C5 03 15 71 BB 7A 69 01 A1 78 0F CB 13 82 [=????q?zi??x????]

1w3d: RADIUS: 1D 83 40 A8 2C 88 07 9B 2B 9E 6B 5C 8E F3 94 96 [??@?,???+?k\????]

1w3d: RADIUS: 94 D3 FA 3A 94 09 F7 89 01 CD 85 2F 95 F6 23 7F [???:???????/??#?]

1w3d: RADIUS: 60 DD 53 ED 16 84 49 CA 4D 5E 61 8C 22 1F DD 3F [`?S???I?M^a?"???]

1w3d: RADIUS: 72 B0 3B 92 BB 00 D8 85 29 10 A1 D9 18 2C 8A DD [r?;?????)????,??]

1w3d: RADIUS: D8 EC 14 FD 2B 41 D8 62 9D 9B 5B CD 21 EC E3 4A [????+A?b??[?!??J]

1w3d: RADIUS: DB F7 75 71 F2 87 37 3A 26 A8 71 6E 1D 7C 43 6E [??uq??7:&?qn?|Cn]

1w3d: RADIUS: 0E 83 E4 94 7B 74 A0 E7 93 B0 37 88 A7 F0 EF 2B [????{t????7????+]

1w3d: RADIUS: 38 14 F6 61 ED 75 83 B8 07 9F 77 C5 6E 19 67 04 [8??a?u????w?n?g?]

1w3d: RADIUS: BD 8A E1 4C E6 ED A1 F4 0C 46 02 10 C3 5C 2A 22 [???L?????F???\*"]

1w3d: RADIUS: ED 8F F1 E8 DA 03 08 CB D0 00 20 B0 1C B2 BB 61 [?????????? ????a]

1w3d: RADIUS: E7 2C E6 C0 36 B0 3D 19 33 F5 0A D2 5D 95 FE 52 [?,??6?=?3???]??R]

1w3d: RADIUS: 63 30 61 3D 4F A7 16 03 01 00 04 0E 00 00 00 [c0a=O??????????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: A0 E7 47 99 CD B6 76 96 83 67 A8 3B 9B 2D 40 92 [??G???v??g?;?-@?]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 61 51 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?faQ????@?????]

1w3d: RADIUS(00000078): Received from id 1645/229

1w3d: RADIUS/DECODE: EAP-Message fragments, 239, total 239 bytes

1w3d: RADIUS/ENCODE: EAP-Message fragment 336 into 253+83, total 336 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/230, len 496

1w3d: RADIUS: authenticator 03 51 63 4C 7F 33 F6 61 - 92 D4 04 C5 B6 9F F2 77

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 255

1w3d: RADIUS: 02 05 01 50 19 80 00 00 01 46 16 03 01 01 06 10 [???P?????F??????]

1w3d: RADIUS: 00 01 02 01 00 2D AD 4B A7 78 99 1E C4 75 1E B4 [?????-?K?x???u??]

1w3d: RADIUS: C3 35 F4 5E 88 9F 37 BA B2 24 95 B9 70 30 60 32 [?5?^??7??$??p0`2]

1w3d: RADIUS: EE 3B 02 9E A6 31 63 2F C8 00 EF 21 86 53 F1 2B [?;???1c/???!?S?+]

1w3d: RADIUS: 01 3F 5E F6 A1 8F D0 4A 0D 70 18 0A 46 22 94 4E [??^????J?p??F"?N]

1w3d: RADIUS: 18 21 61 E1 B4 98 00 F5 81 FD A0 B7 BE D9 07 07 [?!a?????????????]

1w3d: RADIUS: 0B 8A EB 09 5F 9E 12 D9 07 17 4F 4F C0 6F 5A 23 [????_?????OO?oZ#]

1w3d: RADIUS: 2F 70 7C B0 8C CB B8 1C 35 7C 92 83 8B 0E 08 89 [/p|?????5|??????]

1w3d: RADIUS: AE AA 96 E7 B2 1D C7 70 CB 2E 7A 20 76 EC E4 85 [???????p?.z v???]

1w3d: RADIUS: A2 10 74 67 B0 BB 34 7C 8D 3F 4B A0 BB F1 1A 82 [??tg??4|??K?????]

1w3d: RADIUS: 7A 63 6B 77 91 A6 57 4D 87 E9 C9 66 4E 23 7C DD [zckw??WM???fN#|?]

1w3d: RADIUS: E7 3B 24 00 66 1C 29 0C 34 4A F3 F4 A9 F3 85 62 [?;$?f?)?4J?????b]

1w3d: RADIUS: F0 EE CF F8 C1 62 12 54 EE 7C BC 85 42 B7 6D A2 [?????b?T?|??B?m?]

1w3d: RADIUS: 8A BC C2 3A B3 C7 2F 7F 9C 51 12 2B 6E 0E 10 E4 [???:??/??Q?+n???]

1w3d: RADIUS: 63 2A 5A DB 3A F3 53 3D 37 D8 6E A0 8F 41 89 BE [c*Z?:?S=7?n??A??]

1w3d: RADIUS: 1E B4 A8 81 E9 29 CA 48 12 B2 7A 3F FB [?????)?H??z??]

1w3d: RADIUS: EAP-Message [79] 85

1w3d: RADIUS: 9C 6E 34 97 3A A2 50 50 A8 B8 C4 3B C7 2F CE 47 [?n4?:?PP???;?/?G]

1w3d: RADIUS: E5 EA FB 97 88 07 C5 C3 14 03 01 00 01 01 16 03 [????????????????]

1w3d: RADIUS: 01 00 30 03 84 21 31 46 92 E3 7B C2 38 C3 4C 0E [??0??!1F??{?8?L?]

1w3d: RADIUS: 78 9D 3E 03 22 72 86 D1 21 E6 A7 4C 4F F9 0E F4 [x?>?"r??!??LO???]

1w3d: RADIUS: 06 53 77 09 6C 95 7B 5B 29 27 16 FD 07 68 A4 57 [?Sw?l?{[)'???h?W]

1w3d: RADIUS: 10 57 74 [?Wt]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 83 89 35 02 33 9A 11 19 23 E7 90 41 E6 78 F6 89 [??5?3???#??A?x??]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 61 51 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?faQ????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/230 10.1.3.7:1812, Access-Challenge, len 123

1w3d: RADIUS: authenticator DD 9E 08 4F 3D 0C 15 58 - 49 50 0D 71 DD 8C 17 ED

1w3d: RADIUS: EAP-Message [79] 67

1w3d: RADIUS: 01 06 00 41 19 00 14 03 01 00 01 01 16 03 01 00 [???A????????????]

1w3d: RADIUS: 30 24 AA AA C6 F4 FF 3F 23 EE 73 7C 2E 01 28 2D [0$??????#?s|.?(-]

1w3d: RADIUS: 47 85 A0 92 62 40 08 2D F1 83 C6 B4 ED 82 04 22 [G???b@?-???????"]

1w3d: RADIUS: A3 29 3A 0C E7 27 61 90 46 9E 90 57 F2 BA 0C 73 [?):??'a?F??W???s]

1w3d: RADIUS: 7A [z]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: E8 F3 04 6B 64 E5 60 F0 D7 30 9B B3 A3 51 33 66 [???kd?`??0???Q3f]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 60 52 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?f`R????@?????]

1w3d: RADIUS(00000078): Received from id 1645/230

1w3d: RADIUS/DECODE: EAP-Message fragments, 65, total 65 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/231, len 164

1w3d: RADIUS: authenticator 6F 1A 59 18 65 C8 EF 20 - A7 74 57 A8 71 EF 6D 43

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 8

1w3d: RADIUS: 02 06 00 06 19 00 [??????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: CF 48 EC 60 AA 47 55 41 60 0F 5B F1 3C 17 D1 A5 [?H?`?GUA`?[?<???]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 60 52 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?f`R????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/231 10.1.3.7:1812, Access-Challenge, len 101

1w3d: RADIUS: authenticator 55 C2 18 91 2D E0 3A 0E - AC 3A 97 B6 62 FB 84 A8

1w3d: RADIUS: EAP-Message [79] 45

1w3d: RADIUS: 01 07 00 2B 19 00 17 03 01 00 20 E8 04 BE 45 5E [???+?????? ???E^]

1w3d: RADIUS: 59 B3 96 1B B7 48 07 6A 47 AD 0F 11 F0 E1 C6 10 [Y????H?jG???????]

1w3d: RADIUS: 7A E6 C9 D9 21 97 97 A2 4D 41 A1 [z???!???MA?]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: DE C0 10 06 90 77 1C C8 9F BC 18 6D 2A 8E 34 5F [?????w?????m*?4_]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 67 53 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fgS????@?????]

1w3d: RADIUS(00000078): Received from id 1645/231

1w3d: RADIUS/DECODE: EAP-Message fragments, 43, total 43 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/232, len 201

1w3d: RADIUS: authenticator 9E 53 A8 5A 3E 40 A0 5E - 1D B2 BD 22 A0 EF 6B DC

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 45

1w3d: RADIUS: 02 07 00 2B 19 00 17 03 01 00 20 CA 52 0F 0F AB [???+?????? ?R???]

1w3d: RADIUS: D5 84 E3 07 BF E9 37 E3 57 57 3B B0 54 02 79 5F [??????7?WW;?T?y_]

1w3d: RADIUS: 73 26 1D C1 0F 9E 85 68 51 92 A3 [s&?????hQ??]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: C5 8E 81 28 B4 BF 98 C6 DA B8 00 11 55 80 ED E5 [???(????????U???]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 67 53 C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fgS????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/232 10.1.3.7:1812, Access-Challenge, len 133

1w3d: RADIUS: authenticator 6D 60 29 9F E3 FE 86 59 - 28 C6 39 D6 5A 3C 2B A5

1w3d: RADIUS: EAP-Message [79] 77

1w3d: RADIUS: 01 08 00 4B 19 00 17 03 01 00 40 C7 3A E6 C2 FD [???K??????@?:???]

1w3d: RADIUS: 65 55 33 19 3C C6 BE A8 32 B6 42 30 A9 7E 69 DE [eU3?<???2?B0?~i?]

1w3d: RADIUS: 9C F5 27 8F 61 5E 12 7B 7B 7E 55 4C FE FF 4C E6 [??'?a^?{{~UL??L?]

1w3d: RADIUS: 91 38 4A 01 3B 70 13 5F CC E6 D9 33 78 68 32 68 [?8J?;p?_???3xh2h]

1w3d: RADIUS: FD A9 DC A0 26 05 FC C6 BB BF D0 [????&??????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 23 F6 4F 03 92 1A 5C 26 BB 82 B4 40 A2 43 7E DC [#?O???\&???@?C~?]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 66 5C C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?ff\????@?????]

1w3d: RADIUS(00000078): Received from id 1645/232

1w3d: RADIUS/DECODE: EAP-Message fragments, 75, total 75 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/233, len 265

1w3d: RADIUS: authenticator A1 95 14 47 86 C3 D5 10 - 4C B8 6C A7 35 3E FB 90

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 109

1w3d: RADIUS: 02 08 00 6B 19 00 17 03 01 00 60 C8 C9 42 DA 55 [???k??????`??B?U]

1w3d: RADIUS: 9A 2B 33 54 87 CA E5 C5 CF C8 A6 45 09 01 42 3C [?+3T???????E??B<]

1w3d: RADIUS: F8 7D 37 98 4A EE 85 DB 5E 55 B4 97 D4 A3 41 D9 [?}7?J???^U????A?]

1w3d: RADIUS: 21 50 40 64 9F 96 02 E0 D4 9C 8A 97 30 42 F9 48 [!P@d????????0B?H]

1w3d: RADIUS: 65 89 A2 3F EC 65 0E B6 43 F0 51 3A 6B E3 1D 58 [e????e??C?Q:k??X]

1w3d: RADIUS: 72 92 67 F6 8B F8 3C 94 2B C3 69 89 8B 6E 5D B3 [r?g???<?+?i??n]?]

1w3d: RADIUS: C7 D5 6C 0E 54 D3 76 D0 21 35 0B [??l?T?v?!5?]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 53 8A 74 F9 DB 80 9A 36 1D 95 21 13 65 36 C1 99 [S?t????6??!?e6??]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 66 5C C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?ff\????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/233 10.1.3.7:1812, Access-Challenge, len 149

1w3d: RADIUS: authenticator F6 82 B1 7E 1D 01 08 AD - 72 09 FE 54 A2 70 18 6A

1w3d: RADIUS: EAP-Message [79] 93

1w3d: RADIUS: 01 09 00 5B 19 00 17 03 01 00 50 5F 0B 8C 36 17 [???[??????P_??6?]

1w3d: RADIUS: BA 42 7B 0E C4 C9 B7 0F 94 08 14 14 92 1C 58 74 [?B{???????????Xt]

1w3d: RADIUS: D0 DE 34 CA 7D 86 56 98 58 D6 4D 87 71 04 56 1F [??4?}?V?X?M?q?V?]

1w3d: RADIUS: 27 06 D3 C0 30 8C C1 97 DF 54 96 11 FD 37 FC 49 ['???0????T???7?I]

1w3d: RADIUS: 0F FE 9E BB 75 0B DB 6A 8F A1 45 FF CA 8C 51 79 [????u??j??E???Qy]

1w3d: RADIUS: 1C 51 6F 9B 19 23 DB D5 8F 03 DF [?Qo??#?????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 41 B3 98 DA 01 8C 2A 28 74 CE FD CE AD CF 40 61 [A?????*(t?????@a]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 65 5D C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fe]????@?????]

1w3d: RADIUS(00000078): Received from id 1645/233

1w3d: RADIUS/DECODE: EAP-Message fragments, 91, total 91 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/234, len 201

1w3d: RADIUS: authenticator 23 D3 5B 1D C5 B5 2E 31 - 9A C1 D4 A7 76 11 A6 D2

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 45

1w3d: RADIUS: 02 09 00 2B 19 00 17 03 01 00 20 53 27 B3 87 B9 [???+?????? S'???]

1w3d: RADIUS: EE 13 4D D5 06 7A 7C FD 2E 5A E9 C9 6E 03 92 80 [??M??z|?.Z??n???]

1w3d: RADIUS: C7 7F A1 27 7D D9 F4 36 A2 E2 30 [???'}??6??0]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 46 36 2E FB 1F 4F 9B 2F A2 AC 4F 11 DA 3F F0 56 [F6.??O?/??O????V]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 65 5D C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fe]????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/234 10.1.3.7:1812, Access-Challenge, len 101

1w3d: RADIUS: authenticator BD D4 91 CC 08 8D 0B E5 - A3 54 97 49 4B 9C 28 68

1w3d: RADIUS: EAP-Message [79] 45

1w3d: RADIUS: 01 0A 00 2B 19 00 17 03 01 00 20 F1 07 45 C8 19 [???+?????? ??E??]

1w3d: RADIUS: ED D6 0B 8D C6 76 7C 70 1D BA 23 4B 10 90 73 A9 [?????v|p??#K??s?]

1w3d: RADIUS: DC 0A 11 9E E9 AE 98 E9 4C 6D AF [????????Lm?]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: 1A 45 E7 03 2A D6 4D 33 E0 56 60 8A 5B 66 09 23 [?E??*?M3?V`?[f?#]

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 64 5E C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fd^????@?????]

1w3d: RADIUS(00000078): Received from id 1645/234

1w3d: RADIUS/DECODE: EAP-Message fragments, 43, total 43 bytes

1w3d: RADIUS(00000078): Using existing nas_port 50002

1w3d: RADIUS(00000078): Config NAS IP: 0.0.0.0

1w3d: RADIUS/ENCODE(00000078): acct_session_id: 120

1w3d: RADIUS(00000078): sending

1w3d: RADIUS/ENCODE: Best Local IP-Address 10.1.1.102 for Radius-Server 10.1.3.7

1w3d: RADIUS(00000078): Send Access-Request to 10.1.3.7:1812 id 1645/235, len 201

1w3d: RADIUS: authenticator FA E2 21 EC FA 4F 81 3A - 77 00 15 80 D7 38 B9 5D

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Service-Type [6] 6 Framed [2]

1w3d: RADIUS: Framed-MTU [12] 6 1500

1w3d: RADIUS: Called-Station-Id [30] 19 "00-1E-49-99-B5-82"

1w3d: RADIUS: Calling-Station-Id [31] 19 "00-24-54-42-86-04"

1w3d: RADIUS: EAP-Message [79] 45

1w3d: RADIUS: 02 0A 00 2B 19 00 17 03 01 00 20 F6 5A 6E 7D 98 [???+?????? ?Zn}?]

1w3d: RADIUS: F1 6C 70 74 2B 35 CB 89 B4 F0 B5 03 D0 F1 A3 3B [?lpt+5?????????;]

1w3d: RADIUS: F6 85 67 5C C7 9D 92 11 9B C1 79 [??g\??????y]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: B2 ED DE 02 AF FE 9F 77 2F BB 3C 91 9A F3 CE 72 [???????w/?<????r]

1w3d: RADIUS: NAS-Port-Type [61] 6 Eth [15]

1w3d: RADIUS: Vendor, Cisco [26] 23

1w3d: RADIUS: cisco-nas-port [2] 17 "FastEthernet0/2"

1w3d: RADIUS: NAS-Port [5] 6 50002

1w3d: RADIUS: State [24] 18

1w3d: RADIUS: 63 54 DA 66 64 5E C3 E0 F5 89 40 0D 9A B2 01 A8 [cT?fd^????@?????]

1w3d: RADIUS: NAS-IP-Address [4] 6 10.1.1.102

1w3d: RADIUS: Received from id 1645/235 10.1.3.7:1812, Access-Accept, len 186

1w3d: RADIUS: authenticator 46 4B 53 12 99 7A F4 76 - 96 53 79 07 62 FA FE 5E

1w3d: RADIUS: Tunnel-Type [64] 6 00:VLAN [13]

1w3d: RADIUS: Tunnel-Medium-Type [65] 6 00:ALL_802 [6]

1w3d: RADIUS: Tunnel-Private-Group[81] 5 "741"

1w3d: RADIUS: User-Name [1] 9 "testuser"

1w3d: RADIUS: Vendor, Microsoft [26] 58

1w3d: RADIUS: MS-MPPE-Recv-Key [17] 52 *

1w3d: RADIUS: Vendor, Microsoft [26] 58

1w3d: RADIUS: MS-MPPE-Send-Key [16] 52 *

1w3d: RADIUS: EAP-Message [79] 6

1w3d: RADIUS: 03 0A 00 04 [????]

1w3d: RADIUS: Message-Authenticato[80] 18

1w3d: RADIUS: B6 BE D0 BE 54 B5 B8 9B 6F 06 D7 A2 7F A7 47 2A [????T???o?????G*]

1w3d: RADIUS(00000078): Received from id 1645/235

1w3d: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes

1w3d: %DOT1X_SWITCH-5-ERR_ADDING_ADDRESS: Unable to add address 0024.5442.8604 on Fa0/2

1w3d: dot1x-err:Failed to add 0024.5442.8604:741 on FastEthernet0/2

The debug from a C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA14, RELEASE SOFTWARE (fc1) switch has a bit more information

RADIUS: EAP-login: length of eap packet = 4

3d03h: RADIUS: Tunnel-MType, [00] 00 00 06

3d03h: RADIUS: tag='00', consider the attribute untagged.

3d03h: RADIUS: TAS(0) created and enqueued.

3d03h: RADIUS: Tunnel-Type, [00] 00 00 0D

3d03h: RADIUS: Tunnel-GID, [00] 741

3d03h: RADIUS: unrecognized Microsoft VSA type 17

3d03h: RADIUS: unrecognized Microsoft VSA type 16

3d03h: RADIUS: TAS(0) takes precedence over tagged attributes,

tunnel_type=13

3d03h: RADIUS: free TAS(0)

3d03h: RADIUS: no appropriate authorization type for user.

Radius debug log snippet shows access-accept:

Waking up in 3.3 seconds.

rad_recv: Access-Request packet from host 10.1.1.102 port 1645, id=226, length=201

User-Name = "testuser"

Service-Type = Framed-User

Framed-MTU = 1500

Called-Station-Id = "00-1E-49-99-B5-82"

Calling-Station-Id = "00-24-54-42-86-04"

EAP-Message = 0x020a002b19001703010020587590e237130c060446fb11d376500910b601cfb2d3605a71d4bec6d645517e

Message-Authenticator = 0xd3bfd6a24de22e93aa9e5f2f7819c864

NAS-Port-Type = Ethernet

Cisco-NAS-Port = "FastEthernet0/2"

NAS-Port = 50002

State = 0x51984bf05692527dab89cb2cb6f3d522

NAS-IP-Address = 10.1.1.102

server packetfence {

# Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence

+- entering group authorize {...}

[suffix] No '@' in User-Name = "testuser", looking up realm NULL

[suffix] No such realm "NULL"

++[suffix] returns noop

++[preprocess] returns ok

[eap] EAP packet type response id 10 length 43

[eap] Continuing tunnel setup.

++[eap] returns ok

Found Auth-Type = EAP

# Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence

+- entering group authenticate {...}

[eap] Request found, released from the list

[eap] EAP/peap

[eap] processing type peap

[peap] processing EAP-TLS

[peap] eaptls_verify returned 7

[peap] Done initial handshake

[peap] eaptls_process returned 7

[peap] EAPTLS_OK

[peap] Session established. Decoding tunneled attributes.

[peap] Peap state send tlv success

[peap] Received EAP-TLV response.

[peap] Success

[peap] Using saved attributes from the original Access-Accept

Tunnel-Type:0 = VLAN

Tunnel-Medium-Type:0 = IEEE-802

Tunnel-Private-Group-Id:0 = "741"

User-Name = "testuser"

[eap] Freeing handler

++[eap] returns ok

# Executing section post-auth from file /usr/local/pf/raddb/sites-enabled/packetfence

+- entering group post-auth {...}

++[exec] returns noop

++? if (!EAP-Type || (EAP-Type != 21 && EAP-Type != 25))

? Evaluating !(EAP-Type ) -> FALSE

?? Evaluating (EAP-Type != 21 ) -> TRUE

?? Evaluating (EAP-Type != 25) -> FALSE

++? if (!EAP-Type || (EAP-Type != 21 && EAP-Type != 25)) -> FALSE

} # server packetfence

Sending Access-Accept of id 226 to 10.1.1.102 port 1645

Tunnel-Type:0 = VLAN

Tunnel-Medium-Type:0 = IEEE-802

Tunnel-Private-Group-Id:0 = "741"

User-Name = "testuser"

MS-MPPE-Recv-Key = 0x88954e0d97ca1d4d422b5fe0d4b4a234a1a567434f2db150989a4aacf3e437d2

MS-MPPE-Send-Key = 0xc1fdbace83664c4dcc168841a6a0cb9041de1333ce72d6dd2cbf8430a9a47070

EAP-Message = 0x030a0004

Message-Authenticator = 0x00000000000000000000000000000000

Finished request 191.

Going to the next request

Waking up in 1.8 seconds.

Cleaning up request 190 ID 225 with timestamp +5281

Waking up in 3.1 seconds.

Cleaning up request 191 ID 226 with timestamp +5285

Ready to process requests.

I appreciate that's not the full debug log for the 2950, nor the radius server. These are available if anyone needs them.

Can anyone please help shed some light on this?

dot1x authorization failing

AndiMorris — Thu, 12 Dec 2013 12:21:37 GMT

2960 switch config:

Current configuration : 3328 bytes

version 12.2

no service pad

service timestamps debug uptime

service timestamps log uptime

service password-encryption

hostname llHswA105

enable secret 5 blahblah

aaa new-model

aaa group server radius packetfence

server 10.1.3.7 auth-port 1812 acct-port 1813

aaa authentication login default local

aaa authentication login MyVTY line

aaa authentication login MyCon none

aaa authentication dot1x default group packetfence

aaa authorization network default group packetfence

aaa session-id common

system mtu routing 1500

ip subnet-zero

no ip domain-lookup

ip name-server 193.62.96.6

dot1x system-auth-control

dot1x guest-vlan supplicant

no file verify auto

spanning-tree mode pvst

spanning-tree extend system-id

vlan internal allocation policy ascending

interface FastEthernet0/1

description Link from PG

switchport mode trunk

speed 10

duplex full

interface FastEthernet0/2

description Andi test

switchport mode access

dot1x pae authenticator

dot1x port-control auto

dot1x host-mode multi-host

dot1x timeout quiet-period 3

dot1x timeout tx-period 15

dot1x timeout supp-timeout 10

dot1x reauthentication

dot1x guest-vlan 798

spanning-tree portfast

interface FastEthernet0/3

description Sean Desk

switchport access vlan 720

switchport mode access

interface FastEthernet0/4

interface FastEthernet0/5

switchport access vlan 712

switchport mode access

spanning-tree portfast

interface FastEthernet0/6

description pfencehalls02

switchport mode trunk

interface FastEthernet0/7

description pfencehalls01

switchport mode trunk

interface FastEthernet0/8

description Sean

switchport access vlan 720

switchport mode access

interface GigabitEthernet0/1

switchport mode trunk

spanning-tree portfast

interface Vlan1

ip address 10.1.1.102 255.255.255.0

no ip route-cache

ip default-gateway 10.1.1.2

ip http server

logging trap warnings

logging 192.168.1.12

access-list 10 permit 10.1.3.8

access-list 10 permit 10.1.3.9

access-list 10 permit 10.1.1.2

access-list 10 permit 192.168.110.13

access-list 10 permit 192.168.1.9

access-list 10 permit 192.168.1.10

access-list 10 permit 192.168.1.12

access-list 10 permit 10.100.3.10

access-list 10 permit 192.168.199.199

access-list 10 permit 192.168.6.18

access-list 10 permit 193.62.103.18

access-list 10 permit 193.62.96.3

access-list 10 permit 192.168.199.5

access-list 10 permit 192.168.199.4

access-list 10 permit 192.168.199.2

access-list 10 permit 193.62.103.42

access-list 10 permit 10.1.1.199

access-list 10 deny any log

snmp-server community blah RO 10

snmp-server community bleh RW 10

snmp-server location LL A105

snmp-server contact Helpdesk extn. 7000

snmp-server enable traps port-security

snmp-server enable traps port-security trap-rate 1

snmp-server host 192.168.1.10 public-uwic config vlan-membership snmp

radius-server host 10.1.3.7 auth-port 1812 acct-port 1813 timeout 2 key 7 bleeee

radius-server source-ports 1645-1646

radius-server deadtime 1

radius-server vsa send authentication

control-plane

line con 0

line vty 0 4

access-class 10 in

password 7 moo

line vty 5 15

session-timeout 30

access-class 10 in

password 7 baaa

ntp server 192.168.1.10

end

dot1x authorization failing

AndiMorris — Mon, 16 Dec 2013 14:08:06 GMT

It looks like this might be happening on the wireless side of things as well, although it's less apparent for the end user, which is why we hadn't heard about it until now.

Has anybody any idea where I can start looking?

dot1x authorization failing

AndiMorris — Mon, 16 Dec 2013 15:16:27 GMT

It actually seems to be related to the time of day, in correlation to how busy the network is.

dot1x authorization failing

AndiMorris — Thu, 02 Jan 2014 10:36:22 GMT

Nobody has any idea? This is a shame.

The problem seems to have disappeared over Christmas as the network has quietened down dramatically. I'd still really like to find the solution before everyone starts back again.