topic ACS 5.2 EAP-TLS Machine Authentication in Wireless

ACS 5.2 EAP-TLS Machine Authentication

Roger Alderman — Sun, 04 Jul 2021 04:38:14 GMT

Hi All

I have set up an ACS (5.2) to do EAP-TLS Machine and User Authentication.

I am getting intermittent results with the machine authentication using the same laptop as a test client.

When the machine authentication succeeds the RADIUS name shows as host/xxx-yyy.

When the machine authentication fails the RADIUS name shows as xxx-yyy without the host/.

Anybody have any ideas why this is happening?

Regards

Roger

Re: ACS 5.2 EAP-TLS Machine Authentication

Scott Fella — Wed, 22 Feb 2012 14:11:59 GMT

When you are testing, are you rebooting the machine?

Thanks,

Scott Fella

Sent from my iPhone

ACS 5.2 EAP-TLS Machine Authentication

Roger Alderman — Wed, 22 Feb 2012 14:56:59 GMT

Hi Scott

I have rebooted the machine yes. However, you don't need to go that far. It's sufficient to simply log-off the user and the machine authentication will kick in again. That's standard practice.

Re: ACS 5.2 EAP-TLS Machine Authentication

Scott Fella — Wed, 22 Feb 2012 15:12:29 GMT

Just wondering when it fails. When it is rebooted or when logging off and logging on.

Thanks,

Scott Fella

Sent from my iPhone

ACS 5.2 EAP-TLS Machine Authentication

Roger Alderman — Wed, 22 Feb 2012 15:47:38 GMT

Scott

It appears to be random.

It will fail and then a few minutes later it will pass.

The only discrepancy I can see is the RADIUS name but I don't see how this would change so it may be a red herring!

Roger

Re: ACS 5.2 EAP-TLS Machine Authentication

Scott Fella — Wed, 22 Feb 2012 15:51:59 GMT

If your using windows 7, did you just specify computer, not user or computer.

Thanks,

Scott Fella

Sent from my iPhone

ACS 5.2 EAP-TLS Machine Authentication

Roger Alderman — Wed, 22 Feb 2012 15:58:34 GMT

It is Windows 7. We've specified 'computer or user' since we want to use machine and user authentication.

Re: ACS 5.2 EAP-TLS Machine Authentication

Scott Fella — Wed, 22 Feb 2012 16:11:59 GMT

It's machine OR user not both.

Thanks,

Scott Fella

Sent from my iPhone

ACS 5.2 EAP-TLS Machine Authentication

Roger Alderman — Wed, 22 Feb 2012 16:17:03 GMT

What are you saying? That you can't have both machine and user EAP-TLS authentication?

This has always worked with XP and I've got it working with Windows 7 if I set the client to 'computer or user'.

It just seems to be a bit flaky on the machine authentication.

Roger

ACS 5.2 EAP-TLS Machine Authentication

Scott Fella — Wed, 22 Feb 2012 16:37:36 GMT

I was thinking you were ysing PEAP. Well it seems like the issue is with the client not sending the host/ which ACS is looking for,