topic Re: PEAP User + Machine Authentication in Wireless

PEAP User + Machine Authentication

sreejith_r — Sun, 04 Jul 2021 04:19:19 GMT

Hi ;

I tried PEAP machine and user authentication together with acs 5.3. But if we are selecting only computer authentication in the client side , we are able to connect without even prompting for the username and password.

Is there any way to enforce both authentications.

Best Regards

Sreejith R

PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 14:22:39 GMT

Are you using windows 7... if so, you can, but I know that windows xp only can do user. Also this depends on how you setup your policy in ACS 5.3. Post some screen shots so we can take a look.

Re: PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 14:26:04 GMT

Can you also post screen shots of the failed attempts using the username also.

Sent from Cisco Technical Support iPhone App

PEAP User + Machine Authentication

sreejith_r — Tue, 03 Jan 2012 14:29:44 GMT

I am trying with windows 7. There are three options

1. User or Compuer Authentication: Its working as expected. I can see the both successful authentication in the Logs.

2. User Authentication : Its working as expected. Because of the was machine authenticated attribute the authentications fails.

3. Computer Authentication: Once the computer passed the authentication the client successfully connecting to wireless without the username and password.

i did the following steps

1. Enable machine authentication

2. Enabled MAR with 1 hour

3. Added the computer and user grups in the ACS

4. Added the protocol, External groups & Was machine authenticated in the authorization list.

Please let me know if any changes has to be done or is this the way the machine authentication works.

Best Regards

Sreejith R

PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 14:33:43 GMT

On the client side you need to choose:

1. User or Compuer Authentication

Now can you post a screen shot of your failed attemps in ACS.

PEAP User + Machine Authentication

sreejith_r — Tue, 03 Jan 2012 14:36:50 GMT

This is a customer requirement. We cannot force the client to use only user or computer authentication. The client may try with usre authentication, Computer autnetication & User or compuer authentication.

We need to configure ACS in such a way that only the user or computer authentication will work out.

Sorry, i dont have the screenshots with me.

PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 14:38:42 GMT

I know it works, because I have done that in the past. It must be hwo the policy is configured on ACS.

PEAP User + Machine Authentication

sreejith_r — Tue, 03 Jan 2012 14:41:24 GMT

i didnt see any option in the policy. Could you please share the information on how we need to configure the policy to enforce both the authentications.

PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 14:43:10 GMT

I will try to dig something up, but being able to see the failed logs helps since there are various ways to setup policies.

PEAP User + Machine Authentication

sreejith_r — Tue, 03 Jan 2012 14:49:36 GMT

I will also try to get the logs by tomorrow.

But if you are selecting the computer authentication in the client side you will not see any failed logs in the ACS.

If you are selecting the user authentication in the client side, in the failed logs you will see that the machine was not authenticated.

If you are selecting the user or computer authentication in the client side, then also you will not see any failed logs.

PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 14:55:08 GMT

But if you are selecting the computer authentication in the client side you will not see any failed logs in the ACS.

That is because the policy configured in ACS right now is only working for machine authentication

If you are selecting the user authentication in the client side, in the failed logs you will see that the machine was not authenticated.

This is because the user authentication part is failing or not configured correctly.

If you are selecting the user or computer authentication in the client side, then also you will not see any failed logs.

This is because of the "OR" on the client side. You specify to send both user and machine, but your policy is only looking for machine not user.

PEAP User + Machine Authentication

sreejith_r — Tue, 03 Jan 2012 15:06:59 GMT

No the user authentication is failing beacuse of the was machine authenticated attribute in the policy. If the client is selecting only the user authentication acs will block the access beacuse of the was machine authenticated attribute. If are removing that attribute it will work for user authentication as well.

If we are selecting user or computer authentication , both authentication works. We can see the logs in the acs that both user and machine authentication passed.

What is happening is that since machine authentication happens prior to the user authentication, once the machineauthentication passed acs grants access to the clients without checking any other rules. How we can override this.

Re: PEAP User + Machine Authentication

Scott Fella — Tue, 03 Jan 2012 15:13:55 GMT

Have you tried using AD1:ExternalGroups: "contains all" in your authorization policy and listed specfic AD group and included the computer group.

Re: PEAP User + Machine Authentication

Scott Fella — Wed, 04 Jan 2012 03:23:56 GMT

Okay.... I decided to lab this up and here is how to set this up. After you have set this up, make sure you reboot the client device (Windows 7) so that ACS knows that this device has authenticated using machine authentication. These policies are customizable, so here is the basic that you have to do.

Also note, when you first connect, you will see the machine and user being authenticated, then if you disconnect and reconnect, you will only see the username come through, because it is cached due to the Aging Time you will set in ACS.

Attached is a PDF so hopefully this helps.

PEAP User + Machine Authentication

Scott Fella — Wed, 04 Jan 2012 22:46:09 GMT

Let me know if the doc doesn't help.

PEAP User + Machine Authentication

sreejith_r — Thu, 05 Jan 2012 08:49:12 GMT

i will try with this document by today and will let you know about the status.

Re: PEAP User + Machine Authentication

Scott Fella — Thu, 05 Jan 2012 13:02:37 GMT

Sounds good.

Thanks,

Scott Fella

Sent from my iPhone

Re: PEAP User + Machine Authentication

Scott Fella — Fri, 06 Jan 2012 12:01:21 GMT

Were you able to try it?

Sent from Cisco Technical Support iPhone App

Re: PEAP User + Machine Authentication

Scott Fella — Wed, 11 Jan 2012 12:50:21 GMT

Any update if this worked for you?

Sent from Cisco Technical Support iPhone App

Re: PEAP User + Machine Authentication

sreejith_r — Wed, 11 Jan 2012 13:36:26 GMT

Didn't get any update from the customer. Will update you once i get the feedback from the customer.