topic Machine Authentication in ACS 5.1 in Wireless

Machine Authentication in ACS 5.1

sreejith_r — Sun, 04 Jul 2021 02:35:48 GMT

Hi;

I am having issues with PEAP + Machine Authentication in ACS 5.1. Without machine authentication peap is working fine. Is something we have to do with the MAR vale .

Please Confirm ?

Re: Machine Authentication in ACS 5.1

Tiago Antunes — Tue, 28 Dec 2010 10:42:30 GMT

Hi,

You will need o be more specific so we can help you.

What exactly is happening/not working?

Please keep in mind that with MAR, the PC needs to do machine authentication prior to user login, as the ACS will only allow users to login from previously authenticated machines.

Is your PC doing machine authentication?

HTH,

Tiag

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Machine Authentication in ACS 5.1

sreejith_r — Tue, 28 Dec 2010 10:47:05 GMT

Sorry. i dont understand HTH & Tiag

Re: Machine Authentication in ACS 5.1

sreejith_r — Tue, 28 Dec 2010 10:50:22 GMT

Thats the main issue. Machine authentication is not happening. These are the configuration steps i did

1. Enabled the Machine Authentication

2. Enable MAR with value 8500 Hrs

3. Enabled Host Lookup

4. In the service set " WAS Machine Authenticated =True" Please add if i missout anything to support machine authentication.

For the authentication i created a group called staff. Does the machine need to be a member of that or it can be in any group under the domain.

Re: Machine Authentication in ACS 5.1

Tiago Antunes — Tue, 28 Dec 2010 10:53:30 GMT

Hi,

HTH = Hope This Helps

Tiag = Tiago which is my name (i missed the 'o').

Re: Machine Authentication in ACS 5.1

Tiago Antunes — Tue, 28 Dec 2010 11:01:10 GMT

Hi,

You need to configure the machine itself to do machine authnetication.

And please note that machine authentication occurs by default only at boot up of the PC.

HTH,

Tiago

Re: Machine Authentication in ACS 5.1

sreejith_r — Tue, 28 Dec 2010 11:04:03 GMT

that i did. i am trying with windows 7 machine. there is an option to select machine or user authentication.

Re: Machine Authentication in ACS 5.1

Tiago Antunes — Tue, 28 Dec 2010 11:16:49 GMT

So, do you see the machine doing authentication?

On the ACS logs do you see the machine host name ons the passed/failed authentications?

HTH,

Tiago

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Machine Authentication in ACS 5.1

sreejith_r — Tue, 28 Dec 2010 11:20:50 GMT

yes. i can see the hostname in the failed attempts.

Re: Machine Authentication in ACS 5.1

Tiago Antunes — Tue, 28 Dec 2010 11:24:47 GMT

Ok, so why is it failing?

Please be aware that machine authentication has to be done against AD.

Do you have the ACS joined to AD and configured the Service Policy to use AD as identity Store to authenticate the machine?

HTH,
Tiago

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: Machine Authentication in ACS 5.1

sreejith_r — Tue, 28 Dec 2010 11:28:13 GMT

i didnt see any specific filed in the acs to use one group for user and one group for laptop. What i did is that moved the machine and the user to a single identity group and mapped it in the access policy.

Re: Machine Authentication in ACS 5.1

Tiago Antunes — Tue, 28 Dec 2010 11:34:11 GMT

What identity store are you using for the machine authentication?

Please be aware that machine authentication has to be done against AD.

Do you have the ACS joined to AD and configured the Service Policy to use AD as identity Store to authenticate the machine?

HTH,

Tiago

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.