topic Re: PEAP : Machine authentication doesn't work in Wireless

PEAP : Machine authentication doesn't work

alex.alexander — Sun, 04 Jul 2021 17:33:32 GMT

Hello,

I'm trying to set up machine authentication and at this time I have some problems.

I have the following configuration:

- the users laptop are running WinXP

- the AP is a 1232

- ACS 3.3.2

- external database (Win2000 Active Directory) authentication

I set up PEAP and it works well when a user is authenticated. However when I enable machine authentication on the ACS and also on the user laptop, it doesn't work. In the ACS logs I can see that the user has not authenticated due to the machine access restriction.

On the Active Directory I changed the Dial In config. for the computers to allow access.

Is there anything else that has to be modified in order to perform machine authentication?

Hope someone will be able to help me.

Thanks in advance.

Alex

Re: PEAP : Machine authentication doesn't work

bbaley — Fri, 18 Mar 2005 16:50:39 GMT

Try after disabling peap session resume if it's enabled.

Re: PEAP : Machine authentication doesn't work

colin.lynch — Tue, 22 Mar 2005 09:02:02 GMT

Hi Alex

I have had a similar issue, I found that my PEAP users were fine but Machine authentication failed at the SSL handshake. I.E the machine didn't know where the local certificate was. In the meantime to get the policies working I unchecked the "validate server certificate" on the client. And that works, I would assume that the certificate needs to be in a specific default location for the machine authentication to use it, though thats just a guess.

I am spending the day to get this working and I'll post what I find out.

Regards

Colin

Re: PEAP : Machine authentication doesn't work

colin.lynch — Tue, 22 Mar 2005 18:19:39 GMT

Hi Got machine auth working, by using a policy to specify the certificate to the workstations.

Although the mmc snap-in can also be used.

Regards

Colin

Re: PEAP : Machine authentication doesn't work

mhernandez11 — Wed, 25 May 2005 02:10:28 GMT

I know this is a dumb response, but i got mine working after a bit of trouble....

seems just like users you need to map the computer group to a group in ACS...(duh), so i mapped all the "domain computers" ad group into my dot1x group and got the machine authentication working (this was for my 802.1x wired project). It should work for wired and wireless though.

Re: PEAP : Machine authentication doesn't work

eerten — Wed, 15 Jun 2005 13:25:16 GMT

Hi,

I had the same problem. I solved it like this:

- In ACS go to Windows User Database Configuration

- "EAP-TLS and PEAP machine authentication name prefix" option, remove "/host" (i.e leave field empty).

- Check "Enable machine access restrictions"

this worked for me.

regards,

Eniz