22063 Wrong password error with EAP-MD5 for IP Phone authentication

[Marco__89]

Hi all,

i'm struggling with an authentication related problem. I have an IP Phone (Polycom VX201) that connects to a contact center to download its configuration. Inside this config, there is the 802.1X supplicant credentials (username and password). 

I added this credential in the internal user database in ISE (2.7). Between ISE and Polycom there is a cisco catalyst 3850 switch.

When the Ip Phone tries to authenticate, ISE responds with wrong password.

From the contact center i verified that the password is equal withe the respect to the on inserted in ISE. Does someone know where the problem could be?

I also tried to capture the packets. I report below the 2 packets with the MD5 challenges:

1) From Switch to IP Phone

2) From IP Phone to Switch

I thought the problem was that the IP Phone was not receiving the correct password. From the capture of wireshark I therefore wanted to recover the password using the MD5 challenge but I could not. Anyone would know how to do it?

Thanks!

[thomas]

Any chance there was a mis-typed or copy-and-pasted password that accidentally included a space at the beginning or end of the password?  It happens.

[Marco__89 · Accepted solution]

Hi thomas, thanks for the reply.

After some troubleshooting I found that in the provisioning file there were some misconfigured settinges related to the 802.1X. I was not able to solve this problem due to the fact that these options were not described within the Polycom datasheet.