802.1X EAP-TLS Error

[michaelglosker]

Over the past few weeks, I have been working on configuring 802.1x port-based authentication between my Cisco switch (RADIUS Client) and the NPS Server (My DC) using EAP-TLS authentication.

After completing the configuration on both sides following the tutorial provided in this link: Tutorial Link, I noticed that the status of my Ethernet port changed to "Authentication failed." To investigate further, I captured the EAP packets using Wireshark and observed that my computer responded with the identity but received a failure response with "EAP Code Failure 4."

Now, I'm trying to determine which side might be causing the error - the switch or the NPS server. I have referred to several guides, and it seems that the configuration on the NPS server was done correctly, and the CA certificate was imported to the client.

For reference, here is the configuration from the NPS and endpoint side: Configuration Link

Any insights or guidance on resolving this issue would be greatly appreciated.

Best regards,

Michael

[M02@rt37]

Hello @michaelglosker,

Do you check that you have a policy taht matches the conditions for the AUTH. request form the Cisco Switch. Constraints....Conditions....that might prevent successful AUTH.

Also, take a closer look at the Wireshark capture of the EAP packets exchanged between the client abd the NPS server. Analyze the packet flow to identify ant abnormalities/errors in the EAP messages exchanged.

[Aref Alsouqi]

Code failure 4 would mean access rejected which would suggest there is no policy match on the NPS. Could you please share the NPS policies and the endpoints NIC settings for review?

[michaelglosker]

Here is my post including NIC Setting and the NPS policy.

https://learn.microsoft.com/en-us/answers/questions/1318668/eap-tls-authentication-failed

[Aref Alsouqi]

It could be the order of the policies, it could be the policy is not enabled, I think the best place to look at to trying to find out the root cause of this would be the NPS logs on the server, usually the are good enough to point out the issue.

[michaelglosker]

I already tried to view the NPS logs but there is no events of success or failure (even tough that i enabled the logging).

When i tried to capture the traffic is saw that my computer send his identity and get EAP Failure.

[Aref Alsouqi]

Where did you get that capture from? If the NPS is not showing any logs it could be that is not receiving these RADIUS requests?

[michaelglosker]

The picture was captured with Wireshark from my laptop that tries to authenticate, probably the NPS server not receiving the logs but i am trying to understand why i also checked if there is any block from the FW side and there is no any rule that block the communication.

[MHM Cisco World]

You not answer my below Q, so I review your previous comment 
NOW 
the SW enable 802.1x but the issue it stop at EAP-response Identity 
This can from EAP method, the user send method that NOT match the EAP method.
so double check in NPS and user EAP method 

 

[Nancy Saini]

Check if the RADIUS request is reaching the NPS server. Also, check the output of "show authentication session int gig <id> detail" on the Cisco switch.

[michaelglosker]

[MHM Cisco World]

Hi can I know exactly your issue

Thanks 
MHM

[Aref Alsouqi]

Try please to drop the keyword "detail" at the end of the "show authentication" command and share the output for review. You can also enable RADIUS authentication debugs on the switch "debug radius authentication" which should you if the comms with the NPS is working. Another thing you can do from the switch would be to show the aaa server status "show aaa servers" and look at the state lines, if it should show "current UP" it means the switch and the NPS can talk to each other. Finally you can enable the epm logging on the switch which would help you finding out any issue with the dot1x flows. 

[michaelglosker]

[MHM Cisco World]

According to what you new share' and as @Nancy Saini mention' your SW never send request to aaa server.

Share config