ACS 5.3 machine authentication error

[eng__mohamed]

i have this error

5411 EAP session timed out

11500 Invalid or unexpected EAP payload received.

when the user power on his machine and the IP phone is already up , i get these errors , the solution of them to diconnect the cable and reconnect the cable again , but this solution is annoying the customer

so kindly advise

[Eduardo Aliaga]

Hello. Please be more specific.

What is your switch configuration ? I'm assuming you're only using Windows XP and Windows 7,  what EAP are you using in your windows ?

Also I guess your Windows PC is behing the ip phones. Are Cisco IP Phones? or other brand?  are you authentication your IP Phones with MAB, EAP-TLS or EAP-MD5 ?

Kind regards

[eng__mohamed]

switch configuration is

aaa new-model

aaa authentication login default local

aaa authentication dot1x default group radius

aaa authorization exec default local

aaa authorization network default group radius

aaa accounting dot1x default start-stop group radius

aaa accounting network default start-stop group radius

aaa accounting system default start-stop group radius

!

dot1x system-auth-control

dot1x critical eapol

ip radius source-interface Vlanxx

radius-server host y.y.y.y key xxxxxxxxxxxxx

interfa config

sh

no  switchport access vlan 4

dot1x pae authenticator

dot1x port-control auto

dot1x host-mode multi-host

dot1x timeout quiet-period 3

dot1x timeout server-timeout 15

dot1x timeout tx-period 15

dot1x guest-vlan 17

dot1x critical vlan 104

no sh

exit

this error with windows 7 and Xp with peap

the ip phone is not authenticated

[gandhi.rifal]

Hello,

I've the same problem. Any solution for this issues?

Thanks,

Gandhi

[Jatin Katyal]

What is the MAR cache timeout configured on ACS. Are end users shutdown their machines at the end of the day or reboot or log off / login after a specified amount of time.

Please share more info about ACS and switch side config.

Jatin Katyal

- Do rate helpful posts -