ACS 5.6 with PEAP-GTC: Unsupported EAP Type?

[Alex Kitaichik]

Hello everybody,

I've ran into strange issue - PEAP-GTC is enabled on my ACS 5.6 box (under "allowed protocols" obviously), but the moment an Android phone is trying to authenticate using it, the phone got rejected and ACS log says: "Extracted EAP-Response/NAK packet requesting to use unsupported EAP protocol; EAP negotiation failed".

Could it be that ACS 5.6 isn't fully supports PEAP-GTC?

[jan.nielsen]

Is GTC the only thing you have in your allowed protocol definition ?

[Alex Kitaichik]

Hello jan.nielsen,

and thank you for replying.

In fact, we have all the protocols allowed. We already successfully got this phone authenticated with many additional EAP flavors. It's just the GTC gives that strange message.

[Alex Kitaichik]

OK, there's an update to that issue which might be helpful for figuring this thing out. I'll post here a question (I've posted on bug toolkit - support forum page) after trying to authenticate to the same ACS 5.6 with PEAP-HTC using Windows 7 PC (instead of the Androd phone) using Cisco's AnyConnect Secure Mobility Client:

CSCty91667 - Can this bug affect ACS 5.6.0.22?

-------------------------------------------------------------------------

Hello everybody,

I ran exactly into behavior described by this bug.

I my case, I'm using ACS 5.6.0.22 newly installed (and therefore almost empty). The only rule is for authenticating a standalone Cisco AP and the only user authenticating is my Windows 7 PC using Cisco's "AnyConnect Mobile Secure Client 3.1.07021'. The user repository is 'local users' and there's only 1 user for testing. I'm using PEAP-GTC.

PEAP-GTC is enabled under 'allowed protocols' and recognized as such in each and every log entry. The error basically goes as following:

...

toward the end

12624 EAP-GTC authentication attempt passed

11519 Prepared EAP-Success for inner EAP method

12314 PEAP inner method finished succesfully

...

12323 PEAP cryptobinding verification failed

12307 PEAP authentication failed

...

What's going on? May CSCty91667 affect ACS 5.6 also?