05-07-2014 06:57 AM - edited 03-10-2019 09:41 PM
I've been using ACS to authenticate client mac addresses on 3750 and 3750x switches for some time (to ensure only known MACs gain access to the network) and everything has been working happily. However, I've just begun rolling out 3850 switches at the edge and I've hit a problem.
Using MAB and dot1x authentication configured on the access ports, the switch attempts to validate the client's mac address against a table held on the RADIUS server (in this case, ACS). Looking on the ACS server, I can see the successful authentication of the MAC address. Also, with Wireshark sniffing the traffic on the uplink from the edge switch, I can see the Radius "Access-Request" go out from the switch and the Radius "Access-Accept" come back from ACS. However, on the switch I get the message "DOT1X-5-FAIL: Authentication failed for client (AAAA.BBBB.CCCC) on Interface Gix/0/x AuditSessionID xxxxxxxxxx"
The client interfaces are configured like this (the same on the 3850s as the 3750s):
interface GigabitEthernetx/0/x
switchport access vlan xx
switchport mode access
authentication control-direction in
authentication event server dead action authorize vlan xx
authentication event server alive action reinitialize
authentication port-control auto
authentication periodic
authentication timer restart 30
authentication timer reauthenticate 14400
mab
dot1x pae authenticator
dot1x timeout tx-period 1
dot1x max-reauth-req 1
spanning-tree portfast
spanning-tree bpduguard enable
I wonder if anyone can shed any light on what's going on here? (and why something that was working perfectly well on 3750s is suddenly not playing ball on 3850s?)
05-07-2014 08:17 AM
Can you post the output from the following command:
show authentication session interface x/x
05-07-2014 10:04 AM
Aren't you missing some commands?
authentication host-mode multi-domain
authentication open (depends on your scenario)
authentication order dot1x mab
authentication priority dot1x mab
Also the dot1x timeout tx-period 1 is a VERY short timer, you will get into problems with that, 5 is a better value in my experience.
05-08-2014 04:34 AM
I seem to have figured my way out of this. The reason for the short dot1x timer is that we are using MAB to authenticate the client MAC, so we actually WANT the dot1x authentication to timeout as quickly as possible for the secondary (MAB) authentication to execute.
I'm also suffering from the age-old problem of interpreting the logic of a config originally implemented by someone else. I'm wondering if all the dot1x commands we have are actually necessary in our situation.
What I have found when comparing new switches to old is that on the 3750s, show authentication sessions for an interface only shows mab as a runnable method, while on the 3850s it lists dot1x, mab and webauth (in that order). Using authentication order mab and authentication priority mab on an interface of the 3850 seems to do the trick. With debug mab turned on you can see the mab authentication working and the switch then allows the interface to pass traffic. Just as importantly, it blocks the port if I try using a client whose MAC is not in the ACS database.
Appreciate your help.
05-08-2014 04:51 AM
Ah, it wasn''t really clear to me if you actually wanted to use dot1x or not. If not then you are absolutely correct, auth order mab/auth prio mab will force the switch to start with, and only do mab authentication. I'm guessing there are some default settings that are different on the 3850 and the 3750, because the functionality should be the same.
05-08-2014 07:15 AM
Thanks for sharing the resolution and glad that you were able to solve the problem (+5 from me). Please mark the thread as closed.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide