HP Printer failing 8021x

[Mike.Cifelli]

Anyone have issues with getting an HP printer to authenticate via 8021x?  Model/Series = HP Laserjet m452nw

ISE failure reason = 12851 Received unexpected EAP NAK message. Client rejected the conversation

ISE expects for regular conversation continuation but client sent outer EAP method NAK message. It means that client rejected conversation for some reason that is unknown to ISE. Known issue: CSSC 5.1.1.10

Verify that the client's supplicant does not have any known compatibility issues and that it is properly configured.

Thanks in advance.

[BigK]

They are many things you can check. 

1- is the mac address of your printer in mab list 

2- does your printer have a native supplicant installed or no supplicant.

3 - what happen if you have authc open on the interface that the printer is connected to?

Thanks

Big K

[Mike.Cifelli]

Sorry this issue is strictly an 8021x error. Mab is irrelevant as that is working as expected. I think the issue is client side.

1- is the mac address of your printer in mab list
Mab is working as expected. This issue is regarding 8021x failure due to the eap-nak error identified above.

2- does your printer have a native supplicant installed or no supplicant.
The printer has a built-in supplicant.

3 - what happen if you have authc open on the interface that the printer is connected to?
The printer can authenticate via Mab onto the SDA fabric with no problems whatsoever.

[Jason Kunst]

please work with HP and Cisco support for debugging

[raffyblindogan · Accepted solution]

It seems that EAP Request and Response, HP rejected the server.

It is possible that both HP and ISE are not using similar EAP type or protocols

Can you please send the whole logs on the ISE which has the EAP conversation.

Also can you send the configuration of your supplicant.

Thanks.

[aportugal1]

Hi, were you able to solve this problem? In the thread does not have the solution. I'm facing the same issue with HP printers not authenticating through 802.1x, only mab.

Thanks for your attention.

[Marcelo Morais]

Hi @aportugal1 ,

 it looks like that the solution is to check the EAP Type: "... It is possible that both HP and ISE are not using similar EAP type or protocols ..."

Hope this helps !!!

[aportugal1]

Hi Marcelo, thank's for your attention. I managed to solve the problem! I needed to import the root and intermediate certificate into the HP printer, then it successfully authenticated by 802.1x. Here's a tip for anyone facing the same problem.

[Giorgos_Mama]

Hi Aportugal1

But were you added the 2 certs?
Certificates->CA Certificate->Configure and repeat the process for both??

[ElXandel]

thanks for the tipp with the pki certs -> after installing them it worked 

[Naive]

Hello Mike, Are we discussing about HP printer not getting authenticated through 802.1Q (Sorry if I misunderstood), As far I know printers are always authenticated through MAB. Under which circumstances we are using printers to authenticate through 802.1Q