MAB authentication on WEBCAM is not working

[manojg694409412]

Hi ,

We have configured a webcam on 3750 switch with authentication  open . Since the device is silent device ,until we ping the webcam which as static IP address the MAC address is not learnt by the switch. Once it learns it the authentication starts and MAB is successfully. 

IF we put the port in closed mode and bounce the interface authentication starts never starts and the Ping also don't work .

My question is if the end point is silent device the switch need to initiate the EAP process as per the cisco doc  ,but i am not seeing EAP packets from the switch until i initiate the ping to the webcam .

Is it normal behavior ? or we have any other ways to overcome the same.

Regards,

Manoj

[Peter Koltl]

MAB process does not include any EAP frames between switch and host. It just waits for the first incoming frame from the host.

[manojg694409412]

Thanks Peter. But the endpoint is not generating any packets when it get connected. Hence there any other way to resolve it . 

 Regards, 

Manoj

[lrojaslo · Accepted solution]

If the endpoint is not learned by MAC address on the switch (per your description, seems to be endpoint behavior), the switch/authenticator won't start EAP communication until it detects that endpoint is plug on the port. 

If this is expected behavior from the endpoint, I don't think there would be a particular way to make it work.

The second way for dot1x to initiate is with EAPoL start, so if the endpoint is able to send an start packet, then switch will reply with Identity-request packet to start dot1x process.