cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

4820
Views
5
Helpful
2
Replies
Chris Samuels
Beginner

MAC authentication with W2K8R2 NPS (radius) & Cisco 4400

On a cisco 4400 I have a wlan set up for only mac filtering through radius using MS NPS.

I have created an AD user account with mac address as username and password. On NPS I created a connection policy and network policy with the latter displayed.

netpol.png

On the client (Win7Pro), i connect to the ssid and it makes the connection as intended and the access entry is logged in the radius log.

The problem is that when I shut the machine down or manually disconnect the ssid I am able to reconnect to it when the machine comes back up or when I reconnected to the ssid. Policy is not executed and no radius entry is logged on the reconnect. What's more, if I disable the network policy so that no connection can be made it is still made regardless of the policy status. The ONLY way to reinitiate the whole process the proper way, i.e. connection via policy, radius logging, etc., is to disable and reenable the wlan on the controller. After this is completed the machine is properly denied access when the NPS network policy is disabled.

In a nutshell, once the machine is authorized to connect is seems to stay connected no matter what the policy status is until the connection to the wlan is disabled. My guess is that the computer is somehow caching the credentials. However, I am hoping it is something I can change on the controller because the devices connecting to this wlan are only trusted via dhcp (mac) reservations; they can be any type of machine with a mac address.

Any help appreciated.

Thank you

1 ACCEPTED SOLUTION

Accepted Solutions
Nicolas Darchis
Cisco Employee

Hi,

a WLC will not reauthenticate a client if it disconnected all of a sudden (=client didn't tell WLC it was disconnecting) and if only a short amount of time passed.

By default, this means that the client has to be not seen for 5 minutes for the client entry to be deleted on the controller. That's the "user idle timeout" on WLC and can be configured to be shorter.

To make sure if this is your problem, disconnect your client and check on "monitor->clients" if you still see the client mac there.

If you don't, then the WLC should ask for authentication again and the problem would be on microsoft side then.

Hope this helps.

Nicolas

===

Don't forget to rate answers that you find useful

View solution in original post

2 REPLIES 2
Nicolas Darchis
Cisco Employee

Hi,

a WLC will not reauthenticate a client if it disconnected all of a sudden (=client didn't tell WLC it was disconnecting) and if only a short amount of time passed.

By default, this means that the client has to be not seen for 5 minutes for the client entry to be deleted on the controller. That's the "user idle timeout" on WLC and can be configured to be shorter.

To make sure if this is your problem, disconnect your client and check on "monitor->clients" if you still see the client mac there.

If you don't, then the WLC should ask for authentication again and the problem would be on microsoft side then.

Hope this helps.

Nicolas

===

Don't forget to rate answers that you find useful

View solution in original post

Thanks for pointing this out. It was right there in front of my face.

thanks again.

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel