Problem with EAP-TLS (802.1X)

[karel.stadler]

Hello,

i'm trying to create a Port-Based Network Access Control using 802.1X. With EAP-MD5 it works fine but if i use EAP-TLS the authentication won't work.

I'm using Windows XP Sp1 as client (supplicant), as authenticator an Catalyst 2950 Switch and the Server is a Windows Server 2003 Std. (IAS as RADIUS)

I sniffed the traffic between the Switch and the Server, there are 4 RADIUS packets and in the last one (it seems to be the packet with the server certificate) it shows me the message "Unreassembled Packet:RADIUS".

What can i do to fix this?

Thanks for help

[drolemc]

We had a similar problem which turned out to be an issue with baby-giant packets. You will need to play with your MTU settings. As far as EAP-TLS dot1x authentication goes, I don't think any issues exist.

[karel.stadler]

Thank you for your help. The MTU game didn't help us much.

Finally the problem was the IOS Version! :-(

For example the Catalyst 3550 supports EAP-TLS since Version 12.1(12c)EA1a. So the problem is solved now.

Hope this helps others to identify EAP-TLS Problems.

best rgds

Karel