Hello everyone,
I have an urgent problem with the change of a network devices and kindly ask for support. We have many access stacks (WS-3750-24TS - firmware 12.2 (55) SE), these have been running unchanged since 2011 and are currently to be exchanged for WS-C3850-24T firmware 16.6.7. 802.1X (PEAP, TLS, etc) authentication is not used in the network, ONLY MAB! The clients are dynamically assigned to VLANs using Mac Authentication Bypass. The Radius server is a Microsoft NPS still on Windows 2008 server. Today we brought a 3850 into the running network and tested the authentication whole day without success. The configuration should simply be taken over from the old switches 1:1 (except commands with changed syntax). There appears to be a problem with the communication between the switch and the NPS so that MAB does not appear to be taking place properly and the VLAN is not dynamically assigned.
Here is the old AAA / RADIUS / Port Config of a 3750:
aaa new-model ! aaa authentication login default enable aaa authentication dot1x default group radius aaa authorization network default group radius ! aaa session-id common ! dot1x system-auth-control dot1x guest-vlan supplicant ! interface FastEthernetx/x/x switchport access vlan 100 switchport mode access authentication control-direction in authentication event no-response action authorize vlan 100 authentication port-control auto authentication periodic mab dot1x pae authenticator dot1x timeout quiet-period 5 dot1x timeout tx-period 5 spanning-tree portfast ! radius-server host x.x.x.1 auth-port 1812 acct-port 1813 key 1234 radius-server host x.x.x.2 auth-port 1812 acct-port 1813 key 1234
Here is the AAA / RADIUS / Port Config of a new 3850:
aaa new-model ! ! aaa authentication login default local aaa authentication dot1x default group radius aaa authorization exec default local aaa authorization network default group radius ! aaa session-id common ! dot1x system-auth-control dot1x guest-vlan supplicant ! interface GigabitEthernetx/x/x switchport access vlan 100 switchport mode access authentication control-direction in authentication event no-response action authorize vlan 100 authentication port-control auto authentication periodic mab dot1x pae authenticator dot1x timeout quiet-period 5 dot1x timeout tx-period 5 spanning-tree portfast ! radius server radius1 address ipv4 x.x.x.1 auth-port 1812 acct-port 1813 key 1234 ! radius server radius2 address ipv4 x.x.x.2 auth-port 1812 acct-port 1813 key 1234
*** Different variants of the RADIUS server configuration were tested ... aaa group etc. ***
Authentication works wonderfully with the old 3750 switches, Authz Success and is also recognized as MAB:
This does not work with the new 3850 switches! Method stands for N / A and status stands for "Auth".
The actual result of the authentication is that the PC comes into the VLAN 100 (authentication event no-response action authorize vlan 100) and receives an IP address there, i.e. it is not in its actually assigned VLAN. However, according to the NPS Log, the MAC address stored in the AD is assigned in the correct network policy and thus in the correct VLAN.
The NPS server shows both authentications as completely identical, except that of course the switch name and the switch IP are different!
I would be very happy to receive support because I don't know what to do next. What has changed about the new 3850 that authentication no longer works?
Accepted Solutions
