08-09-2011 01:18 PM - edited 03-10-2019 06:17 PM
I'm attempting to use webauth as a fallback method for 802.1x for wired clients. I've configured the switchport as recommened in the documentation. Here's the snipped for the interface:
interface FastEthernet0/4
switchport access vlan 141
switchport mode access
authentication order dot1x webauth
authentication port-control auto
authentication fallback PROFILE-WEBAUTH
dot1x pae authenticator
dot1x timeout tx-period 5
end
The debugs seem to show that webauth fails over too quickly for it to be effective. Any ideas why this may be the case? Thanks.
Aug 9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
AHQSWTC02#
A
Aug 9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
AHQSWTC02#
A
08-09-2011 11:50 PM
if my memory serves me well, you configure "dot1x timeout tx-period 5". So it means that the switch will send dot1x probes every 5 seconds, 3 times.
So after 15 seconds,it declares there is no dot1x capable laptop and it fails over.
I would suggest to increase the amount of dot1x retries or to increase the tx period.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide