cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
933
Views
0
Helpful
1
Replies

Webauth Failed Over

fouzan.work
Level 1
Level 1

I'm attempting to use webauth as a fallback method for 802.1x for wired clients. I've configured the switchport as recommened in the documentation. Here's the snipped for the interface:

interface FastEthernet0/4

switchport access vlan 141

switchport mode access

authentication order dot1x webauth

authentication port-control auto

authentication fallback PROFILE-WEBAUTH

dot1x pae authenticator

dot1x timeout tx-period 5

end

The debugs seem to show that webauth fails over too quickly for it to be effective. Any ideas why this may be the case? Thanks.

Aug  9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

AHQSWTC02#

A

Aug  9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

Aug  9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B

AHQSWTC02#

A

1 Reply 1

Nicolas Darchis
Cisco Employee
Cisco Employee

if my memory serves me well, you configure "dot1x timeout tx-period 5". So it means that the switch will send dot1x probes every 5 seconds, 3 times.

So after 15 seconds,it declares there is no dot1x capable laptop and it fails over.

I would suggest to increase the amount of dot1x retries or to increase the tx period.