cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
676
Views
0
Helpful
1
Replies

802.1x Authentication Issues

dohogue
Level 1
Level 1

I have a c2969-48PST-L switch running IOS Version 12.2(55) SE. The switch is configured for 802.1x authentication. The radius server is a Cisco ACS 5.2. We are using PEAP and allowing EAP-TLS and EAP-MS-CHAPv2. Windows 7 PCs (HP Elitebooks) are using the "windows" supplicant and configured to 802.1x authentication is enabled using Microsoft Protected EAP (PEAP), we are not validating any certificates and the authentication method is Secured password (EAP-MSCHAP v2). What is occurring every so often is that the PC will fail authentication (intermittently) and the ACS shows the reason as being 5411 EAP session timeout. This is a pretty generic message according to TAC.

The interesting part to me is the Authentication Method showing on the ACS when the authentication fails is simply PEAP. However, when it does not fail the Authenication Method is shown as PEAP (EAP-MSCHAPv2). We have the Cisco TAC looking at the ACS and they are saying the issue is the client not reponding to the request correctly from the switch.

However, I am wondering if the version of IOS softare on the switch maynot be handling the communication to the ACS correctly.

I have wireshark traces of a successful authenication and unsuccessful one. There does seem to be any difference from the client side at all.

Can anyone shed any light on this?

Thanks,

Doug

1 Reply 1

d3mb0y555
Level 1
Level 1

I'm having the exact same issue. Were you able to get any answers from cisco TAC?

Thanks

A.Z.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco