10-26-2009 08:34 AM - edited 03-06-2019 08:18 AM
Dear Colleagues,
I am currently encountering an issue which does not seem to make sense to me and hence checking if anyone of you have come across the same or can provide further input on how to proceed...
Setup :
1. Radius Server - Cisco ACS 1113 Engine
2. Authenticator - Cisco 6509 Switch
3. Supplicant - Windows XP SP2/3
Problem:
1. Supplicants fail to authenticate using EAP-TLS as the authentication method.
Errors Seen:
1. Cisco ACS Reports - Authen session timed out: Supplicant did not respond to ACS correctly. Check supplicant configuration.
2. Cisco Switch Reports - dot1x-err(Gi3/39): Invalid Eapol packet length = 1490
3. Supplicant Reports when Trace enabled in the RASTLS file - â>> Received Failure (Code: 4) packet: Id: 8, Length: 4, Type: 0, TLS blob length: 0. Flags:â and âCode 4 unexpected in state SentFinishedâ
Other Information:
1. Wireless Clients using the windows supplicant and EAP-TLS connect without any issue.
2. ACS has certificates issued by 3rd Party Root CA - Geotrust.
3. Clients have Certs issued by clients own CA infrastructure.
4. ACS has the clients Root CA cert in the trust list and hence why the wireless users work.
5. PEAP works fine on wired.
Any pointers appreciated. Happy to share logs from Switch / Supplicant and ACS if needed.
Thanks
Volven
10-27-2009 06:01 PM
Hi,
A failure code 4 indicates that, the radius server receives a accounting request on a autentication port. By RFC all accounting request should go to port 1812 and accounting request should go to 1813.
10-27-2009 06:13 PM
Hello Dheeraj, that does not seem to be the case, as the radius configs are set on the Switch and not on the end points.
A quick update to my situation though....
1. Windows XP Supplicant connected behind a Cisco IP Phone does not work with EAP-TLS (Certificates) but works fine when PEAP is used at the Auth method.
2. Windows XP Supplicant connected without the IP Phone on the same port works fine with EAP-TLS.
3. Juniper Supplicant connected behind a Cisco IP Phone works fine with EAP-TLS>
4. The error seen on the switch when EAP-TLS authentication is attempted by windows supplicant while connected behind the IP Phone - âdot1x-err (port number of the switch) : Invalid EAPOL packet length = 1490
Seems to me like an MTU issue, however not sure how to address that...
Thanks
Volven
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide