Hi Guys, I have successfully implemented 802.1X port authentication in our environment using a Windows 2016 NPS server as the Radius server. I’m happy to say that the configuration is working as expected.   My boss has recently had some complaints from some of the client support team saying that .1X is making their job harder in that they need to add a MAC address of the machine that they are building to AD. he is now asking what the benefit is of Port Authentication and i have explained, however he is looking for stats to back up my claim that .1X is protecting us. Do any of you guys know of any software that can be used to monitor .1X violations? ... View more

Hi Guys, not sure where i should post this but here goes. I have recently installed a new 2960X POE switch in one of our regional offices. I have configured 802.1x port authentication on the client ports but on some ports we have Cisco SBS303 IP phones with client devices connected to the phones. There are 2 VLANs, 16 and 17, 16 being the DATA LAN and 17 being the VOICE LAN. I am now starting to see issues on the phone / PC where the ports are being shutdown due to security violation, see below. Jul 14 16:35:36.119: %DOT1X-5-FAIL: Authentication failed for client (d0d0.fd0b.c8f0) on Interface Gi1/0/21 AuditSessionID AC1310030000000F0001FC03 Jul 14 16:35:36.206: %MAB-5-FAIL: Authentication failed for client (d0d0.fd0b.c8f0) on Interface Gi1/0/21 AuditSessionID AC1310030000000F0001FC03 Jul 14 15:36:48.769: %DOT1X-5-FAIL: Authentication failed for client (d0d0.fd0b.c8f0) on Interface Gi1/0/21 AuditSessionID AC1310030000000F0001FC03 Jul 14 15:36:48.850: %MAB-5-FAIL: Authentication failed for client (d0d0.fd0b.c8f0) on Interface Gi1/0/21 AuditSessionID AC1310030000000F0001FC03 Jul 14 15:37:46.473: %PM-4-ERR_DISABLE: security-violation error detected on Gi1/0/21, putting Gi1/0/21 in err-disable state Jul 14 15:37:46.477: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet1/0/21, new MAC address (34e6.d70e.53c0) is seen.AuditSessionID  Unassigned Jul 14 15:37:47.477: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/21, changed state to down Jul 14 15:37:48.476: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/21, changed state to down the following is the switch config for the port above. interface GigabitEthernet1/0/21  switchport access vlan 16  switchport mode access  switchport voice vlan 17  authentication order dot1x mab webauth  authentication port-control auto  mab  no snmp trap link-status  dot1x pae authenticator  dot1x timeout quiet-period 2  dot1x timeout tx-period 3  spanning-tree portfast  spanning-tree bpduguard enable Any help would be appreciated. ... View more

Hi Guys, hoping that someone has seen this issue before and might be able to help. Equipment used:- ASA5510 Ver 9.1(7)6, 256MB Flash, Total Memory 1024MB, CPU at 19%, 477MB memory used Anyconnect client, anyconnect-win-4.2.01035-k9 Windows 10 Ent We have recently moved from Lync 2010 to Office 2016 that uses Skype For Business, we are now seeing a problem where voice calls are dropped after only 5 seconds, screen sharing seems to work OK as does IM when using our Anyconnect VPN solution. We didn't see any issues with the old Lync 2010 solution. I have narrowed the issue down to the ASA by using an alternative temporary VPN gateway. So far i have not been able to find any solutions so I'm here asking you guys. Cheers. ... View more

Hi Guys, I'm implementing a clientless SSL VPN portal for one of our suppliers, i have configured the relevant bookmarks and tested then successfully and restricted access to other resources. What i would like to do now is remove the help information that appears on the side of the portal, i really don't want to go down the road of creating a whole new customized page to do this so if anyone can help it would be greatly appreciated. Cheers. ... View more

Hi Guys, I'm trying to get Dot1x working on some new 2960X switches running 15.2(2)E3. When I run the "dot1x test eapol-capable" I'm not getting any results in the logging or on the console. I haven't even got to the point of configuring the switch for dot1x authentication yet. I have dot1x setup on the same switch platform in other offices with out any issues the only difference being the software version running on the switches that work, 15.0(2)EX4. Anyone got any ideas? ... View more

I have just installed a new ASA5512 in transparent mode. This is the first time I have done this type of installation and have been having some issues getting remote management to the device. I have configured a BVI interface for management with an IP of 10.252.255.25. The network looks like this...... 172.19.130.5 --- LAN --- Router --- MPLS --- Router 10.252.255.30 ---- ASA Gi0/1 ---- ASAGi0/0 ----- Switch to LAN ---- 10.252.0.0 clients So, from my management workstation on 172.19.130.5 I can ping the router at 10.252.255.30, I can also ping and manage the client machines on the 10.252.0.0 network on the other side of the ASA but I cant manage the ASA on 10.252.255.25. It going to be something I haven't done so any help would be greatly appreciated. Please see config attached. Murray ... View more