Scott, I just found your eventlog on the Cisco site. It says Reason: The Network Access Permission setting in the dial-in properties of the user account in Active Directory is set to Deny access to the user. To change the Network Access Permission setting to either Allow access or Control access through NPS Network Policy, obtain the properties of the user account in Active Directory Users and Computers, click the Dial-in tab, and change Network Access Permission. In Active Directory, please go into the settings of the user object (the user whose name and password are the MAC address), and check if the settings are set to ‘Control access through NPS Network Policy’ (see PDF that I attached to this mail) and make sure that if you use security groups in your NPS network policy, the correct permissions for the security group that this user object belongs to are set correctly). Stefan Von: scottlian Gesendet: Dienstag, 11. Oktober 2011 10:54 An: Moser, Stefan (SIDB) Betreff: - Re: 802.1x MAB with Microsoft NPS ieee802Device object group Cisco Support Community Re: 802.1x MAB with Microsoft NPS ieee802Device object group created by Scott Li in Other Security Subjects - View the full discussion ... View more

Scott, I’ve attached screenshots of my NPS configuration. It’s quite simple, and doesn’t use MD5 (when I was trying to get it running, I read some articles on the web that said that MD5 is not necessary (supported?) because it does not offer additional security because the username always equals the password which is, of course, always the MAC address, and the username is transferred in clear on the wire). Accordingly, in the 3750 config, I enabled MAB without MD5. I can’t see the eventlog from your email, probably because you sent a screenshot. Can you mail plain text or wrap the screenshot into a Microsoft word document or PDF? Stefan Von: scottlian Gesendet: Sonntag, 9. Oktober 2011 03:32 An: Moser, Stefan (SIDB) Betreff: - Re: 802.1x MAB with Microsoft NPS ieee802Device object group Cisco Support Community Re: 802.1x MAB with Microsoft NPS ieee802Device object group created by Scott Li in Other Security Subjects - View the full discussion ... View more

Scott, I’m going to email some examples within the next few days. Stefan Von: scottlian Gesendet: Donnerstag, 29. September 2011 10:02 An: Moser, Stefan (SIDB) Betreff: - Re: 802.1x MAB with Microsoft NPS ieee802Device object group Cisco Support Community Re: 802.1x MAB with Microsoft NPS ieee802Device object group created by Scott Li in Other Security Subjects - View the full discussion ... View more

Update: I got it running in my lab with Active Directory fine-grained password policies. Steps required: 1.) Raise functional domain level to Windows 2008 2.) Follow the step-by-step guide http://technet.microsoft.com/en-us/library/cc770842(WS.10).aspx to create a PSO which does NOT have complex password settings 3.) Create an OU, e.g. "myMABDevices", so that 802.1X devices do not appear in the regular list of domain user accounts (some administrators may do not like to see hundreds of MAC addresses among their domain user accounts) 4.) Create a regular group, e.g. "allMABDevices", and link the PSO to this group. This is described in the step-by-step guide, Microsoft calls it a "shaddow group". It is necessary because PSOs can't be bound to OUs directly. 5.) Create user accounts (not computer accounts) for every 802.1X device (username = MAC address, password = MAC address). I had to do an intermediate step and had to assign a temporary, complex password because when you create the user account, it is not yet in the corresponding regular group "allMABDevices", so the default domain policy is applied at this moment. There may be ways to circumvent this, but this is out of my scope (I'm a network engineer, not an AD specialist). If you are not able to raise to Windows 2008 functional domain level, you may consider the use of password filters (passfilt.dll). There are commercial password filters (e.g. nFront, ANIXIS PPE) that might work. You will probably have to shift all domain user accounts under their control, that will probably lead to heavy discussions with your Active Directory colleagues. As this is out of my current scope of work, I'm not going to have a closer look to it at the moment. Stefan ... View more

Update: I opened an official case with Microsoft Support. They worked out that the ieee802Device class can NOT be used with NPS/IAS, because the class does not contain a username attribute. The existence of the username attribute is required by NPS/IAS. This means: The Cisco document leads to the wrong direction! Proposed solution for the problem: Use fine grained password policies (unfortunately, this is only possible if the domain is Windows 2008 level), and lower password policy for accounts that represent devices (MAC adresses). Stefan ... View more

michagar, >> but the problem would more then likely reside on the MSFT side ? well, of course, you´re right, but ... :-) As a Cisco client, it would be very helpful to me if my switch vendor gave me some help to deal with a *scenario* that is very, very common with SMB companies that consider to add 802.1x in their existing infrastructure. These customers usually have Cisco switches and Microsoft AD (Windows Server 2003 or 2008) are not willing to pay the extra cost for buying Cisco ACS do not want to use any additional free software as, e.g., FreeRADIUS expect us to “do it” with Microsoft built-in tools Stefan ... View more