Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About isaaco001
08-07-2019
Stats
Member since
05-06-2016
116
Posts
0
Helpful
1
Solution
07-23-2019
04:18 AM
Hi Reza, The links from ISP are the internet facing links. I have layer 3 switches i.e 3560's. I have seen a situation where the wan aggregation switch is segmented with vlans then traffic redirected to firewall,thats what i want to learn, why they do that. Thanks for your response. Regards, Isaac.
... View more
07-22-2019
12:19 PM
Dear community, I have two ISP wan connections that need to terminate in a layer three switch. How can i use vlans to separate the connections terminating in the wan switch? I have i firewall that needs to be connected to this wan switch. How can i design this?what vlans do i need to create and how do I route them to the firewall? Any example of deployment in this scenario would be helpful. Thanks Isaac.
... View more
Labels:
03-19-2019
11:31 AM
hi Mike,
Thanks for the response. I basically followed the guides by enabling wiredautoconfig from services.msc and disabled certificate validation as required for dot1x without CA's.I will update you guys tomorrow when i implement the recommendations.
I really appreciate,thanks.
... View more
03-19-2019
08:52 AM
Hi Sheraz,
Thanks for the prompt response! I will implement the recommended changes tomorrow. Please note that i was bouncing the interface at some point to force dot1x process and in this test i was just doing dot1x peap authentication only.i meant i had tried mab authentication separately but i didnt succeed.
Thanks once again!
Regards,
Isaac.
... View more
03-19-2019
06:30 AM
Hi all,
I have been struggling to find out why a test pc client can't authenticate with dot1x or mab. I have collected debug dot1x all and show run config file of the switch. Can anybody please assist in why client cant authenticate. when i do test aaa group radius xxxxx xxxx legacy on the switch all is well,but when i do it on client side it just fails.
Thank you all!
... View more
Labels:
03-15-2019
07:57 AM
Hi,
Please find more debugs from todays tshooting. Thanks.
SW1# *Jan 2 03:03:18.387: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A *Jan 2 03:03:18.387: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A *Jan 2 03:03:18.387: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A *Jan 2 03:03:18.387: %AUTHMGR-7-NOM SW1#OREMETHODS: Exhausted all authentication methods for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A *Jan 2 03:03:18.387: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A SW1# *Jan 2 03:04:06.999: %AUTHMGR-5-START: Starting 'dot1x' for client (0022.64b3.0b38) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A SW1#test aaa group radisu us j Joseph @i Winter2019 ke legacy Attempting authentication test to server-group radius using radius User was successfully authenticated.
SW1# *Jan 2 03:04:50.905: RADIUS: Pick NAS IP for u=0x593D66C tableid=0 cfg_addr=0.0.0.0 *Jan 2 03:04:50.905: RADIUS(00000000): Config NAS IPv6: :: *Jan 2 03:04:50.905: RADIUS: ustruct sharecount=1 *Jan 2 03:04:50.905: Radius: radius_port_info() success=0 radius_nas_port=1 *Jan 2 03:04:50.905: RADIUS/ENCODE: Best Local IP-Address 192.168.159.2 for Radius-Server 192.168.159.145 *Jan 2 03:04:50.905: RADIUS(00000000): Send Access-Requ SW1#est to 192.168.159.145:1645 id 1645/6, len 58 *Jan 2 03:04:50.905: RADIUS: authenticator FD 02 72 DE 6F 30 CD 7A - C1 2C 09 6A B0 2D 02 9E *Jan 2 03:04:50.905: RADIUS: NAS-IP-Address [4] 6 192.168.159.2 *Jan 2 03:04:50.905: RADIUS: NAS-Port-Type [61] 6 Async [0] *Jan 2 03:04:50.905: RADIUS: User-Name [1] 8 "Joseph" *Jan 2 03:04:50.905: RADIUS: User-Password [2] 18 * *Jan 2 03:04:50.905: RADIUS(00000000): Sending a IP SW1#v4 Radius Packet *Jan 2 03:04:50.905: RADIUS(00000000): Started 5 sec timeout *Jan 2 03:04:50.972: RADIUS: Received from id 1645/6 192.168.159.145:1645, Access-Accept, len 122 *Jan 2 03:04:50.972: RADIUS: authenticator F1 D9 34 78 8E DE 1A 14 - 96 23 04 67 EA 4A D3 8A *Jan 2 03:04:50.972: RADIUS: User-Name [1] 8 "Joseph" *Jan 2 03:04:50.972: RADIUS: State [24] 40 *Jan 2 03:04:50.972: RADIUS: 52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 63 30 [ReauthSession:c0] SW1# *Jan 2 03:04:50.972: RADIUS: 61 38 39 66 39 31 30 30 30 30 30 30 30 35 35 43 [a89f91000000055C] *Jan 2 03:04:50.972: RADIUS: 38 42 42 37 46 32 [ 8BB7F2] *Jan 2 03:04:50.972: RADIUS: Class [25] 48 *Jan 2 03:04:50.972: RADIUS: 43 41 43 53 3A 63 30 61 38 39 66 39 31 30 30 30 [CACS:c0a89f91000] *Jan 2 03:04:50.972: RADIUS: 30 30 30 30 35 35 43 38 42 42 37 46 32 3A 49 53 [000055C8BB7F2:IS] *Jan 2 03:04:50.972: RADIUS: 45 31 2F 33 34 32 30 30 33 38 35 33 2F SW1#36 [ E1/342003853/6] *Jan 2 03:04:50.972: RADIUS: Termination-Action [29] 6 1 *Jan 2 03:04:50.980: RADIUS: saved authorization data for user 593D66C at 593AC94 SW1# *Jan 2 03:05:32.429: %DOT1X-5-FAIL: Authentication failed for client (0022.64b3.0b38) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A *Jan 2 03:05:32.429: %AUTHMGR-7-RESULT: Authentication result 'fail' from 'dot1x' for client (0022.64b3.0b38) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A SW1# *Jan 2 03:05:32.429: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (0022.64b3.0b38) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A SW1# *Jan 2 03:08:05.068: %DOT1X-5-FAIL: Authentication failed for client (0022.64b3.0b38) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A SW1# *Jan 2 03:08:05.068: %AUTHMGR-7-RESULT: Authentication result 'timeout' from 'dot1x' for client (0022.64b3.0b38) on Interface Fa0/3 AuditSessionID C0A80A010000002700A1FF8A SW1# *Jan 2 03:09:38.005: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:09:38.005: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:09:38.005: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:09:38.005: %AUTHMGR-7-NOM SW1#OREMETHODS: Exhausted all authentication methods for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:09:38.005: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB SW1# *Jan 2 03:12:10.661: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:12:10.661: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:12:10.661: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:12:10.661: %AUTHMGR-7-NOM SW1#OREMETHODS: Exhausted all authentication methods for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:12:10.661: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB SW1# *Jan 2 03:14:43.988: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:14:43.988: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:14:43.988: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Fa0/3 AuditSessionID C0A80A010000002800AC74FB *Jan 2 03:14:43.988: %AUTHMGR-7-NOM
... View more
03-14-2019
05:50 AM
Hi Idanny,
Thanks for your response. I have taken snapshots of the detail column. Its a fresh installation and am just beginning to use ise so i didn't set any authentication policy on ise.
... View more
03-14-2019
05:31 AM
Hi Damien,
Thanks for the quick response! from ISE side i didn't see much in the operations>live authentication section just old authentication failures. I hope am checking the right place. Here is snapshot attached.
... View more
03-14-2019
05:27 AM
Hi Balaji,
Firstly,thanks for the prompt response. I have captured logs from switch(please find attached). Kindly, clarify which device i am checking for ports 1812/1813 and if its switch how will i check this. I have check form ISE GUI ,operations>live authentication(is this the correct place?), there is much there just old authentication failure.
Just to clarify f0/1 is connected to my laptop where ise is running, f0/3 is connected to test pc.
i come across this lines in the logs,does it mean dot1x is not enabled on test pc?
Jan 2 04:47:38.428: AUTH-FEAT-CRITICAL-EVENT (Fa0/3) Critcal authc fail, mac a0d3.c19c.5956, auth_event 2 *Jan 2 04:47:38.428: AUTH-FEAT-CRITICAL-EVENT (Fa0/3) Critical auth not applicable. Feature is not enabled
Thanks once more!
... View more
03-14-2019
02:15 AM
Hi all,
I have setup ise on vmware and using a real switch for authentication configurations and a test pc. Network device is setup in ise together with mac-address of client however there is authentication failure! i have disabled windows firewall on host and test pc but no success. Kindly advise how i can sort this. Please find the switch configs attached!
Thanks!
... View more
Labels:
03-03-2019
06:46 AM
Hi Marvin,
Firstly, thanks for the reply.
I have continued working on it and made changes to the configuration to make things simpler. I just have two interface now inside and outside,but its essentially the same.
log from monitoring
5
Mar 03 2019
14:35:47
305013
192.168.137.10
32592
192.168.1.1
23
Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:192.168.137.10/32592 dst inside:192.168.1.1/23 denied due to NAT reverse path failure
Packet tracer indicates that there's a nat problem. in this lab, 192.168.137.10 represents "internet".
... View more
03-02-2019
09:42 AM
Hi community,
I have tried this port forwarding for some time now but i cant see why its not working, i have looked at some forums but still i keep getting errors like asymmetric nat. please assist.
am trying to telnet from an outside ip to inside router behind ASA.please find run config attached.
object network R3 nat (Inside-dmz,outside) static interface service tcp telnet telnet
access-group outside_access_in in interface outside
Thank you all!
... View more
Labels:
08-07-2019
Dear community, This concept escapes me. When a guest user connects to a
wired network, what is ISE ...
07-23-2019
Hi Reza, The links from ISP are the internet facing links. I have layer
3 switches i.e 3560's. I hav...
07-22-2019
Dear community, I have two ISP wan connections that need to terminate in
a layer three switch. How c...
03-19-2019
hi Mike, Thanks for the response. I basically followed the guides by
enabling wiredautoconfig from s...
03-19-2019
Hi Sheraz, Thanks for the prompt response! I will implement the
recommended changes tomorrow. Please...
03-19-2019
Hi all, I have been struggling to find out why a test pc client can't
authenticate with dot1x or mab...
03-15-2019
Hi, Please find more debugs from todays tshooting. Thanks. SW1#*Jan 2
03:03:18.387: %DOT1X-5-FAIL: A...
03-14-2019
Hi Idanny, Thanks for your response. I have taken snapshots of the
detail column. Its a fresh instal...
03-14-2019
Hi Damien, Thanks for the quick response! from ISE side i didn't see
much in the operations>live aut...
03-14-2019
Hi Balaji, Firstly,thanks for the prompt response. I have captured logs
from switch(please find atta...
03-14-2019
Hi all, I have setup ise on vmware and using a real switch for
authentication configurations and a t...
Public Statistics
| Date Registered | 05-06-2016 09:53 PM |
| Date Last Visited | 08-07-2019 12:17 AM |
| Total Messages Posted | 116 |
Helpful Votes Given To
