PEAP : Machine authentication doesn't work

[alex.alexander]

Hello,

I'm trying to set up machine authentication and at this time I have some problems.

I have the following configuration:

- the users laptop are running WinXP

- the AP is a 1232

- ACS 3.3.2

- external database (Win2000 Active Directory) authentication

I set up PEAP and it works well when a user is authenticated. However when I enable machine authentication on the ACS and also on the user laptop, it doesn't work. In the ACS logs I can see that the user has not authenticated due to the machine access restriction.

On the Active Directory I changed the Dial In config. for the computers to allow access.

Is there anything else that has to be modified in order to perform machine authentication?

Hope someone will be able to help me.

Thanks in advance.

Alex

[bbaley]

Try after disabling peap session resume if it's enabled.

[colin.lynch]

Hi Alex

I have had a similar issue, I found that my PEAP users were fine but Machine authentication failed at the SSL handshake. I.E the machine didn't know where the local certificate was. In the meantime to get the policies working I unchecked the "validate server certificate" on the client. And that works, I would assume that the certificate needs to be in a specific default location for the machine authentication to use it, though thats just a guess.

I am spending the day to get this working and I'll post what I find out.

Regards

Colin

[colin.lynch]

Hi Got machine auth working, by using a policy to specify the certificate to the workstations.

Although the mmc snap-in can also be used.

Regards

Colin

[mhernandez11]

I know this is a dumb response, but i got mine working after a bit of trouble....

seems just like users you need to map the computer group to a group in ACS...(duh), so i mapped all the "domain computers" ad group into my dot1x group and got the machine authentication working (this was for my 802.1x wired project). It should work for wired and wireless though.

[eerten]

Hi,

I had the same problem. I solved it like this:

- In ACS go to Windows User Database Configuration

- "EAP-TLS and PEAP machine authentication name prefix" option, remove "/host" (i.e leave field empty).

- Check "Enable machine access restrictions"

this worked for me.

regards,

Eniz