EAP-FAST, ACS, CSSC, AD password changes

Unanswered Question
Nov 3rd, 2007

We have been using 802.1x machine and user authentication via MS built-in supplicant (PEAP, MSCHAP-v2) and MS IAS (radius) backend on a wired network for about a year.

We recently migrated our 802.1x platform to CSSC 4.2 and ACS 4.1.

I soon discovered that when MS AD informs the user that their password requires changing (after 30 days due to GP), the user happily changes their password, and soon after, CSSC authentication fails. A reboot and subsequent Logon resolves the problem.

It seems CSSC has cached the initial logon details and has not updated itself when the password change took place?

Has anybody else experienced this problem and discovered a solution?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Anonymous (not verified) Wed, 11/07/2007 - 14:27

Does this happen everytime you logon with new password?

toddsandery Wed, 11/07/2007 - 15:11

Well, whenever a password change is required by AD (once every 30 days). ACS then reports "Invalid Protocol Data" when the next 802.1x reauthentication occurs soon after the AD password change. The remote agent log shows the authentication as successful. Rebooting the PC resolves the issue for another 30 days but this is not acceptable.

I'm using ACS 4.1.1.23.p5 CSSC 4.2.0.6187 and CTA 2.1.3.0

Actions

This Discussion

 

 

Trending Topics - Security & Network