Hi Pros,
I am a newbie in the ACS 4.2 and EAP-TLS implementation, with that being said. I face an issue during a EAP-TLS implementation. My search shows that this kind of error message is already certificate issue;However, I have deleted and recreated the certificate in both ACS and the client with the same result. I have deleted and re-install the certchain as well.
When I check my log in the failed attemps, there is what I found:
Date  | Time | Message-Type | User-Name | Group-Name | Caller-ID | Network Access Profile Name | Authen-Failure-Code | Author-Failure-Code | Author-Data | NAS-Port | NAS-IP-Address | Filter Information | PEAP/EAP-FAST-Clear-Name | EAP Type | EAP Type Name | Reason | Access Device | Network Device Group |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 06/23/2010 | 17:39:51 | Authen failed | 000e.9b6e.e834 | Default Group | 000e.9b6e.e834 | (Default) | EAP-TLS or PEAP authentication failed during SSL handshake | .. | .. | 1101 | 10.111.22.24 | .. | .. | 25 | MS-PEAP | .. | wbr-1121-zozo-test | Office Networ |
| 06/23/2010 | 17:39:50 | Authen failed | groszozo@xxx.com | Default Group | 000e.9b6e.e834 | (Default) | EAP-TLS or PEAP authentication failed during SSL handshake | .. | .. | 1098 | 10.111.22.24 | .. | .. | 25 | MS-PEAP | .. | wbr-1121-zozo-test | Office Network |
groszozo@xxx.com = my windows active directory name
1. Why under EAP-TYPE it shows MS-PEAP not EAP-TLS? I did configure EAP-TLS....
2. Why sometimes it just shows the MAC of the client for username?
3. Why it puts me in DEFAULT-GROUP even though i belongs to a group well definy in the acs?
2. Secondly, When I check in pass authentications... there is what i saw
| Date | Time | Message-Type | User-Name | Group-Name | Caller-ID | NAS-Port | NAS-IP-Address | Network Access Profile Name | Shared RAC | Downloadable ACL | System-Posture-Token | Application-Posture-Token | Reason | EAP Type | EAP Type Name | PEAP/EAP-FAST-Clear-Name | Access Device | Network Device Group |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 06/23/2010 | 17:30:49 | Authen OK | groszozo | NOC Tier 2 | 10.11.10.105 | 1 | 10.111.22.24 | (Default) | .. | .. | .. | .. | .. | .. | .. | .. | wbr-1121-zozo-test | Office Network |
| 06/23/2010 | 17:29:27 | Authen OK | groszozo | NOC Tier 2 | 10.11.10.105 | 1 | 10.111.22.24 | (Default) | .. | .. | .. | .. | .. | .. | .. | .. | wbr-1121-zozo-test | Office Network |
In the output below, it says that the user is authenticate and it puts the user in the right group with the right username, but the user never really authenticate. Maybe for the first few seconds when I initiate the connection.
Before I forget, the suppliant is using WIN XP and 802.1x is enable. I even uncheck not verify the server and the ACS under External User Databases, I did check ENABLE EAP-TLS machine authentication.
Thanks in advance for your help,
Crazy---
