Hello everyone. This is my first post so hopefully I will pose the question properly. Currently we have a 3550 running 12.1(20)EA1 and a Cisco Secure ACS 3.2(3) on a Windows 2000 server. I have configured 802.1x authentication using EAP-TLS with certificates and have successfully tested this with Windows computers. I have the switch using Radius (Cisco IOS/PIX) for server type in the ACS.
My boss asked me to configure MAC address security as well on the switch. This is where I am running into problems. On the port with dot1x enabled I first configured switchport port-security. By using the show commands I see that dot1x shows the port as being authenticated, port-security on the interface shows the port being secure-up, and the ACS passed authentications log sees the user as being authenticated. When I unplug the network cable from this port and plug it back in the same is true.
Now when I add the switchport...mac-address sticky command on the previously mentioned interface I see the mac-address of the appropriate machine listed for the correct interface of the running config. Using the show commands I see that dot1x shows the port as being authenticated and port-security on the interface shows the port being secure-up. If I then unplug the network cable from this interface and plug it back in, the light for the port of the switch stays orange. Upon looking at the show commands I see that dot1x continuously reads authenticating (never reads authenticated), port-security reads secure-down, and the ACS passed authentications log has about 50 passed attempts for the user (After 15-30 seconds, 50 more passed authentications appear for the user.)
I looked at the Radius log in the CSRadius folder of ACS and I see that the machine is talking to the ACS but is constantly hit with challenge requests. Now when I go back into the switch and run the no switchport... mac-address sticky command but leave port-security on the port, the port becomes authenticated through dot1x and also becomes secure-up. On the reverse side, if I leave the switchport... mac-address sticky command and remove the dot1x authentication on the port, the port immediately becomes secure-up.
I think I may need to add certain radius attributes for the user, or change the server type for the 3550 to Radius (IETF) in ACS. I have tried a bunch of options in the ACS, and have statcally added the MAC of the computer on the port and the same thing happens. Any information that would help would be greatly appreciated.
