Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

user auth fails using 802.1x (EAP-TLS)

I'm currently testing 802.1x machine and user authentication using EAP-TLS. Right now I'm testing them separately, and machine auth works great, but user auth doesn't.

Here's what I'm using:

Smart Cards ->

Built-in Microsoft XP supplicant ->

Catalyst 4006 Switch ->

Cisco Secure ACS 3.3 ->

Microsoft Active Directory

After I log in using the smart card, an EAPOL message from the computer is sent to the switch, and the switch replies asking for the computer to identify itself, but the computer does nothing. The switch continues asking and finally gives up because of no response. The ACS server logs no traffic from the supplicant.

Is this a supplicant issue? Using PEAP MSCHAPv2 with secured passwords works fine, but not with certificates.

New Member

Re: user auth fails using 802.1x (EAP-TLS)

I found my answer. The problem was with the Microsoft supplicant. It wasn't prompting me to type in the PIN to unlock the smart card, so it couldn't read the certificate and thus the EAP process was timing out.

In order for the Windows supplicant to prompt the user for the smart card PIN, the "Show icon in notification area when connected" checkbox in the Local Area Connection properties windows must be checked. They may want to think about renaming that box... :-)

CreatePlease to create content