cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
397
Views
0
Helpful
3
Replies

802.1x over Wire + Dynamic VLAN

cashqoo
Level 1
Level 1

Hi,

i am trying 802.1x (peap) over Wire.

equipment

-acs 4.0

-3750 switch w 802.1q trunk

-client windows xp

the problem i am getting is my switchport is getting the desire vlan.

acs - Authen OK

switchport - authorised

vlan - 1 (correct vlan should be '40')

ACS's user have been configured w:

-[64] Tunnel-Type = VLAN

-[65] Tunnel-Medium = 802

-[81] Tunnel-Private-Group-ID = VLAN 40

if i were to configure the switch for

-aaa authorization exec default group tacacs+ group radius

-aaa authorization network default group radius

the ACS fail attempts will show:

EAP-TLS or PEAP authentication failed during SSL handshake

i think i am missing some things

appreciate any advice.

cash

3 Replies 3

Jagdeep Gambhir
Level 10
Level 10

Hi Cash,

SSL handshake error points to certificate issue. On your client make sure that validate server certificate is not checked.

Network connection properties---> Authen TAB--->dot1x properties--->uncheck valid server certs.

Let me know how that goes.

Regards,

~JG

Hi,

Its still not working.

i am getting these logs from ACS:

-Passed Authentications - ok

-Failed Attempts - EAP-TLS or PEAP authentication failed during SSL handshake

-switch - unauthorized

i like to confirm my understanding:

for this whole process, i need only 1 cert, which is for the ACS, am i right?

cash

Cash,

Yes, for peap you need one certs , that too on acs only.

Please Enable Fast Reconnect on Clients and on acs.

System Configuration >Global Authentication Setup > EAP Configuration > check "Enable Fast

Reconnect:" > Submit + Restart

Try to authenticate with both combinations ( with and without fast reconnect) and see if that makes any change.

If issue is still there then get me logs from switch

debug radius

debug dot1x all

debug aaa authentication

Regards,

~JG

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: