ACS 5.2 EAP-TLS Machine Authentication

[Roger Alderman]

Hi All

I have set up an ACS (5.2) to do EAP-TLS Machine and User Authentication.

I am getting intermittent results with the machine authentication using the same laptop as a test client.

When the machine authentication succeeds the RADIUS name shows as host/xxx-yyy.

When the machine authentication fails the RADIUS name shows as xxx-yyy without the host/.

Anybody have any ideas why this is happening?

Regards

Roger

[Scott Fella]

When you are testing, are you rebooting the machine?

Thanks,

Scott Fella

Sent from my iPhone

[Roger Alderman]

Hi Scott

I have rebooted the machine yes. However, you don't need to go that far. It's sufficient to simply log-off the user and the machine authentication will kick in again. That's standard practice.

[Scott Fella]

Just wondering when it fails. When it is rebooted or when logging off and logging on.

Thanks,

Scott Fella

Sent from my iPhone

[Roger Alderman]

Scott

It appears to be random.

It will fail and then a few minutes later it will pass.

The only discrepancy I can see is the RADIUS name but I don't see how this would change so it may be a red herring!

Roger

[Scott Fella]

If your using windows 7, did you just specify computer, not user or computer.

Thanks,

Scott Fella

Sent from my iPhone

[Roger Alderman]

It is Windows 7. We've specified 'computer or user' since we want to use machine and user authentication.

[Scott Fella]

It's machine OR user not both.

Thanks,

Scott Fella

Sent from my iPhone

[Roger Alderman]

What are you saying? That you can't have both machine and user EAP-TLS authentication?

This has always worked with XP and I've got it working with Windows 7 if I set the client to 'computer or user'.

It just seems to be a bit flaky on the machine authentication.

Roger

[Scott Fella]

I was thinking you were ysing PEAP.  Well it seems like the issue is with the client not sending the host/ which ACS is looking for,