Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

EAP-FAST, ACS, CSSC, AD password changes

We have been using 802.1x machine and user authentication via MS built-in supplicant (PEAP, MSCHAP-v2) and MS IAS (radius) backend on a wired network for about a year.

We recently migrated our 802.1x platform to CSSC 4.2 and ACS 4.1.

I soon discovered that when MS AD informs the user that their password requires changing (after 30 days due to GP), the user happily changes their password, and soon after, CSSC authentication fails. A reboot and subsequent Logon resolves the problem.

It seems CSSC has cached the initial logon details and has not updated itself when the password change took place?

Has anybody else experienced this problem and discovered a solution?


Re: EAP-FAST, ACS, CSSC, AD password changes

Does this happen everytime you logon with new password?

New Member

Re: EAP-FAST, ACS, CSSC, AD password changes

Well, whenever a password change is required by AD (once every 30 days). ACS then reports "Invalid Protocol Data" when the next 802.1x reauthentication occurs soon after the AD password change. The remote agent log shows the authentication as successful. Rebooting the PC resolves the issue for another 30 days but this is not acceptable.

I'm using ACS CSSC and CTA