Tech or Treat! Write an article about your scariest tech disaster to win gadgets!Learn more


802.1x Authentication on Cisco C2960 & Win2k8 R2

Posted on 2013-11-22
Medium Priority
Last Modified: 2013-12-07
Hello All,

We are trying to setup dynamic vlan assignment based on the user's AD group; the Cisco switch in question is a 2960-S, and it's trying to talk to our NPS server running on Server 2008 R2. We have RADIUS authentication already set up on the switch, as we can authenticate to the switch via telnet using our AD credentials, so we have the initial config right.

Here's our switch config:

aaa new-model
aaa authentication login default group radius local
aaa authentication dot1x default group radius
aaa authorization exec default group radius if-authenticated
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
dot1x system-auth-control
radius-server dead-criteria time 5 tries 10
radius-server host auth-port 1812 acct-port 1813 key psswd
radius-server vsa send authentication

interface GigabitEthernet3/0/11 
 switchport access vlan 12 
 switchport mode access 
 authentication control-direction in 
 authentication port-control auto 
 authentication periodic 
 authentication violation restrict

Open in new window

When Wired Auto Config is enabled on the workstation, we are not assigned any vlan nor prompted for a username/pass.  Instead there's no network connectivity. After enabling debugging on the switch, we get the following:
Received an EAPOL frame
Received pkt saddr =0012.3fc4.2aad , daddr = 0180.c200.0003, pae-ether-type = 888e.0101.0000
dot1x-ev(Gi3/0/11): New client detected, issuing Start Request to AuthMgr
dot1x-ev(Gi3/0/11): Role determination not required
dot1x-packet(Gi3/0/11): queuing an EAPOL pkt on Auth Q
dot1x-ev:Enqueued the eapol packet to the global authenticator queue

Open in new window

The workstation is configured with PEAP, validating our self signed cert from our AD CS server.

We are really stuck, so can anyone give us some tips as to what we are doing wrong? Thanks.
Question by:Robert Davis
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 47

Accepted Solution

Craig Beck earned 1500 total points
ID: 39671351
The port config is slightly incorrect I think.

With 802.1x you don't configure an access port VLAN ID.  If you want to set a VLAN ID you'd configure the fail-auth VLAN ID or the critical VLAN ID.

Also you're not using port-control.

Test using this...

interface GigabitEthernet3/0/11
switchport mode access
authentication port-control auto
dot1x pae authenticator

Open in new window

If you're authenticating machines on a domain it's easier and more secure to use EAP-TLS and certificate auto-enrolment.  You can use PEAP to process the user login after the machine is authenticated if you want, and that will enable you to do cool tricks like put the PC on one VLAN when it boots to get GPOs, etc, then shift the user into a specific VLAN based on security group, for example.

Author Comment

by:Robert Davis
ID: 39675528
We added dot1x pae authenticator and removed the access vlan, which I thought was used for clients that do not support Dot1x, but no change.

LVL 47

Expert Comment

by:Craig Beck
ID: 39675720
Can you debug aaa events on the switch and post the log?

Assisted Solution

by:Robert Davis
Robert Davis earned 0 total points
ID: 39690534
So the switch config was slightly incorrect, and adding dot1x pae authenticator did the trick on the switch. We had to make changes server-side as well. First we had to set up a certificate for the NPS server; then we had to specify that certificate inside of the PEAP properties in the Connection Request Policy that the clients were using to talk to the server.

For anyone that might be interested, this is the link for setting up the NPS Server Cert:
And this talks about VLAN attributes that need to be used in the Network Policy:

Author Closing Comment

by:Robert Davis
ID: 39702882
The expert's comment put us on the right track, but it didn't provide us with the entire solution.

Featured Post

Understanding Web Applications

Without even knowing it, most of us are using web applications on a daily basis. Gmail and Yahoo email, Twitter, Facebook, and eBay are used by most of us daily—and they are web applications. We often confuse these web applications tools for websites.  So, what is the difference?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This program is used to assist in finding and resolving common problems with wireless connections.
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
Internet Business Fax to Email Made Easy - With  eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

648 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question