802.1x Authentication on Cisco C2960 & Win2k8 R2

Posted on 2013-11-22
Medium Priority
Last Modified: 2013-12-07
Hello All,

We are trying to setup dynamic vlan assignment based on the user's AD group; the Cisco switch in question is a 2960-S, and it's trying to talk to our NPS server running on Server 2008 R2. We have RADIUS authentication already set up on the switch, as we can authenticate to the switch via telnet using our AD credentials, so we have the initial config right.

Here's our switch config:

aaa new-model
aaa authentication login default group radius local
aaa authentication dot1x default group radius
aaa authorization exec default group radius if-authenticated
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
dot1x system-auth-control
radius-server dead-criteria time 5 tries 10
radius-server host auth-port 1812 acct-port 1813 key psswd
radius-server vsa send authentication

interface GigabitEthernet3/0/11 
 switchport access vlan 12 
 switchport mode access 
 authentication control-direction in 
 authentication port-control auto 
 authentication periodic 
 authentication violation restrict

Open in new window

When Wired Auto Config is enabled on the workstation, we are not assigned any vlan nor prompted for a username/pass.  Instead there's no network connectivity. After enabling debugging on the switch, we get the following:
Received an EAPOL frame
Received pkt saddr =0012.3fc4.2aad , daddr = 0180.c200.0003, pae-ether-type = 888e.0101.0000
dot1x-ev(Gi3/0/11): New client detected, issuing Start Request to AuthMgr
dot1x-ev(Gi3/0/11): Role determination not required
dot1x-packet(Gi3/0/11): queuing an EAPOL pkt on Auth Q
dot1x-ev:Enqueued the eapol packet to the global authenticator queue

Open in new window

The workstation is configured with PEAP, validating our self signed cert from our AD CS server.

We are really stuck, so can anyone give us some tips as to what we are doing wrong? Thanks.
Question by:Robert Davis
  • 3
  • 2
LVL 47

Accepted Solution

Craig Beck earned 1500 total points
ID: 39671351
The port config is slightly incorrect I think.

With 802.1x you don't configure an access port VLAN ID.  If you want to set a VLAN ID you'd configure the fail-auth VLAN ID or the critical VLAN ID.

Also you're not using port-control.

Test using this...

interface GigabitEthernet3/0/11
switchport mode access
authentication port-control auto
dot1x pae authenticator

Open in new window

If you're authenticating machines on a domain it's easier and more secure to use EAP-TLS and certificate auto-enrolment.  You can use PEAP to process the user login after the machine is authenticated if you want, and that will enable you to do cool tricks like put the PC on one VLAN when it boots to get GPOs, etc, then shift the user into a specific VLAN based on security group, for example.

Author Comment

by:Robert Davis
ID: 39675528
We added dot1x pae authenticator and removed the access vlan, which I thought was used for clients that do not support Dot1x, but no change.

LVL 47

Expert Comment

by:Craig Beck
ID: 39675720
Can you debug aaa events on the switch and post the log?

Assisted Solution

by:Robert Davis
Robert Davis earned 0 total points
ID: 39690534
So the switch config was slightly incorrect, and adding dot1x pae authenticator did the trick on the switch. We had to make changes server-side as well. First we had to set up a certificate for the NPS server; then we had to specify that certificate inside of the PEAP properties in the Connection Request Policy that the clients were using to talk to the server.

For anyone that might be interested, this is the link for setting up the NPS Server Cert: http://technet.microsoft.com/en-us/library/cc754198.aspx
And this talks about VLAN attributes that need to be used in the Network Policy: http://technet.microsoft.com/en-us/library/cc754422%28v=ws.10%29.aspx

Author Closing Comment

by:Robert Davis
ID: 39702882
The expert's comment put us on the right track, but it didn't provide us with the entire solution.

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

755 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question