xSEOx
asked on
EAP-TLS; Cisco + Microsoft NPS; wired 802.1x
I am in the process of setting up EAP-TLS authentication on my network.
I use cisco 3850's running 16.6.5 IOS XE
Microsoft Server 2016 for Radius / NPS
The question I have is the following:
Radius is configured as follows:
!
radius server NPS
address ipv4 x.x.206.16 auth-port 1812 acct-port 1813
We have a ACL that permits the following:
permit tcp any eq 1812 any
permit udp any any eq radius
permit udp any eq radius any
permit udp any any eq 1813
permit udp any eq 1813 any
permit tcp any any eq 1813
permit tcp any eq 1813 any
However EAP-TLS was not working. After reviewing the logs we found the following entries. UDP from the switch being denied going to the NPS server:
Dec 3 07:48:59:I:list MGMT denied udp x.x.221.139(42599)(Etherne t 5/7 5006.ab22.1e54) -> x.x.206.16(43961), 1 event(s)
Dec 3 07:42:24:I:list MGMT denied udp x.x.221.145(40734)(Etherne t 5/13 9c57.ada7.aa54) -> x.x.206.16(18819), 1 event(s)
Dec 3 07:37:23:I:list MGMT denied udp x.x.221.145(14857)(Etherne t 5/13 9c57.ada7.aa54) -> x.x.206.16(32594), 1 event(s)
If NPS is using 1812 / 1813 why is the switch sending out traffic on random high level UDP ports? What is this traffic being used for? Possibly EAP-TLS packet fragmentation?
I use cisco 3850's running 16.6.5 IOS XE
Microsoft Server 2016 for Radius / NPS
The question I have is the following:
Radius is configured as follows:
!
radius server NPS
address ipv4 x.x.206.16 auth-port 1812 acct-port 1813
We have a ACL that permits the following:
permit tcp any eq 1812 any
permit udp any any eq radius
permit udp any eq radius any
permit udp any any eq 1813
permit udp any eq 1813 any
permit tcp any any eq 1813
permit tcp any eq 1813 any
However EAP-TLS was not working. After reviewing the logs we found the following entries. UDP from the switch being denied going to the NPS server:
Dec 3 07:48:59:I:list MGMT denied udp x.x.221.139(42599)(Etherne
Dec 3 07:42:24:I:list MGMT denied udp x.x.221.145(40734)(Etherne
Dec 3 07:37:23:I:list MGMT denied udp x.x.221.145(14857)(Etherne
If NPS is using 1812 / 1813 why is the switch sending out traffic on random high level UDP ports? What is this traffic being used for? Possibly EAP-TLS packet fragmentation?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
The logs don't show traffic from the switch; they show two different IP addresses, so it's unlikely to be sourced from your switch.