We help IT Professionals succeed at work.
Get Started

EAP-TLS; Cisco + Microsoft NPS; wired 802.1x

xSEOx
xSEOx asked
on
58 Views
Last Modified: 2020-11-05
I am in the process of setting up EAP-TLS authentication on my network.  
I use cisco 3850's running 16.6.5 IOS XE
Microsoft Server 2016 for Radius / NPS

The question I have is the following:

Radius is configured as follows:
!
radius server NPS
 address ipv4 x.x.206.16 auth-port 1812 acct-port 1813

We have a ACL that permits the following:
permit tcp any eq 1812 any
 permit udp any any eq radius                                    
 permit udp any eq radius any
 permit udp any any eq 1813
 permit udp any eq 1813 any
 permit tcp any any eq 1813
 permit tcp any eq 1813 any

However EAP-TLS was not working.  After reviewing the logs we found the following entries. UDP from the switch being denied going to the NPS server:


Dec  3 07:48:59:I:list MGMT denied udp x.x.221.139(42599)(Ethernet 5/7 5006.ab22.1e54) -> x.x.206.16(43961), 1 event(s)
Dec  3 07:42:24:I:list MGMT denied udp x.x.221.145(40734)(Ethernet 5/13 9c57.ada7.aa54) -> x.x.206.16(18819), 1 event(s)
Dec  3 07:37:23:I:list MGMT denied udp x.x.221.145(14857)(Ethernet 5/13 9c57.ada7.aa54) -> x.x.206.16(32594), 1 event(s)

If NPS is using 1812 / 1813 why is the switch sending out traffic on random high level UDP ports?  What is this traffic being used for?  Possibly EAP-TLS packet fragmentation?
Comment
Watch Question
Commented:
This problem has been solved!
Unlock 1 Answer and 2 Comments.
See Answer
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant

An Experts Exchange subscription includes unlimited access to online courses.

Get Started
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE