Comware

Hello,

trying to get my HP 2524 procurve switches to use 802.1x to dynamically set the vlan on the interfaces. Things seem to be communicating but I am getting the following errors in my Windows 2003 server running IAS:

User Administrator@net.artstest.ualberta.ca was denied access.
Fully-Qualified-User-Name = net.artstest.ualberta.ca/Users/Administrator
NAS-IP-Address = 192.168.1.60
NAS-Identifier = HP ProCurve Switch 2524
Called-Station-Identifier = 00-0a-57-9b-c6-aa
Calling-Station-Identifier = 00-00-39-6d-35-ae
Client-Friendly-Name = test switch
Client-IP-Address = 192.168.1.60
NAS-Port-Type = Ethernet
NAS-Port = 10
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <UNDETERMINED>
Policy-Name = Connections to other access servers
Authentication-Type = EAP
EAP-Type = <UNDETERMINED>
Reason-Code = 66
Reason = The user attempted to use an authentication method that is not enabled on the matching remote access policy.

the switch is configured like this:

aaa authentication port-access eap-radius
radius-server host 192.168.1.50 key testkey
aa port-access authenticator active
</UNDETERMINED></UNDETERMINED>

Hi

You are missing one command that configure the Switch to be an Authenticator for specific ports :

aaa port-access authenticator < port-list > [ control < authorized | auto | unauthorized >]

This command configures the individual ports you want to operate as 802.1X authenticators for point-to-point links to 802.1X-aware clients or switches.

Say you have port 1 connected to this 802.1x client, the command you should add is like this:

2824(config)#aaa port-access authenticator 1 control auto

Good Luck !!!

Thanks Mohieddin. Actually it is in the switch configuration, I just forgot to type it in the question.

After posting I messed around with the setup and I think I know the problem. I don't think the Procurve 2524 switches can do what I want it to do, hopefully someone can prove me wrong. I want to have the Microsoft 802.1x supplicant to auto authenticate to the radius using a Certificate being pushed to my clients, using eap-tls. Switch is setup with eap-radius, but for whatever reasong the remote access policy , Microsoft IAS, will not determine the eap-type.

Configuration on the switch looks to be right. On IAS you mainly need to make sure that 'smart card or other certificate' is selected under your EAP Methods.

Check the IAS logs for some other clues maybe?

Hi

I can prove you that your Setup from the ProCurve side will work for sure.

If you notice that, in the Warning entry you posted:
----------------------------------------
Authentication-Server = <UNDETERMINED>
Policy-Name = Connections to other access servers
Authentication-Type = EAP
EAP-Type = <UNDETERMINED>
----------------------------------------

EAP type is not determined and this is a normal output in the event viewer.

What i think (and 99% sure) that Windows 802.1x supplicant can't do that, and you need another supplicant to do that.

Good Luck !!!
</UNDETERMINED></UNDETERMINED>

Thanks for the input. That EAP-Type = <UNDETERMINED> was giving me some concern, where other postings on other sites had an entry under that EAP-Type.

I was doing some searching and I was going to use another supplicant, probably wpa_supplicant, of if I can get an eval of one of the commercial supplicants.

Will let you know</UNDETERMINED>

Well didn't try supplicant just yet, I think I made some head way on this problem. I noticed in my previous post that the event log was not displaying my Policy name correctly, so I deleted the 2 default remote access policies in IAS and I got a different message, but things look better. Below in the new Event Log and error.

Will keep you updated on this issue.


User Administrator@net.artstest.ualberta.ca was denied access.
Fully-Qualified-User-Name = net.artstest.ualberta.ca/Users/Administrator
NAS-IP-Address = 192.168.1.60
NAS-Identifier = HP ProCurve Switch 2524
Called-Station-Identifier = 00-0a-57-9b-c6-ac
Calling-Station-Identifier = 00-00-39-6d-35-ae
Client-Friendly-Name = test switch
Client-IP-Address = 192.168.1.60
NAS-Port-Type = Ethernet
NAS-Port = 12
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <UNDETERMINED>
Policy-Name = wired_eap-tls
Authentication-Type = EAP
EAP-Type = Smart Card or other certificate
Reason-Code = 16
Reason = Authentication was not successful because an unknown user name or incorrect password was used.</UNDETERMINED>

Managed to get this to work. When you go into the workstations Network interface properties, go into the Authentication tab, Properties of the "smart card or other certificate" EAP type, there is an option "validate Server Certificate". When disabled everything works, but when enabled I get the Reason Code = 16.

Will update when I figure this out.

o.k. this should be the final post to this issue. Found a solution that I have been able to reproduce, with some pain, but still working on it.

To correct the error #16 and the Validate server Certificate issue you need to go through a document called:

Build Guide â Implementing the Wireless LAN Security Infrastructure.pdf

It will walk you through some certificates and how to create them. Url is:
http://www.microsoft.com/technet/security/prodtech/windowsserver2003/pkiwire/BGCH09.mspx?pf=true

Good Luck.