I'm having hard times configuring wired 802.1x test lab. Everything went ok on the server side, but I'm getting some weird results when it comes to vlan switching: every time a client authenticates it ends up in a "healthy" vlan, meaning that it succeeded to authenticate. When I disable the 802.1x service on a client computer and it cannot authenticate it still moves to vlan 3 although it should be moved to vlan 2.
- NAP server: 192.168.0.10 (it's also a DC)
- Switch: 192.168.0.3
- Client: 192.168.0.100 (static ip)
Policies on NPS: I've ran a wizard to create wired 802.1x policies including the settings concerning VLAN's. My "Compliant" policy has following settings:
Tunnel-Medium-Type: 802 (includes all 802...) Tunnel-Pvt-Group-IP: 3 Tunnel-Type: Virtual LANs (VLAN) Tunnel-Tag: 1 Health policy: Compliant "Noncompliant" policy: Tunnel-Medium-Type: 802 (includes all 802...) Tunnel-Pvt-Group-IP: 2 Tunnel-Type: Virtual LANs (VLAN) Tunnel-Tag: 1 Health policy: Noncompliant "Non NAP-Capable" policy: Tunnel-Medium-Type: 802 (includes all 802...) Tunnel-Pvt-Group-IP: 2 Tunnel-Type: Virtual LANs (VLAN) Tunnel-Tag: 1
In Windows Security Health Validator i've only ticked the "firewall on" box, nothing else.
aaa authentication dot1x default group radius aaa authorization network default group radius authentication mac-move permit ip subnet-zero dot1x system-auth-control vlan internal allocation policy ascending vlan 2 name non-compliant vlan 3 name compliant interface GigabitEthernet2/0/1 //this is the Client interface switchport mode access dot1x pae authenticator spanning-tree portfast interface GigabitEthernet2/0/24 //this is the NAP server interface switchport mode access spanning-tree portfast interface Vlan1 ip address 192.168.0.3 255.255.255.0 no ip route-cache