Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently planning to implement 802.1X authentication for all the wired computers at the office where I work at currently.

We have successfully implemented 802.1X authentication with login/password credentials. It authenticates against a RADIUS server. The RADIUS server is a Microsoft IAS.

Alongside the wired network, we have an ARUBA wifi controller which does 802.1X authentication with certificates.

We are wishing to use the same certificates to authenticate wired computers. This just does not seem to work. The problem seems to be at the Cisco switch level. The computer sends the credentials to the switch but the switch just ends the EAP session with an error. The RADIUS server is never contacted.

There my question is the following : do Cisco switches support 802.1X EAP authentication with certificates ? If yes, what are the specifics to this type of setup ?

Thank you in advance for your help,

Antoine

share|improve this question
    
I called Cisco and they said that it shouldn't matter wether it's certificates or login/password. I totally agree but it still does not work... –  Antoine Benkemoun Dec 21 '09 at 7:42

2 Answers 2

up vote 0 down vote accepted

We currently are using 3560g and 2950g switches with MS Network Policy Server. I'm the sysadmin rather than the network admin here so Im not exactly sure of the setup details on the cisco side, but we are definately doing 802.1x EAP with certs and Cisco switches.

In order to do this I needed to add each switch as a valid radius client with a shared secret and then create Network Policies in the NPS server. On the NPS side it checks conditions and constraints (cert) to assign a VLAN tag and activate the port.

share|improve this answer
    
Is Network Policy Server like the newer version of MS IAS ? –  Antoine Benkemoun Dec 21 '09 at 21:06

Yes Cisco switches support the functionality you are looking for.

Can you provide more info?

like:

  • show run
  • show log

(Be careful as it can contain passwords.)

What clients do you use? (some windows versions contains buggy supplicants, but a fix/SP is available)

I am not sure if I can help as I do not use windows on the server side (I use freeradius on linux), but we will see...

share|improve this answer
    
We use Windows XP SP2 & SP3 mostly. I can't test it until a while as I am on holiday until Jan 4th. –  Antoine Benkemoun Dec 27 '09 at 10:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.