Identity and Policy Control
Reply
Contributor
eng_mahmood48@yahoo.com
Posts: 58
Registered: ‎06-23-2010
0

Re: Do IC support for Huawei switches as 802.1x?

Hi

 

attached is the OAC log file.

 

Regards

Mahmoud

Recognized Expert
Raveen
Posts: 419
Registered: ‎04-15-2010
0

Re: Do IC support for Huawei switches as 802.1x?

Hi,

 

In OAC logs, I can see switch sending EAP-FAILURE.

Snippet..

--------------------------------------------------------------------------

00172,09 2012/06/03 13:07:24.046 0 SYSTEM odClientService.exe odService p1944 tDB0 OdysseySupplicantMgr.cpp:300 - 'odService' [ERR] Discarding EAPOL packet: unknown packet type 1

...

00216,09 2012/06/03 13:07:26.046 0 SYSTEM odClientService.exe odService p1944 tDB0 OdysseySupplicantMgr.cpp:300 - 'odService' [ERR] Cannot set master key: authentication not complete or method does not support session keys

...

00178,09 2012/06/03 13:07:30.046 0 SYSTEM odClientService.exe odService p1944 tDB0 OdysseySupplicantMgr.cpp:300 - 'odService' [NRM] Processing EAP-Failure: code = 4, id = 9, length = 7

00132,09 2012/06/03 13:07:30.046 4 SYSTEM odClientService.exe odService p1944 tDB0 OdysseySupplicant.cpp:5428 - 'odService' STATE_Auth() 3

00156,09 2012/06/03 13:07:30.046 3 SYSTEM odClientService.exe odService p1944 tDB0 OdysseySupplicant.cpp:5496 - 'odService' Supplicant state: authentication failed

---------------------------------------------------------------------------

 

This could be a switch issue! However, there is no synchronised logs provided(UAC, OAC, Sniffer capture taken together at the same time-stamp).

 

Regards,

Raveen

Note: If this answers your question, you could mark this post as accepted solution, that way it helps others as well. Kudos will be cool if I earned it!
Contributor
eng_mahmood48@yahoo.com
Posts: 58
Registered: ‎06-23-2010
0

Re: Do IC support for Huawei switches as 802.1x?

I was able to collect the logs from MAG, OAC, and the captured traffic from the switch and at the same time.

 

attached are the logs

 

Regards

Mahmoud

Recognized Expert
Raveen
Posts: 419
Registered: ‎04-15-2010
0

Re: Do IC support for Huawei switches as 802.1x?

Hi Mahmoud,

 

This looks like a switch issue, as it sends EAP-FAILURE, even after receiving ACCESS-ACCEPT.

 

Below are the snippet for reference:

------------------------------------------------------------------------------

User Access Log:

 

2012-06-04 14:14:55 - ic - [0.0.0.0] test(Allowed-Realm)[] - Radius authentication accepted for test (realm 'Allowed-Realm') from location-group 'tel Location Group' and attributes are: NAS-IP-Address = 172.16.10.11,NAS-Port = 12398,NAS-Port-Type = 15

 

Radius Trouble shooting log:

 

info - [127.0.0.1] - System()[] - 2012/06/04 14:14:55 - (b0b7b250)Authentication Response
info - [127.0.0.1] - System()[] - 2012/06/04 14:14:55 - (b0b7b250)Packet : Code = 0x2 ID = 0x3c

 

Switch Capture:

 

Frame 86 --> ACCESS-ACCEPT from MAG Device

Frame 116 --> EAP Failure from switch to Cleint

 

After getting Acces-Accept, switch is not responding to the client, after twenty seconds, client is sending new EAPOL start message.

 

Regards,

Raveen

 

Note: If I have answered your questions, you could mark this as accepted solution, that way it would help others as well. A kudo would be a bonus thanks!

 

Note: If this answers your question, you could mark this post as accepted solution, that way it helps others as well. Kudos will be cool if I earned it!
Recognized Expert
Raveen
Posts: 419
Registered: ‎04-15-2010
0

Re: Do IC support for Huawei switches as 802.1x?

It is pretty much a switch issue, given that, it is sending EAP-FAILURE, albeit receving ACCESS-ACCEPT. Also, EAP-ID that it is using is also wrong, I reckon!

 

However, I would also try increasing authPeriod to eliminate timing isues. For testing purpose, can you increase the authperiod timeout in OAC.

 

HKEY_LOCAL_MACHINE\SOFTWARE\Funk Software, Inc.\odyssey\client\configuration\options\wired8021x\authPeriod

 

Default values is 20 seconds, try increasing it to 60

 

Regards,

Raveen

Note: If this answers your question, you could mark this post as accepted solution, that way it helps others as well. Kudos will be cool if I earned it!
Recognized Expert
Raveen
Posts: 419
Registered: ‎04-15-2010
0

Re: Do IC support for Huawei switches as 802.1x?

Forgot to add that changes to the registry requires reboot of the machine.

 

Regards,

Raveen

Note: If this answers your question, you could mark this post as accepted solution, that way it helps others as well. Kudos will be cool if I earned it!
Contributor
eng_mahmood48@yahoo.com
Posts: 58
Registered: ‎06-23-2010
0

Re: Do IC support for Huawei switches as 802.1x?

Hello Raveen

 

thank you for your posts, i tried what you suggested but i got the same responce.

so why the switch is refussing the EAP messages?

 

Regards

Mahmoud

Recognized Expert
Raveen
Posts: 419
Registered: ‎04-15-2010
0

Re: Do IC support for Huawei switches as 802.1x?

Well if it is not a timing issue, then you will have to work with your switch vendor on this.

You could provide the analysis that we have provided.

 

Regards,

raveen

Note: If this answers your question, you could mark this post as accepted solution, that way it helps others as well. Kudos will be cool if I earned it!
Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.