Security

Hi,

I have been testing using enforce machine auth vs disabling enforce machine auth.  The login times vary from 30 seconds to 1 minute.  Probably stupid question, but is this by design?  On our wired network we just have comp auth.  The wireless is using computer or user auth.  When at the Ctrl+alt+delete screen, the computer does authenticate from the radius server.

Few questions:

• EAP-TLS or EAP-PEAP/MSCHAPv2 ?
• Are you using ClearPass?
• Are you restricting access in your machine authentication role?

EAP-PEAP/MSCHAPv2

No, we do not have clearpass

We have a domain-computer role which includes logon-control (dns, dhcp, icmp) and (allow domain controller) policy which gives full access to the domain controllers.

Ok, you had me think.  I added allowall to the domain-computer policy -- and that did the trick.  Now only took 5 seconds compared to 1min 18 seconds.

Generally slow logon times mean something is being blocked.

Just to test, can you change that role to have an allowall and see if it speeds up?

If so, remove the allowall and then use the "show datapath session table <client-ip> | include D" command to see what is being blocked during the logon process.