Thank you, Herman,
Since I'm doing the pilot for the hospital wired dot1x it is slightly different, i.e. no SSID in the service rule but I have adjusted it to look similar
I already chatted with one of your colleagues, i.e. Brandon Murrey, and we walked through it together and even collected captures on the endpoint for EAPOL traffic. He is investigating it and it looks like it has something to do with Hello messages during the SSL/TLS negotiation between the client and Clearpass. The session just times out now and I can't see that it gets to the identity verification step
I'm trying to understand which one of the attributes used as shown above in the service takes care about the anonymous username. We confirmed that Windows supplicant sends it no matter how it is configured on the supplicant, whether it is checked or not
Original Message:
Sent: 10/6/2023 8:03:00 AM
From: Herman Robers
Subject: RE: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
Ok, this may indeed be confusing... for the service selection (service rules) you would need to use the anonymous identity, where you have the option to change it on the client and make a better decision for multiple types of clients (different group policies/Intune policies).
This is what I did in my service for TEAP to separate the TEAP out from TLS/PEAP:
This checks for either teap or anonmymous. If you have Intune managed client and domain managed clients you could use a different anonymous identity to map to the right service if these devices connect to the same network (SSID/Wired).
Hope this helps you further... Once the TEAP authentication is starting, it should populate the Method-1 and Method-2 attributes with status/username.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------
Original Message:
Sent: Oct 05, 2023 11:23 AM
From: zheka
Subject: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
Good day, Herman!
Many thanks for the reply and willingness to help.
Yeah, I developed an idea that it is all Windows "fault" to send "anonymous" username in the authentication request ��
Here's what you showed in you video to unselect and this is exactly what I did
Access tracker in Clearpass gives me an explicit reason of rejecting
So, if your anonymous authentication works how would I construct the service if an endpoint sends "anonymous" regardless of the setting in the supplicant? ��
Maybe I need to populate that field with something known to Clearpass that would be the condition to continue with the authentication request ?
Original Message:
Sent: 10/5/2023 9:38:00 AM
From: Herman Robers
Subject: RE: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
I'm not fully sure what I advised in that video, but know that things have changed and also I think you can't really turn of the anonymous identity in Windows 10 anymore in recent version. Regardless, for me it works with anonymous authentication and you can even select which username is used (the Method-1 or Method-2) by returning either one as IETF:Username, so if Method-2 fails, you return IETF:Username = %{Authentication:TEAP-Method-1-Username}; otherwise the Method-2-Username.
But if authentication fails already, please check what is the reason of failing. Does your service match? Do you see any more specific information in the Alerts tab?
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Sep 30, 2023 02:25 PM
From: zheka
Subject: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
Hi Herman,
I've been watching all your videos posted on Youtube for Clearpass configuration and they give a tremendous help. Thank you very much. Now I want to build a solution for the client that would use EAP-TEAP. Based on your video on Youtube you advise to uncheck "enable identity privacy" for TEAP settings. I did it and then adjusted all policies in Clearpass to include TEAP method and use Method 2. Alas, all end point authentications attempt are rejected and I clearly see "anonymous" is being sent by Windows 10. Then I adjusted the service profile in Clearpass as it was advised in this forum thread, namely RADIUS:IETF username equals %{Authentication:TEAP-Method-2-Username}. Still the same rejection. Any suggestions or insights? I'm desperate. Is something wrong with Windows 10? It is the newer build that apparently has EAP-TEAP available.
Original Message:
Sent: Jul 22, 2022 05:43 AM
From: Herman Robers
Subject: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
TEAP is available in Windows 10 version 2004 and newer as basic part of the operating system. No need to install anything.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Jul 21, 2022 07:15 PM
From: juan Santamaria
Subject: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
Hi
how can i know
Which supplicant(s) is capable of eap chaining ?
Should i install driver on windows ?
------------------------------
J Santamaria
Original Message:
Sent: Apr 29, 2020 10:29 AM
From: Zak Emerick
Subject: [Tutorial] - Clearpass Authentication using EAP-TEAP (EAP-Chaining)
Attached is a PDF on how to configure Clearpass authentication using EAP-TEAP, also known as EAP-Chaining.
Environment:
Device: Windows 10 Insider Preview 2004 build 19613.
CPPM: 6.9.0
EAP-TEAP (RFC: 7170) Abstract:
This document defines the Tunnel Extensible Authentication Protocol (TEAP) version 1. TEAP is a tunnel-based EAP method that enables secure communication between a peer and a server by using the Transport Layer Security (TLS) protocol to establish a mutually authenticated tunnel. Within the tunnel, TLV objects are used to convey authentication-related data between the EAP peer and the EAP server.
EAP-TEAPv1 allows for the User and Machine to authenticate during the same session. This will make User + Machine authentication much more graceful.
Instead of relying on the Machine authentication cache in CPPM, you will get the authentication status on the first authentication attempt of both the User and Machine.
NOTE: My original post disappeared for some reason without notice, so I'm posting again. If I have violated a forum rule somehow please let me know.