Security

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Hello , i suspect the PC is not configured properly . Especially the network adapter settings . Can you please show the adapter configuration . Because from access tracker i see after user login it not present the username . Be sure the network adapter  must be configured as (machine or user ) this to work .

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Herman, I took a look at the Input Tab for the failed request, and I show the following Computed attributes:

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Hello gmann101 , What we see is the for whatever reason the machine not propagate the username .That's why it not trigger dot1x service . Personally i would check if on the machine under the user personal certificates there is user cert on it --->if it is there next step i would change adapter setting to user authentication only and check how it would go . 

Herman, I took a look at the Input Tab for the failed request, and I show the following Computed attributes:

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

OS66 - I checked for local computer certificates, and there is one there.  I also disabled the GPO for this machine, and manually went into the NIC adapter setting and changed the setting for authentication mode to "Computer Authentication" only.  Following this, I re-started, and signed back into the PC, and was not disconnected thereafter.

So machine authentication appears to work, but not user authentication.  What might the next step be to troubleshoot this further?

Hello gmann101 , What we see is the for whatever reason the machine not propagate the username .That's why it not trigger dot1x service . Personally i would check if on the machine under the user personal certificates there is user cert on it --->if it is there next step i would change adapter setting to user authentication only and check how it would go . 

Herman, I took a look at the Input Tab for the failed request, and I show the following Computed attributes:

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Hello gmann101 ,please check for user certificate is it presented there . AFter you clarify this change adapter setting to user authentication . Ans see what will happen and provide a screenshot .

OS66 - I checked for local computer certificates, and there is one there.  I also disabled the GPO for this machine, and manually went into the NIC adapter setting and changed the setting for authentication mode to "Computer Authentication" only.  Following this, I re-started, and signed back into the PC, and was not disconnected thereafter.

So machine authentication appears to work, but not user authentication.  What might the next step be to troubleshoot this further?

Hello gmann101 , What we see is the for whatever reason the machine not propagate the username .That's why it not trigger dot1x service . Personally i would check if on the machine under the user personal certificates there is user cert on it --->if it is there next step i would change adapter setting to user authentication only and check how it would go . 

Herman, I took a look at the Input Tab for the failed request, and I show the following Computed attributes:

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

Herman, I took a look at the Input Tab for the failed request, and I show the following Computed attributes:

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on? 

This request looks like a MAC authentication, not a 802.1X authentication. So it looks like the configuration that's being pushed is incorrect for this client.

Maybe you can exempt this (or another client you can test with) from the GPO and first find out the correct configuration. Then find the differences between the working config and what is in the GPO.

Also, the client-side troubleshooting steps in this document may help as well. As you don't even see that authentication in ClearPass, my guess is that there is something basic in your supplicant config that is set incorrect. If there would be a trust issue with the server certificate, I would at least expect the negotiation to start and either a REJECT or TIMEOUT in the ClearPass.

This type is issue can be challenging to find the root cause for, so it may be good to work with your Aruba partner or TAC Support for interactive troubleshooting and a broader configuration check.

Herman, I took a look at the Input Tab for the failed request, and I show the following Computed attributes:

Failed to classify request to service means that there was no matching Service in ClearPass for that request.

The Input tab for the failing request may show the request attributes, from there you could check your service matches to find out why there is no match. It may be that your client doesn't have a client certificate for user authentication, or isn't configured correctly to find the client certificate for use authentication, and Windows drops back to unauthenticated access which then attempts MAC authentication from the switch.

Hi everyone.  I am encountering an issue where a PC is failing 802.1x authentication once a test user signs into it.  According to the access tracker, the PC passes the EAP TLS authentication, and the correct cert is being pushed down to the machine via Group Policy, but once a user has signed in, I immediately see REJECT message.

The enforcement policy of the Service is configured as follows:

Why is the authentication be failing after a user logs on?