Security

Setting up 802.1X for 7841 phones, the team managing the CUCM have seemingly configured a test phone for 802.1X.

I see the device request in access tracker using EAP-FAST but as a "Timeout" event - "Client did not complete EAP transaction".

Is this a definite problem with the client, just wondering whether I need to do something special for EAP-FAST.

I have imported the Cisco certificates and enabled them in the Trust List.

Do you have EAP-FAST enabled as an authentication method? And do you have the appropriate Authentication sources also? I would add the authentication source as an authorization source as well.

Also check your Inner Methods on your EAP-FAST Authentication method as well. See below. Can you share the access tracker details?

Hi Dustin, EAP-FAST is configured as an authentication method in the service.

The inner methods for EAP-FAST are GTC, MSCHAPv2 & TLS.

The Authentication source is the AD servers which are used for EAP-TLS for client laptops (the service is shared but I can create a new service if it can't be used for both.

What would EAP-FAST on phones require as an authentication source? I thought it would use certs only for auth.

I've attached the Access tracker log.

Attachment(s)

PhoneATLog_San.txt   16 KB 1 version

The fact that ClearPass is reporting a "Timeout" with an Alert: "Client did not complete EAP transaction" would indicate to me that the iPhone is not trusting the ClearPass' RADUS certificate.

Does access tracker log which is shared is complete? I see server sent access challenge request but didn't received any response, you need to look on switch side to which your IP phone is connected to see whether it forwarded challenge to IP client device.

2020-02-18 16:05:53,901 [Th 192 Req 17876374 SessId R001ccd9e-01-5e4c0b61] INFO RadiusServer.Radius - rlm_ldap: searching for user CP-8831-SEPAC44F212B816 in AD:1.1.1.3
2020-02-18 16:05:53,909 [Th 192 Req 17876374 SessId R001ccd9e-01-5e4c0b61] ERROR RadiusServer.Radius - rlm_ldap: could not start TLS Connect error
2020-02-18 16:05:53,910 [Th 192 Req 17876374 SessId R001ccd9e-01-5e4c0b61] ERROR RadiusServer.Radius - rlm_ldap: (re)connection attempt failed
2020-02-18 16:05:53,910 [Th 192 Req 17876374 SessId R001ccd9e-01-5e4c0b61] INFO RadiusServer.Radius - TLS_accept:error in SSLv3 read client key exchange A
2020-02-18 16:05:53,910 [Th 192 Req 17876374 SessId R001ccd9e-01-5e4c0b61] INFO RadiusServer.Radius - TLS_accept:error in SSLv3 read client key exchange A
2020-02-18 16:05:53,910 [Th 192 Req 17876374 SessId R001ccd9e-01-5e4c0b61] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 75:1124:11-22-33-44-55-66:ADkAbwCvAOGWxRABXa/cWhiAwiDkIvPbyXgLZw==

Hi Pavan, this is the complete log. I don't see any reason why the switch wouldn't be forwarding on the challenge so my assumption is that the phone isn't responding. Perhaps as DMellor suggests the client needs to trust the CPPM cert and this isn't happening.

If switch is forwarding the challenge to IP phone then next step is to check certificate, whether client is trusting CPPM certificate or not.

Try check first on switch logs to narrow down the issue.

I'm reply on the service provider who manage CUCM to determine whether the phone is setup to trust the CPPM. Would the customer need to supply the CPPM server cert to the phone provider or can the trust be established using the Geo Trust CA root cert?

If CPPM server certificate is signed by any third party CA like Geo Trust then we can add root CA certificate in client trust list.

I'm not getting a reply from the service provider on the question of certificate trust. They have said that there is a version mismatch but I can't see an option in the EAP-FAST method settings to enable different versions -

5285 NOT Feb 20 13:03:56.668111 (318:318) PAE: -rcvd EAP-Req/FAST
5286 NOT Feb 20 13:03:56.668539 (318:318) PAE: -802.1X authenticating via EAP-TLS

5304 WRN Feb 20 13:03:56.829839 (318:318) PAE: -checkRxMsg: Invalid EAP-FAST version 0

Are you seeing this log in IP Phone?

It looks client not supporting this version,can you change version on client itself and check or use EAP-PEAP protocol.

You can take packet capture from Administration » Server Manager » Server Configuration  or set radius log in debug mode from Administration » Server Manager » Log Configuration and check Access tracker log and packet capture for more details related to EAP-FAST version.

Service Parameters > RADIUS Server Service

It looks like CPPM is selecting the correct version -

2020-02-20 15:04:18,047 [Th 193 Req 18186874 SessId R001d4377-01-5e4e9ff0] DEBUG RadiusServer.Radius - rlm_eap_tls: Server version 1 Peer Version 0 Choosing 0

Phone provider says they cannot change the version even on the latest Cisco phone version and won't give me an answer as to whether they can use another EAP version.

If client is not supporting the EAP-FAST version then try use EAP-PEAP Protocol.

OK I've got the phone performing EAP-TLS but now got an "Unknown CA" failure.

I've installed and enabled the four Cisco certificates supplied by phone provider and what the phone is supplying looks the same, form access tracker - 

 Alerts for this Request 

Additional access tracker logs -

Hi,

The ClearPass server is not able to verify the CA who signed the client certificate. Ensure the correct CA is added in the ClearPass trust list and the subject of CA matches the below CommonName (CN) and Organization(O) and the expiration is also the same.

If your trust list validation matches but still the authentication fails with the same error, then share the trust list screen capture and the access tracker export of the failure. You may also open a TAC case and work with the TAC engineers.

Hi Saravanan, I'm having trouble getting this across to the phone provider, so in simple terms -

Client certificate has -
Certificate: Issuer-DN CN=Cisco Manufacturing CA

Certificate on ClearPass has -
Subject DN: CN=Cisco Manufacturing CA SHA2

and these two don't match.

You can https browse to the phone's ip address and save the certificates in the chain from its https certificate. Save them in the CPPM trust list. I am currently using EAP-TLS in this fashion. Sometimes different phones have different trust chains.

I am moving away from this because we keep the phones longer than the manufacturer's installed certificate expiry.