Security

Hi.

I observed a strange behavior on my 5140EI Comware switch with latest FW 7.10.R6351P02.

Using very simple dot1x authentication with certificate.

When I connect client to the port, authentication on Clearpass is successful, but in switch debug log report failure and authentication is repeated in never ending loop. If RADIUS server deny access, then it works as expected and no loop is observed. 

The same configuration is working flawlessly on Clearpass 6.10 and 6.12. It only fails on 6.11.9 and 10. Before I jump on TAC, did anybody encounter something like that?

#
 dot1x
 dot1x authentication-method eap
 dot1x quiet-period
 dot1x retry 3
 dot1x timer quiet-period 30
 dot1x timer handshake-period 30
 dot1x timer supp-timeout 10
 dot1x timer tx-period 10
#


interface GigabitEthernet1/0/7
 dot1x
 undo dot1x handshake
 dot1x mandatory-domain clearpass1-tacacs
 undo dot1x multicast-trigger
 dot1x unicast-trigger
 dot1x guest-vlan 200
 dot1x auth-fail vlan 300
 dot1x critical vlan 1
#


radius scheme clearpass1
 primary authentication x.x.x.x key cipher
 primary accounting x.x.x.x key cipher 
 accounting-on enable
 user-name-format without-domain

domain clearpass1-tacacs
 authentication lan-access radius-scheme clearpass1 local
 authorization lan-access radius-scheme clearpass1 local
 accounting lan-access radius-scheme clearpass1 local
 

Here is switch debug log for one attempt.

Supplicant issue?  Did your certificates change between these versions/deployments?  

Hi.

I observed a strange behavior on my 5140EI Comware switch with latest FW 7.10.R6351P02.

Using very simple dot1x authentication with certificate.

When I connect client to the port, authentication on Clearpass is successful, but in switch debug log report failure and authentication is repeated in never ending loop. If RADIUS server deny access, then it works as expected and no loop is observed. 

The same configuration is working flawlessly on Clearpass 6.10 and 6.12. It only fails on 6.11.9 and 10. Before I jump on TAC, did anybody encounter something like that?

#
 dot1x
 dot1x authentication-method eap
 dot1x quiet-period
 dot1x retry 3
 dot1x timer quiet-period 30
 dot1x timer handshake-period 30
 dot1x timer supp-timeout 10
 dot1x timer tx-period 10
#


interface GigabitEthernet1/0/7
 dot1x
 undo dot1x handshake
 dot1x mandatory-domain clearpass1-tacacs
 undo dot1x multicast-trigger
 dot1x unicast-trigger
 dot1x guest-vlan 200
 dot1x auth-fail vlan 300
 dot1x critical vlan 1
#


radius scheme clearpass1
 primary authentication x.x.x.x key cipher
 primary accounting x.x.x.x key cipher 
 accounting-on enable
 user-name-format without-domain

domain clearpass1-tacacs
 authentication lan-access radius-scheme clearpass1 local
 authorization lan-access radius-scheme clearpass1 local
 accounting lan-access radius-scheme clearpass1 local
 

Here is switch debug log for one attempt.

Supplicant issue?  Did your certificates change between these versions/deployments?  

Hi.

I observed a strange behavior on my 5140EI Comware switch with latest FW 7.10.R6351P02.

Using very simple dot1x authentication with certificate.

When I connect client to the port, authentication on Clearpass is successful, but in switch debug log report failure and authentication is repeated in never ending loop. If RADIUS server deny access, then it works as expected and no loop is observed. 

The same configuration is working flawlessly on Clearpass 6.10 and 6.12. It only fails on 6.11.9 and 10. Before I jump on TAC, did anybody encounter something like that?

#
 dot1x
 dot1x authentication-method eap
 dot1x quiet-period
 dot1x retry 3
 dot1x timer quiet-period 30
 dot1x timer handshake-period 30
 dot1x timer supp-timeout 10
 dot1x timer tx-period 10
#


interface GigabitEthernet1/0/7
 dot1x
 undo dot1x handshake
 dot1x mandatory-domain clearpass1-tacacs
 undo dot1x multicast-trigger
 dot1x unicast-trigger
 dot1x guest-vlan 200
 dot1x auth-fail vlan 300
 dot1x critical vlan 1
#


radius scheme clearpass1
 primary authentication x.x.x.x key cipher
 primary accounting x.x.x.x key cipher 
 accounting-on enable
 user-name-format without-domain

domain clearpass1-tacacs
 authentication lan-access radius-scheme clearpass1 local
 authorization lan-access radius-scheme clearpass1 local
 accounting lan-access radius-scheme clearpass1 local
 

Here is switch debug log for one attempt.

Have you tried enabling dot1x handshake?   The default setting is on.

Supplicant issue?  Did your certificates change between these versions/deployments?  

Hi.

I observed a strange behavior on my 5140EI Comware switch with latest FW 7.10.R6351P02.

Using very simple dot1x authentication with certificate.

When I connect client to the port, authentication on Clearpass is successful, but in switch debug log report failure and authentication is repeated in never ending loop. If RADIUS server deny access, then it works as expected and no loop is observed. 

The same configuration is working flawlessly on Clearpass 6.10 and 6.12. It only fails on 6.11.9 and 10. Before I jump on TAC, did anybody encounter something like that?

#
 dot1x
 dot1x authentication-method eap
 dot1x quiet-period
 dot1x retry 3
 dot1x timer quiet-period 30
 dot1x timer handshake-period 30
 dot1x timer supp-timeout 10
 dot1x timer tx-period 10
#


interface GigabitEthernet1/0/7
 dot1x
 undo dot1x handshake
 dot1x mandatory-domain clearpass1-tacacs
 undo dot1x multicast-trigger
 dot1x unicast-trigger
 dot1x guest-vlan 200
 dot1x auth-fail vlan 300
 dot1x critical vlan 1
#


radius scheme clearpass1
 primary authentication x.x.x.x key cipher
 primary accounting x.x.x.x key cipher 
 accounting-on enable
 user-name-format without-domain

domain clearpass1-tacacs
 authentication lan-access radius-scheme clearpass1 local
 authorization lan-access radius-scheme clearpass1 local
 accounting lan-access radius-scheme clearpass1 local
 

Here is switch debug log for one attempt.