Security

 View Only
last person joined: 23 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Clearpass mac authentication takes too long

This thread has been viewed 51 times
  • 1.  Clearpass mac authentication takes too long

    Posted Jul 27, 2022 10:26 AM
    Hello

    I have a problem with Aruba ClearpassPM. 6.10
    I configured mac-Authentification for Igel Thin Client and the Authentification takes a very long time.3 to 5 minutes. Same after reboot.
    But the 802.1 X Wired Access Authentification works normally.
    What am I doing wrong?

    Thanks.


    ------------------------------
    David
    ------------------------------


  • 2.  RE: Clearpass mac authentication takes too long

    EMPLOYEE
    Posted Jul 27, 2022 11:22 AM
    If this is wireless, every time you connect a device you need to do a "aaa user delete mac <mac address of device>" or delete the client using the trash can in the GUI of the MM to remove it from the user table.  If you do not do that, a user will stay in the user table for up to 5 minutes and will not attempt mac authentication, even if you disassociate.

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
    ------------------------------



  • 3.  RE: Clearpass mac authentication takes too long

    Posted Jul 27, 2022 11:57 AM
    Hello

    That's not a wireless device, that's normal wired client with Linux. I can only perform Mac-authentification.
    How can I solve this? gives other possibilities ?
    Thks


    ------------------------------
    David
    ------------------------------



  • 4.  RE: Clearpass mac authentication takes too long

    EMPLOYEE
    Posted Jul 27, 2022 12:09 PM
    Sorry.  I thought you were saying wired authentication works but wireless does not.  What is your switch and switch configuration and do you unplug then plug the device back in to start the reauthentication again?  Have you seen the ClearPass wired policy enforcement document here?  https://asp.arubanetworks.com/downloads/documents/RmlsZTpmMDY3Y2UwYS1lNmZiLTExZWEtYjFjMi0zYmZjN2Y0MzMxNDI%3D

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
    ------------------------------



  • 5.  RE: Clearpass mac authentication takes too long

    Posted Jul 27, 2022 01:01 PM
    Hello

    Switch: Aruba CX 6100

    just after restart the Client.

    enforcement is configured and work, only authentification take long long time


    ------------------------------
    David
    ------------------------------



  • 6.  RE: Clearpass mac authentication takes too long

    EMPLOYEE
    Posted Jul 27, 2022 09:03 PM
    Does access tracker give you any clues?

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------



  • 7.  RE: Clearpass mac authentication takes too long

    Posted Jul 28, 2022 01:13 AM
    Hello

    see output below




    ------------------------------
    David
    ------------------------------



  • 8.  RE: Clearpass mac authentication takes too long

    EMPLOYEE
    Posted Jul 28, 2022 02:22 AM
    when you look at the access tracker list, do you see multiple auth request for the same device on the same switch port?
    check the time stamps, in addition do you see timeouts for this client in access tracker?

    lastly what switch is sending these MAC auths? are there any timers that can be changed, if the switch is first trying to do dot1x and then MAC auth?

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------



  • 9.  RE: Clearpass mac authentication takes too long

    EMPLOYEE
    Posted Jul 28, 2022 03:11 AM
    By default, AOS-CX will first try 802.1X and only if the retries and timeouts are expired, it will fallback to MAC Auth. That seems to match what you see.

    Can you try to enable concurrent onboarding and see if that works better?

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------