Security

We have two level authentication. 

1. Machine Authentication (before user login, all devices have to connect network with limit access)
2. User Authentication ( After user login, users will access to resources with their role)

At wired authentication, machine and user authentication is working fine.

-When we choose only "computer authentication", machine authentication is working. But, as customer's requirement,  they need "user authentication" after users login.

-At wireless authentication, machine authentication is not working on login screen before user login when we choose authentication mode as " computer or user authentication" on the computer. Computers always send wrong format domain\hostname$ on login screen. On login screen, computer must send host\fqdn. 

-On Wired Authentication, it's working with same profile and same computer. But, on wireless, it's not working.

Any suggestion for this problem? Thanks.

ClearPass is an AAA (Authentication, Authorization, Accounting) server.

Authentication - verify this is indeed the user they claim to be

Authorization: What can they access on the Network?

Accounting: Summary of what they actually did.

For the rest of this discussion I will assume you are referring to Microsoft Windows clients. The OS permits "User OR Machine authentication", not "User AND Machine Authentication". Some network vendors try caching Machine authentication to provide User and Machine authentication. since you do not state what vendor's wireless solution you use, I have no further suggestions.

Otherwise, there is no such thing as two-level authentication.

How are you performing Machine Authentication? Are the Windows clients joined to an on-Prem AD domain or Entra ID (formerly Azure AD) joined?

I will need more detail to help further.

For more information on AAA : https://en.wikipedia.org/wiki/AAA_(computer_security)

We have two level authentication. 

1. Machine Authentication (before user login, all devices have to connect network with limit access)
2. User Authentication ( After user login, users will access to resources with their role)

At wired authentication, machine and user authentication is working fine.

-When we choose only "computer authentication", machine authentication is working. But, as customer's requirement,  they need "user authentication" after users login.

-At wireless authentication, machine authentication is not working on login screen before user login when we choose authentication mode as " computer or user authentication" on the computer. Computers always send wrong format domain\hostname$ on login screen. On login screen, computer must send host\fqdn. 

-On Wired Authentication, it's working with same profile and same computer. But, on wireless, it's not working.

Any suggestion for this problem? Thanks.

Hi @bosborne, thanks for your reply.

I also found the same issue on this community. My problem is same with the below link.

https://community.arubanetworks.com/discussion/windows-using-domainmachinename-during-computer-authentication

ClearPass is an AAA (Authentication, Authorization, Accounting) server.

Authentication - verify this is indeed the user they claim to be

Authorization: What can they access on the Network?

Accounting: Summary of what they actually did.

For the rest of this discussion I will assume you are referring to Microsoft Windows clients. The OS permits "User OR Machine authentication", not "User AND Machine Authentication". Some network vendors try caching Machine authentication to provide User and Machine authentication. since you do not state what vendor's wireless solution you use, I have no further suggestions.

Otherwise, there is no such thing as two-level authentication.

How are you performing Machine Authentication? Are the Windows clients joined to an on-Prem AD domain or Entra ID (formerly Azure AD) joined?

I will need more detail to help further.

For more information on AAA : https://en.wikipedia.org/wiki/AAA_(computer_security)

We have two level authentication. 

1. Machine Authentication (before user login, all devices have to connect network with limit access)
2. User Authentication ( After user login, users will access to resources with their role)

At wired authentication, machine and user authentication is working fine.

-When we choose only "computer authentication", machine authentication is working. But, as customer's requirement,  they need "user authentication" after users login.

-At wireless authentication, machine authentication is not working on login screen before user login when we choose authentication mode as " computer or user authentication" on the computer. Computers always send wrong format domain\hostname$ on login screen. On login screen, computer must send host\fqdn. 

-On Wired Authentication, it's working with same profile and same computer. But, on wireless, it's not working.

Any suggestion for this problem? Thanks.

does someone has solution for this?

Hi @bosborne, thanks for your reply.

I also found the same issue on this community. My problem is same with the below link.

https://community.arubanetworks.com/discussion/windows-using-domainmachinename-during-computer-authentication

ClearPass is an AAA (Authentication, Authorization, Accounting) server.

Authentication - verify this is indeed the user they claim to be

Authorization: What can they access on the Network?

Accounting: Summary of what they actually did.

For the rest of this discussion I will assume you are referring to Microsoft Windows clients. The OS permits "User OR Machine authentication", not "User AND Machine Authentication". Some network vendors try caching Machine authentication to provide User and Machine authentication. since you do not state what vendor's wireless solution you use, I have no further suggestions.

Otherwise, there is no such thing as two-level authentication.

How are you performing Machine Authentication? Are the Windows clients joined to an on-Prem AD domain or Entra ID (formerly Azure AD) joined?

I will need more detail to help further.

For more information on AAA : https://en.wikipedia.org/wiki/AAA_(computer_security)

We have two level authentication. 

1. Machine Authentication (before user login, all devices have to connect network with limit access)
2. User Authentication ( After user login, users will access to resources with their role)

At wired authentication, machine and user authentication is working fine.

-When we choose only "computer authentication", machine authentication is working. But, as customer's requirement,  they need "user authentication" after users login.

-At wireless authentication, machine authentication is not working on login screen before user login when we choose authentication mode as " computer or user authentication" on the computer. Computers always send wrong format domain\hostname$ on login screen. On login screen, computer must send host\fqdn. 

-On Wired Authentication, it's working with same profile and same computer. But, on wireless, it's not working.

Any suggestion for this problem? Thanks.

does someone has solution for this?

Hi @bosborne, thanks for your reply.

I also found the same issue on this community. My problem is same with the below link.

https://community.arubanetworks.com/discussion/windows-using-domainmachinename-during-computer-authentication

ClearPass is an AAA (Authentication, Authorization, Accounting) server.

Authentication - verify this is indeed the user they claim to be

Authorization: What can they access on the Network?

Accounting: Summary of what they actually did.

For the rest of this discussion I will assume you are referring to Microsoft Windows clients. The OS permits "User OR Machine authentication", not "User AND Machine Authentication". Some network vendors try caching Machine authentication to provide User and Machine authentication. since you do not state what vendor's wireless solution you use, I have no further suggestions.

Otherwise, there is no such thing as two-level authentication.

How are you performing Machine Authentication? Are the Windows clients joined to an on-Prem AD domain or Entra ID (formerly Azure AD) joined?

I will need more detail to help further.

For more information on AAA : https://en.wikipedia.org/wiki/AAA_(computer_security)

We have two level authentication. 

1. Machine Authentication (before user login, all devices have to connect network with limit access)
2. User Authentication ( After user login, users will access to resources with their role)

At wired authentication, machine and user authentication is working fine.

-When we choose only "computer authentication", machine authentication is working. But, as customer's requirement,  they need "user authentication" after users login.

-At wireless authentication, machine authentication is not working on login screen before user login when we choose authentication mode as " computer or user authentication" on the computer. Computers always send wrong format domain\hostname$ on login screen. On login screen, computer must send host\fqdn. 

-On Wired Authentication, it's working with same profile and same computer. But, on wireless, it's not working.

Any suggestion for this problem? Thanks.