Security

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Couple of things to check:

1. Here outer identity is anonymous. Is there an actual user account named "anonymous" in the auth sources configured for the service? 
2. Can you double check the supplicant configuration to check if the trust is setup correctly. Recently heard about someone who ran into similar error and after working with TAC, problem was with the trusted root CA selection on supplicant. I would expect the error message to point out trust issues clearly, so I am not fully convinced that was the real root cause but worth double checking.

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Couple of things to check:

1. Here outer identity is anonymous. Is there an actual user account named "anonymous" in the auth sources configured for the service? 
2. Can you double check the supplicant configuration to check if the trust is setup correctly. Recently heard about someone who ran into similar error and after working with TAC, problem was with the trusted root CA selection on supplicant. I would expect the error message to point out trust issues clearly, so I am not fully convinced that was the real root cause but worth double checking.

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Running into exactly the same error.

It seems to point to using the endpoints repository as the culprit. 
Since my service is configured for TEAP (TLS both methods) and we are also doing InTune checks for iPads who use TLS.
The InTune extension syncs with the endpoints repository so it is added as an auth source. Cannot add InTune as an auth source right now. 

As soon as I remove the endpoints repository as an auth source, my windows client starts working again. 

May have to separate the service and add a condition to check the IETF user-name as anonymous or teap (configured for teap currently) and simply reuse the same role mapping and enforcement policies. 

Couple of things to check:

1. Here outer identity is anonymous. Is there an actual user account named "anonymous" in the auth sources configured for the service? 
2. Can you double check the supplicant configuration to check if the trust is setup correctly. Recently heard about someone who ran into similar error and after working with TAC, problem was with the trusted root CA selection on supplicant. I would expect the error message to point out trust issues clearly, so I am not fully convinced that was the real root cause but worth double checking.

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Exact same issue here, did anyone figure this out? When both TEAP and TLS are enabled in the same service, and Endpoints Repository is an Authentication source, TEAP fails with the 'conflicting identities' error. Removing TLS from the service resolves the issue. In my case removing the Endpoints Repository also breaks my TEAP, I am doing only Certificate authentication (no AD), then AzureAD/EntraID for Authorization. Apparently for that to work Endpoints Repository has to be an Authentication method. The workaround is configuring TEAP on it's own service (looking for the 'anonymous' username), but I'm curious how to get both TLS and TEAP working at the same time with this config. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Ran into this issue within my client's lab this afternoon. Same exact scenario as yours - if I figure this out I will report back with the solution.

Original Message:
Sent: Sep 26, 2024 12:02 AM
From: cm119
Subject: Using EAP-TEAP and EAP-TLS on the same service

Exact same issue here, did anyone figure this out? When both TEAP and TLS are enabled in the same service, and Endpoints Repository is an Authentication source, TEAP fails with the 'conflicting identities' error. Removing TLS from the service resolves the issue. In my case removing the Endpoints Repository also breaks my TEAP, I am doing only Certificate authentication (no AD), then AzureAD/EntraID for Authorization. Apparently for that to work Endpoints Repository has to be an Authentication method. The workaround is configuring TEAP on it's own service (looking for the 'anonymous' username), but I'm curious how to get both TLS and TEAP working at the same time with this config. 

Original Message:
Sent: Sep 11, 2023 10:22 PM
From: hammertim
Subject: Using EAP-TEAP and EAP-TLS on the same service

Original Message:
Sent: 9/11/2023 11:28:00 AM
From: Herman Robers
Subject: RE: Using EAP-TEAP and EAP-TLS on the same service

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 08, 2023 05:11 PM
From: hammertim
Subject: Using EAP-TEAP and EAP-TLS on the same service

Original Message:
Sent: 9/8/2023 10:16:00 AM
From: bd_87
Subject: RE: Using EAP-TEAP and EAP-TLS on the same service

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

------------------------------
ACNSP | ACCP | ACMP | ACEP

Original Message:
Sent: Sep 08, 2023 01:35 AM
From: hammertim
Subject: Using EAP-TEAP and EAP-TLS on the same service

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

If you remove the endpoint database and the local sql database and have say, AD as the only authentication source, you can save the service with both EAP-TLS and TEAP. Of course this does not help those who are not using AD - 

Original Message:
Sent: Nov 07, 2024 04:19 PM
From: Mark Napoleoni
Subject: Using EAP-TEAP and EAP-TLS on the same service

Ran into this issue within my client's lab this afternoon. Same exact scenario as yours - if I figure this out I will report back with the solution.

Original Message:
Sent: Sep 26, 2024 12:02 AM
From: cm119
Subject: Using EAP-TEAP and EAP-TLS on the same service

Exact same issue here, did anyone figure this out? When both TEAP and TLS are enabled in the same service, and Endpoints Repository is an Authentication source, TEAP fails with the 'conflicting identities' error. Removing TLS from the service resolves the issue. In my case removing the Endpoints Repository also breaks my TEAP, I am doing only Certificate authentication (no AD), then AzureAD/EntraID for Authorization. Apparently for that to work Endpoints Repository has to be an Authentication method. The workaround is configuring TEAP on it's own service (looking for the 'anonymous' username), but I'm curious how to get both TLS and TEAP working at the same time with this config. 

Original Message:
Sent: Sep 11, 2023 10:22 PM
From: hammertim
Subject: Using EAP-TEAP and EAP-TLS on the same service

Original Message:
Sent: 9/11/2023 11:28:00 AM
From: Herman Robers
Subject: RE: Using EAP-TEAP and EAP-TLS on the same service

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 08, 2023 05:11 PM
From: hammertim
Subject: Using EAP-TEAP and EAP-TLS on the same service

Original Message:
Sent: 9/8/2023 10:16:00 AM
From: bd_87
Subject: RE: Using EAP-TEAP and EAP-TLS on the same service

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

------------------------------
ACNSP | ACCP | ACMP | ACEP

Original Message:
Sent: Sep 08, 2023 01:35 AM
From: hammertim
Subject: Using EAP-TEAP and EAP-TLS on the same service

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS.