Security

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Couple of things to check:

1. Here outer identity is anonymous. Is there an actual user account named "anonymous" in the auth sources configured for the service? 
2. Can you double check the supplicant configuration to check if the trust is setup correctly. Recently heard about someone who ran into similar error and after working with TAC, problem was with the trusted root CA selection on supplicant. I would expect the error message to point out trust issues clearly, so I am not fully convinced that was the real root cause but worth double checking.

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Couple of things to check:

1. Here outer identity is anonymous. Is there an actual user account named "anonymous" in the auth sources configured for the service? 
2. Can you double check the supplicant configuration to check if the trust is setup correctly. Recently heard about someone who ran into similar error and after working with TAC, problem was with the trusted root CA selection on supplicant. I would expect the error message to point out trust issues clearly, so I am not fully convinced that was the real root cause but worth double checking.

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Running into exactly the same error.

It seems to point to using the endpoints repository as the culprit. 
Since my service is configured for TEAP (TLS both methods) and we are also doing InTune checks for iPads who use TLS.
The InTune extension syncs with the endpoints repository so it is added as an auth source. Cannot add InTune as an auth source right now. 

As soon as I remove the endpoints repository as an auth source, my windows client starts working again. 

May have to separate the service and add a condition to check the IETF user-name as anonymous or teap (configured for teap currently) and simply reuse the same role mapping and enforcement policies. 

Couple of things to check:

1. Here outer identity is anonymous. Is there an actual user account named "anonymous" in the auth sources configured for the service? 
2. Can you double check the supplicant configuration to check if the trust is setup correctly. Recently heard about someone who ran into similar error and after working with TAC, problem was with the trusted root CA selection on supplicant. I would expect the error message to point out trust issues clearly, so I am not fully convinced that was the real root cause but worth double checking.

Here is a client connecting with EAP-TLS on the SSID that I showed the service for:

That client is a Windows 10, not Win11; but that should not make a big difference. From the logs it looks like the client is attempting TEAP, not EAP-TLS, and it the client that decides which authentication method to use.

One other approach would be to split up the services into two..  you can do that by filtering on the anonymous username that you can set for TEAP:

But EAP-TLS and TEAP in one service should just work...

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS. 

Yes, should work. Here is the configuration the I have, it even has PEAP enabled in the same service/SSID in addition to TLS and TEAP.

Can you reply with some screenshots? It almost seams like maybe the client is trying EAP-PEAP instead of EAP-TLS? 

Screenshots of the client SSID config and of the ClearPass service would be a big help.

Is there a way to have EAP-TEAP and EAP-TLS co-exist on the same service?

I have been testing EAP-TEAP on wireless and have it successfully working. Both methods are EAP-TLS. If I then enable EAP-TLS on the same service, clients that only use EAP-TLS do not connect and show the following alert "EAP: Client doesn't support configured EAP methods". 

I have clients that don't support EAP-TEAP (i.e. iPads and MacBooks) and do not want to use a separate SSID. Furthermore, I'm also testing EAP-TEAP for wired authentication and would like the MacBooks to fall back to EAP-TLS.