Security

 View Only
last person joined: 7 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Client did not complete EAP transaction

This thread has been viewed 156 times

  • 1.  Client did not complete EAP transaction

    Posted Jun 13, 2022 04:55 AM
    Hi Teams,
    We are experiencing an authentication timeout issue. A small number of clients cannot complete the EAP transaction, and the authentication method we use is EAP-PEAP. Do you have any suggestions?


    Request log details for session: R000001da-01-62a6f982

    Time Message
    2022-06-13 16:46:58,305 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: device-public-mac= value not present in any of Cisco-AVPairs
    2022-06-13 16:46:58,305 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: Starting Service Categorization - 210:309:00-2B-67-E1-C7-BC
    2022-06-13 16:46:58,309 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1375 h=931 r=R000001da-01-62a6f982] INFO Core.ServiceReqHandler - Service classification result = MPS_Wired_AD_User_Login
    2022-06-13 16:46:58,310 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - Service Categorization time = 5 ms
    2022-06-13 16:46:58,310 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: The request has been categorized into service "MPS_Wired_AD_User_Login"
    2022-06-13 16:46:58,310 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_ldap: searching for user MONOLITHICPOWER\hevhe in AD:cd-ds02.monolithicpower.com
    2022-06-13 16:46:58,312 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_ldap: found user MONOLITHICPOWER\hevhe in AD:cd-ds02.monolithicpower.com
    2022-06-13 16:46:58,312 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - LDAP/AD User lookup time = 2 ms
    2022-06-13 16:46:58,312 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_eap_peap: Initiate
    2022-06-13 16:46:58,313 [Th 204 Req 2500 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 210:88:00-2B-67-E1-C7-BC:AIYA2wDLAArECQAAcwyg/hGHOmzxYPSy14ukTg==
    2022-06-13 16:46:58,319 [Th 202 Req 2501 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: device-public-mac= value not present in any of Cisco-AVPairs
    2022-06-13 16:46:58,319 [Th 202 Req 2501 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: The request was categorized into service "MPS_Wired_AD_User_Login" - 211:497:00-2B-67-E1-C7-BC
    2022-06-13 16:46:58,321 [Th 202 Req 2501 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - TLS_accept:error in SSLv3 read client key exchange A
    2022-06-13 16:46:58,321 [Th 202 Req 2501 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - TLS_accept:error in SSLv3 read client key exchange A
    2022-06-13 16:46:58,322 [Th 202 Req 2501 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 211:1124:00-2B-67-E1-C7-BC:AIgASACwAKTFCQAAp51CHF/v3WUcruTTpZ7epw==
    2022-06-13 16:46:58,326 [Th 203 Req 2502 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: device-public-mac= value not present in any of Cisco-AVPairs
    2022-06-13 16:46:58,326 [Th 203 Req 2502 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: The request was categorized into service "MPS_Wired_AD_User_Login" - 212:331:00-2B-67-E1-C7-BC
    2022-06-13 16:46:58,327 [Th 203 Req 2502 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 212:1120:00-2B-67-E1-C7-BC:AGcAcwC1ABrGCQAAjCQNvijFhuPBoyDke+MOOw==
    2022-06-13 16:46:58,332 [Th 201 Req 2503 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: device-public-mac= value not present in any of Cisco-AVPairs
    2022-06-13 16:46:58,332 [Th 201 Req 2503 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: The request was categorized into service "MPS_Wired_AD_User_Login" - 213:331:00-2B-67-E1-C7-BC
    2022-06-13 16:46:58,333 [Th 201 Req 2503 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 213:1120:00-2B-67-E1-C7-BC:AAMAQgBzAGDHCQAAIATXQwS2gbjrTN0pFUIYzQ==
    2022-06-13 16:46:58,337 [Th 204 Req 2504 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: device-public-mac= value not present in any of Cisco-AVPairs
    2022-06-13 16:46:58,337 [Th 204 Req 2504 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: The request was categorized into service "MPS_Wired_AD_User_Login" - 214:331:00-2B-67-E1-C7-BC
    2022-06-13 16:46:58,338 [Th 204 Req 2504 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 214:801:00-2B-67-E1-C7-BC:AH0AcABOAJTICQAAvF2ah5gLYh+gDtNg45LjQA==
    2022-06-13 16:46:58,345 [Th 202 Req 2505 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: device-public-mac= value not present in any of Cisco-AVPairs
    2022-06-13 16:46:58,345 [Th 202 Req 2505 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_service: The request was categorized into service "MPS_Wired_AD_User_Login" - 215:461:00-2B-67-E1-C7-BC
    2022-06-13 16:46:58,346 [Th 202 Req 2505 SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - reqst_update_state: Access-Challenge 215:139:00-2B-67-E1-C7-BC:AAgAxgAqAPnJCQAAFbQ5JM3s9ecv1mpC5R9DoA==
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Deleting request sessid - R000001da-01-62a6f982, state - AAgAxgAqAPnJCQAAFbQ5JM3s9ecv1mpC5R9DoA=
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Packet 210:309:88:00-2B-67-E1-C7-BC recv 1655110018.305127 - resp 1655110018.313392
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Packet 211:497:1124:00-2B-67-E1-C7-BC recv 1655110018.319209 - resp 1655110018.322060
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Packet 212:331:1120:00-2B-67-E1-C7-BC recv 1655110018.325877 - resp 1655110018.327446
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Packet 213:331:1120:00-2B-67-E1-C7-BC recv 1655110018.331495 - resp 1655110018.333128
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Packet 214:331:801:00-2B-67-E1-C7-BC recv 1655110018.337123 - resp 1655110018.338705
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] ERROR RadiusServer.Radius - reqst_clean_list: Packet 215:461:139:00-2B-67-E1-C7-BC recv 1655110018.345156 - resp 1655110018.346486
    2022-06-13 16:47:45,348 [main SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_policy: Starting Policy Evaluation.
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO Common.EndpointTable - Returning EndpointSPtr for macAddr 002b67e1c7bc
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO Common.TagDefinitionCacheTable - No InstanceTagDefCacheMap found for instance id = 3061 entity id = 29
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO Common.TagDefinitionCacheTable - Building the TagDefMapTable for NAD instance=3061
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO Common.TagDefinitionCacheTable - Built 0 tag(s) for NAD instanceId=3061|entityId=29
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO TAT.TagAttrHolderBuilder - No tags built for instanceId=3061|entity=Device
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO TAT.AluTagAttrHolderBuilder - buildAttrHolder: Tags cannot be built for instanceId=0 (NULL AuthLocalUser)
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO TAT.GuTagAttrHolderBuilder - buildAttrHolder: Tags cannot be built for instanceId=0 (NULL GuestUser)
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 r=psauto-1655078261-1376 h=1081 r=R000001da-01-62a6f982] INFO TAT.OnboardTagAttrHolderBuilder - buildAttrHolder: Tags cannot be built for instanceId=0 (NULL Onboard Device User)
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - *** PE_TASK_SCHEDULE_RADIUS Started ***
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskAuthSourceRestriction **
    2022-06-13 16:47:45,351 [RequestHandler-1-0x7fb68bcc6700 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskRoleMapping **
    2022-06-13 16:47:45,352 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskAuthSourceRestriction **
    2022-06-13 16:47:45,353 [RequestHandler-1-0x7fb68bcc6700 h=12154 c=R000001da-01-62a6f982] INFO Core.PETaskRoleMapping - Roles: AD_Computer
    2022-06-13 16:47:45,353 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskRoleMapping **
    2022-06-13 16:47:45,353 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskPolicyResult **
    2022-06-13 16:47:45,359 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12156 c=R000001da-01-62a6f982] ERROR Core.PETaskPolicyResult - handleHttpResponseEv: All policy result cache lookups failed
    2022-06-13 16:47:45,359 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskPolicyResult **
    2022-06-13 16:47:45,359 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskEnforcement **
    2022-06-13 16:47:45,360 [RequestHandler-1-0x7fb68bcc6700 h=12157 c=R000001da-01-62a6f982] INFO Core.PETaskEnforcement - EnfProfiles: dACL_For_Quarantine
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskEnforcement **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskRadiusEnfProfileBuilder **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskRadiusCoAEnfProfileBuilder **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskAppEnfProfileBuilder **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskAgentEnfProfileBuilder **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskPostAuthEnfProfileBuilder **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskGenericEnfProfileBuilder **
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 h=12163 c=R000001da-01-62a6f982] INFO Core.PETaskGenericEnfProfileBuilder - getApplicableProfiles: No App enforcement (Generic) profiles applicable for this device
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 h=12158 c=R000001da-01-62a6f982] INFO Core.PETaskRadiusEnfProfileBuilder - EnfProfileAction=ACCEPT
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 h=12158 c=R000001da-01-62a6f982] INFO Core.PETaskRadiusEnfProfileBuilder - Radius enfProfiles used: dACL_For_Quarantine
    2022-06-13 16:47:45,361 [RequestHandler-1-0x7fb68bcc6700 h=12158 c=R000001da-01-62a6f982] INFO Core.EnfProfileComputer - getFinalSessionTimeout: sessionTimeout = 0
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskGenericEnfProfileBuilder **
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskAgentEnfProfileBuilder **
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskAppEnfProfileBuilder **
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskCliEnforcement **
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 h=12164 c=R000001da-01-62a6f982] INFO Core.PETaskCliEnforcement - startHandler: No commands for CLI enforcement
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskRadiusEnfProfileBuilder **
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskCliEnforcement **
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12159 c=R000001da-01-62a6f982] INFO Core.PETaskRadiusCoAEnfProfileBuilder - getApplicableProfiles: No radius_coa enforcement profiles applicable for this device
    2022-06-13 16:47:45,362 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskRadiusCoAEnfProfileBuilder **
    2022-06-13 16:47:45,366 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12162 c=R000001da-01-62a6f982] INFO Core.PETaskPostAuthEnfProfileBuilder - getApplicableProfiles: No Post auth enforcement profiles applicable for this device
    2022-06-13 16:47:45,367 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskPostAuthEnfProfileBuilder **
    2022-06-13 16:47:45,367 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskAuthStatusInfo **
    2022-06-13 16:47:45,367 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskOutputPolicyRes **
    2022-06-13 16:47:45,367 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Starting PETaskSessionLog **
    2022-06-13 16:47:45,371 [RequestHandler-1-0x7fb68bcc6700 h=12166 c=R000001da-01-62a6f982] INFO Core.XpipPolicyResHandler - populateResponseTlv: PETaskPostureOutput does not exist. Skip sending posture VAFs
    2022-06-13 16:47:45,371 [RequestHandler-1-0x7fb68bcc6700 h=12166 c=R000001da-01-62a6f982] INFO Core.PolicyResCollector - getSohr: Failed to generate Sohr
    2022-06-13 16:47:45,371 [RequestHandler-1-0x7fb68bcc6700 h=12165 c=R000001da-01-62a6f982] INFO Core.PolicyResCollector - getSohr: Failed to generate Sohr
    2022-06-13 16:47:45,372 [main SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - Policy Evaluation time = 24 ms
    2022-06-13 16:47:45,372 [main SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_policy: Received Accept Enforcement Profile
    2022-06-13 16:47:45,372 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskSessionLog **
    2022-06-13 16:47:45,372 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskOutputPolicyRes **
    2022-06-13 16:47:45,372 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - ** Completed PETaskAuthStatusInfo **
    2022-06-13 16:47:45,372 [RequestHandler-1-0x7fb68bcc6700 r=R000001da-01-62a6f982 h=12152 c=R000001da-01-62a6f982] INFO Core.PETaskScheduler - *** PE_TASK_SCHEDULE_RADIUS Completed ***
    2022-06-13 16:47:45,373 [main SessId R000001da-01-62a6f982] INFO RadiusServer.Radius - rlm_policy: Policy Server reply does not contain Posture-Validation-Response


  • 2.  RE: Client did not complete EAP transaction

    Posted Jun 16, 2022 10:58 AM
    we are having something happen very similar, some clients are not able to authenticate... usually right when they come in for the day.... if they unplug their network cable then plug back in they seem to be able to get a connection and are able to log on.  other older forum posts i have found stated that it might be a cert issue?  we are still looking it this as well.
    Original Message


  • 3.  RE: Client did not complete EAP transaction

    Posted Jan 16, 2023 05:32 PM
    Hello @hevin27, were you able to figure out what the problem was?
    I'm experiencing something similar, it's not happening with all clients just a bunch but enough to make it annoying.
    Most Win10

    I tried to force TLS1.2 from Win registry - this was something that worked for Win7 machines- but no luck.
    EAP-TLS 1.2 and Windows Clients | Security (arubanetworks.com)



    ​
    Original Message


  • 4.  RE: Client did not complete EAP transaction

    EMPLOYEE
    Posted Jan 16, 2023 08:07 PM
    Hi @CarlosRG,

    What is the alert you are seeing for the effected service requests in Access Tracker? Are they client timeouts?

    A number of timeouts may occur due to the way a client transitions away from a network. For example a sleeping client may not complete the EAP process, resulting in a timeout in the ClearPass logs. ​Are you seeing excessive timeouts? Can you correlate them to a poor performing client?
    Original Message


  • 5.  RE: Client did not complete EAP transaction

    Posted Jan 17, 2023 08:37 PM

    Hello @ProbeRequest.
    Yes, all alerts are Timeouts. Client is not roaming at all and AP is not crowded and servicing other clients with no issues.

    Can you correlate them to a poor performing client?

    Yesterday all I got was "Can't connect to this network". Today after upgrading WiFi NIC, is asking me now for my credentials, which in my environment is not needed as we check other parameters in AD.

    If it's helpful at all, client is a Micro Dell PC.


    Original Message


  • 6.  RE: Client did not complete EAP transaction

    Posted Jan 17, 2023 08:47 PM
    Hi @CarlosRG,

    Maybe you can try this. Now most of my traffic is already working.
    ​

    Server Configuration ----->  Service Parameters ----->  Radius Server​
    Original Message


  • 7.  RE: Client did not complete EAP transaction

    EMPLOYEE
    Posted Jan 18, 2023 06:03 AM
    I wonder if it is something to do with the Radius Server certificate. Have you self signed that or obtained it from a third party CA?

    Are you noticing any useful log events on the client?

    What wireless platform are you on (IAP, AOS10, Controller-based)? 

    There is a command to show the authentication trace-buffer. This could be helpful to troubleshoot the wireless infrastructure end of the client authentication.

    On IAP the command is:
    show ap debug auth-trace-buf ​


    Similarly, some packet captures (using Wireshark) from the client while it is attempting to authenticate may show something interesting about why it is not completing the EAP process.


    Original Message


  • 8.  RE: Client did not complete EAP transaction

    Posted Jan 18, 2023 10:58 AM
    Hello @ProbeRequest.

    It's a 3rd Party issued cert.
    No useful logs or captures. Wireshark does not capture anything at all with this SSID, if I try another "open" network WS start to show capture logs immediately.

    Wireless platform: Meraki.

    Hello @hevin27. 
    I have TLS1.0 and 1.1 disabled per security reasons so that is not an option for me.
    Thanks for your suggestion.
    ​​​
    Original Message


  • 9.  RE: Client did not complete EAP transaction

    Posted Jan 18, 2023 07:44 AM
    Not sure if it is useful in your case but we run into this a lot.   We do user and machine auth and our wireless policies are all managed by GPOs.  99% of the time we see this error it is due to GPO settings needing to be updated on the users PC.
    Original Message


  • 10.  RE: Client did not complete EAP transaction

    Posted Jan 18, 2023 11:04 AM
    Hello @ascott.

    You run a specific command on client side to upgrade GPO other than the regular gpupdate?​
    I tried that one too and no luck.

    Thanks.
    Original Message


  • 11.  RE: Client did not complete EAP transaction

    Posted Jan 18, 2023 11:07 AM
    When clients have this issue for us we have them run a gpupdate /force and reboot.   Usually its an issue with the PC certs not matching the CPPM certs.  Sometimes we have to dig into the clients certs in the GpResults file to make sure they are getting the GPO updates correctly.  It is not always the case that they do.
    Original Message


  • 12.  RE: Client did not complete EAP transaction

    Posted Jan 26, 2023 01:57 AM
    Hello timeouts usually appear if you have this in your adapter settings :

    If you not defined the server name or the CN of the radius certificate you will always timeout
    Original Message


  • 13.  RE: Client did not complete EAP transaction

    Posted Feb 21, 2023 05:58 PM

    I check that portion but everything looks fine. 

    Thanks for the suggestion thou.


    Original Message


  • 14.  RE: Client did not complete EAP transaction

    EMPLOYEE
    Posted Feb 21, 2023 06:05 PM

    The settings you highlight here are important security settings allowing the client to validate the radius server prior to sending credentials. Outside of testing I would always ensure these are configured.


    Original Message


  • 15.  RE: Client did not complete EAP transaction

    Posted Feb 22, 2023 06:43 AM

    Have you checked if Credential Guard is enabled on the Windows PCs? This feature disables ms-chap-v2 protocol, which causes PEAP to stop working as well.

    We just had this 2 weeks ago with a customer. The Windows team activates the feature, and the network team wonders why authentication suddenly doesn't work.

    If it really is the Credential Guard, you can switch to TLS authentication.



    ------------------------------
    Regards,

    Waldemar
    ACCX # 1377, ACEP, ACA - Network Security
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------

    Original Message


  • 16.  RE: Client did not complete EAP transaction

    MVP EXPERT
    Posted Feb 22, 2023 09:14 AM

    I known this an old topic but still feel the need to replay to this because many people facing "EAP Client Timeout Issues" for different reasons.

    The message "EAP Client Timeout" doesn't always mean a client issue, and sometimes it does. It means that there is no EAP response to a EAP Challenge. Aruba ClearPass send a EAP Challenge, wait for a response and will timeout after say 50 seconds.

    There could be many reasons for this:

    1. Is the EAP-Challenge send by ClearPass correctly?
    2. Is the EAP-Challange received by the Client correctly?
    3. Did the Client send a EAP-Response back to ClearPass
    4. Did the EAP-Response received by ClearPass
    5. Did we receive all UDP segments our have we some lost segments.

    Sometime the issue is the client driver or a misconfiguration on the client end, other times may the network cause the issue.

    When facing EAP Timeouts allways start with a packet capture and analyse if all challenges and response are go in and out on both sites of the connection. Many times you wil easy find the root-cause this way. Step 1 troubleshooting action make a wireshark captures! You can easly create packet-captures in ClearPass under server management.


    ------------------------------
    Marcel Koedijk | MVP Expert 2022 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own
    ------------------------------

    Original Message


  • 17.  RE: Client did not complete EAP transaction

    Posted Feb 22, 2023 01:12 PM

    I spent a lot of time troubleshooting this and was even able to capture timeouts in a packet capture.  Aruba TAC kept said the client device was not responding to the Clearpass request.  We kept receiving more issues from users.  We are just finishing up resolving the issue today and created a one page word doc that I posted on youtube to hopefully help others out.  Our Event was 9002. 

    https://youtu.be/Hl-mPWRHvWU


    Original Message