Wired 802.1x Authentication through HP Procurve 2650 to Cisco ACS 5.0

[cenk sasmaztin]

can you check MTU size on ACS device network interface

[cenk sasmaztin]

please say me result

[Rob Mengert]

The ACS is connected on a GigEthernet port, MTU is 1500 bytes. That shouldn't make a difference.

[cenk sasmaztin]

ok please test for me

hp switch return image H_10_50 and retest with same config

[cenk sasmaztin]

5400 switch 13_10 software with resolve this problem

RADIUS (0000001164) â The switch drops RADIUS messages with EAP-packets larger
than 1496 bytes

may be same proble 10_74

please return 10_50 and test same config

[cenk sasmaztin]

or you can change MTU size cisco device

for example 1400 byte

and retest with 10_74

[Rob Mengert]

I loaded h.10.50, still seeing the same behavior.

nycorp1acs-test# show ver
Image stamp: /sw/code/build/fish(mkfs)
Oct 9 2007 15:00:51
H.10.50
359
Boot Image: Primary

[Rob Mengert]

I was finally able to get a network capture from in front of the ACS and verified traffic from the switch is getting there without a problem. I also got a capture of a successful authentication attempt through a Cisco switch and saw differences in the authentication sequences.

Through the Cisco switch:
switch -> host: EAP Request Identity
host -> switch: EAP Response Identity
switch -> host: EAP Request, MD5-Challenge
host -> switch: EAP Legacy Nak (Repsonse only)
switch -> host: EAP Request, PEAP
host -> switch: EAP Response, PEAP

Next the host opens an encrypted connection to the switch.

Through HP switch:
switch -> host: EAP Request Identity
host -> switch: EAP Response Identity
host -> switch: EAPOL Start
host -> switch: EAPOL Start
switch -> host: EAP Request Identity
host -> switch: EAP Response Identity

At this point the switch shuts the interface down and the client assumes that the network connection is faulty and assigns itself a non routable APIPA address

[Pieter 't Hart]

>>>
I'm not quite sure what you are referring to as far as Radius dialects are concerned.
<<<

Rob, I attached a screenshot of the setting I mean.

network-config -> Network Device Groups -> -> AAA Clients -> -> "authenticate using..."

[Rob Mengert]

This issue actually turned out to be a bug on the ACS. For those of you who have a CCO account.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsy17858