802.1x not resetting during reboot.

[DMcCoy_1]

I have 802.1x authentication being used extensively and authenticate machines with their Microsoft domain computer accounts.

This is all working as it should, the problem is when I reboot an authenticated machine.

I use the unauthenticated vlan to ghost clients and provide other services required to join the domain, I normally reboot a client to ghost a new image version onto it etc.

The problem is this: Some clients retain their old *authenticated* VLAN and susequently IP despire being rebooted (sometimes numerous times) the only way to force a new authentication is to unplug the cable and wait a few seconds.

Shouldn't the switch begin a new authentication session when the machine reboots? Or is this a machine fault keeping the card active during the reboot?

It's worse on specific switch versions (2848s) and machine types (intel board) although by no means exclusive to these.

Would something like the reauthentication period fix it? or simply cause issues to the logged in machines when they are working normally.

[Jeff Carrell]

if the NIC doesn't go down during a pc reboot, then the switch won't see a state change on its port and it won't drop the auth status...

reauth timers may help you, depends on what could happen if a user was "doing something" on the network that a reauth would disrupt (like saving a file, client-server appl, etc)...

hth...jeff

[cenk sasmaztin]

hi
this problem cause:clint is not logoff on radius

if you can have xp sp2 client (supplicant)
you can enter two registery key on windows xp machine

please look attach

[DMcCoy_1]

I'm using XP SP3 clients with 802.1x settings deployed from the GPO, I'll have to check but I'm not sure if that option works any more. It may be one of the gpo settings now, I shall experiment with the settings and see if it works.

[Jeff Carrell]

sp3 has the eap logoff function working in it now...you don't need the special registry patch as in sp2...

hth...jeff